commit 96afc04eaae89dcaae4aaf7a63d5dcbf4b1e7d57
author yoshi-code-bot <70984784+yoshi-code-bot@users.noreply.github.com> Tue Aug 24 00:22:31 2021 -0700
committer GitHub <noreply@github.com> Tue Aug 24 07:22:31 2021 +0000
tree 789d19c2277e57f9b69c768ea77feb7b38c695c7
parent 861fe70f69f29d619093aae1e4c795792a0dfd9f

chore: Update discovery artifacts (#1493)

## Deleted keys were detected in the following stable discovery artifacts:
documentai v1 https://github.com/googleapis/google-api-python-client/commit/3d6892c775b31d0ed6caead07666e423dccdba62
iam v1 https://github.com/googleapis/google-api-python-client/commit/98682633e8d244ca7bbf5b3726ed305e338a1cdd
osconfig v1 https://github.com/googleapis/google-api-python-client/commit/588812ffa314a68be1be61e229a187aecbe587e4

## Deleted keys were detected in the following pre-stable discovery artifacts:
compute alpha https://github.com/googleapis/google-api-python-client/commit/3740a88b497c25e6a5aee22f873c33117034f8fa
compute beta https://github.com/googleapis/google-api-python-client/commit/3740a88b497c25e6a5aee22f873c33117034f8fa
documentai v1beta3 https://github.com/googleapis/google-api-python-client/commit/3d6892c775b31d0ed6caead07666e423dccdba62
ideahub v1alpha https://github.com/googleapis/google-api-python-client/commit/942102dcc79691866f8febbb732e477d0e5227b4

## Discovery Artifact Change Summary:
feat(analyticsadmin): update the api https://github.com/googleapis/google-api-python-client/commit/8e0c67f316381ec1ad358a079207215293093603
feat(apigee): update the api https://github.com/googleapis/google-api-python-client/commit/9fd19ee8a70661be02219133dda1b80d71ac4f4b
feat(appengine): update the api https://github.com/googleapis/google-api-python-client/commit/9727d32278b91dfa30d4c8c597755323741f8cd4
feat(bigquerydatatransfer): update the api https://github.com/googleapis/google-api-python-client/commit/0b36baa0400731507365bf477cc223729d5a109d
feat(cloudfunctions): update the api https://github.com/googleapis/google-api-python-client/commit/c138aff559b32709a8a81c271ab5c0c48ea3acbe
feat(compute): update the api https://github.com/googleapis/google-api-python-client/commit/3740a88b497c25e6a5aee22f873c33117034f8fa
feat(container): update the api https://github.com/googleapis/google-api-python-client/commit/90b095a5de68d5aebcfbea16078b4727774366f4
feat(containeranalysis): update the api https://github.com/googleapis/google-api-python-client/commit/07d2f4383aef325a7351831909e6cfc4b4b9f889
feat(documentai): update the api https://github.com/googleapis/google-api-python-client/commit/3d6892c775b31d0ed6caead07666e423dccdba62
feat(gkehub): update the api https://github.com/googleapis/google-api-python-client/commit/1676d9f17b499d3bb13f80ad9c4fbd0621961a41
feat(iam): update the api https://github.com/googleapis/google-api-python-client/commit/98682633e8d244ca7bbf5b3726ed305e338a1cdd
feat(ideahub): update the api https://github.com/googleapis/google-api-python-client/commit/942102dcc79691866f8febbb732e477d0e5227b4
feat(ondemandscanning): update the api https://github.com/googleapis/google-api-python-client/commit/97169382a9d0c80bf56af157a16c5b96cb95e6dd
feat(osconfig): update the api https://github.com/googleapis/google-api-python-client/commit/588812ffa314a68be1be61e229a187aecbe587e4
feat(people): update the api https://github.com/googleapis/google-api-python-client/commit/213598c2a41d6724368e1089bc3cbcaa0b2932c5
feat(securitycenter): update the api https://github.com/googleapis/google-api-python-client/commit/74bee354cf1dbaf388de26e756e9aeebe0baa311
feat(slides): update the api https://github.com/googleapis/google-api-python-client/commit/623c740d1333cfea2b5946cc22ebcc2c44a2197d
feat(tagmanager): update the api https://github.com/googleapis/google-api-python-client/commit/98664145c692ed1ca947bdb081a7463897655d28

docs/dyn/analyticsadmin_v1alpha.accounts.html

diff --git a/docs/dyn/analyticsadmin_v1alpha.accounts.html b/docs/dyn/analyticsadmin_v1alpha.accounts.html
index 00a4c19..049d914 100644
--- a/docs/dyn/analyticsadmin_v1alpha.accounts.html
+++ b/docs/dyn/analyticsadmin_v1alpha.accounts.html
@@ -379,6 +379,11 @@
               "parameterName": "A String", # Required. Immutable. Tagging name for this custom metric. If this is an event-scoped metric, then this is the event parameter name. May only contain alphanumeric and underscore charactes, starting with a letter. Max length of 40 characters for event-scoped metrics.
               "scope": "A String", # Required. Immutable. The scope of this custom metric.
             },
+            "dataRetentionSettings": { # Settings values for data retention. This is a singleton resource. # A snapshot of a data retention settings resource in change history.
+              "eventDataRetention": "A String", # The length of time that event-level data is retained.
+              "name": "A String", # Output only. Resource name for this DataRetentionSetting resource. Format: properties/{property}/dataRetentionSettings
+              "resetUserDataOnNewActivity": True or False, # If true, reset the retention period for the user identifier with every event from that user.
+            },
             "displayVideo360AdvertiserLink": { # A link between a GA4 property and a Display & Video 360 advertiser. # A snapshot of a DisplayVideo360AdvertiserLink resource in change history.
               "adsPersonalizationEnabled": True or False, # Enables personalized advertising features with this integration. If this field is not set on create/update, it will be defaulted to true.
               "advertiserDisplayName": "A String", # Output only. The display name of the Display & Video 360 Advertiser.
@@ -496,6 +501,11 @@
               "parameterName": "A String", # Required. Immutable. Tagging name for this custom metric. If this is an event-scoped metric, then this is the event parameter name. May only contain alphanumeric and underscore charactes, starting with a letter. Max length of 40 characters for event-scoped metrics.
               "scope": "A String", # Required. Immutable. The scope of this custom metric.
             },
+            "dataRetentionSettings": { # Settings values for data retention. This is a singleton resource. # A snapshot of a data retention settings resource in change history.
+              "eventDataRetention": "A String", # The length of time that event-level data is retained.
+              "name": "A String", # Output only. Resource name for this DataRetentionSetting resource. Format: properties/{property}/dataRetentionSettings
+              "resetUserDataOnNewActivity": True or False, # If true, reset the retention period for the user identifier with every event from that user.
+            },
             "displayVideo360AdvertiserLink": { # A link between a GA4 property and a Display & Video 360 advertiser. # A snapshot of a DisplayVideo360AdvertiserLink resource in change history.
               "adsPersonalizationEnabled": True or False, # Enables personalized advertising features with this integration. If this field is not set on create/update, it will be defaulted to true.
               "advertiserDisplayName": "A String", # Output only. The display name of the Display & Video 360 Advertiser.

docs/dyn/analyticsadmin_v1alpha.properties.html

diff --git a/docs/dyn/analyticsadmin_v1alpha.properties.html b/docs/dyn/analyticsadmin_v1alpha.properties.html
index 20105d0..2415b39 100644
--- a/docs/dyn/analyticsadmin_v1alpha.properties.html
+++ b/docs/dyn/analyticsadmin_v1alpha.properties.html
@@ -142,6 +142,9 @@
   <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
 <p class="firstline">Lookup for a single "GA4" Property.</p>
 <p class="toc_element">
+  <code><a href="#getDataRetentionSettings">getDataRetentionSettings(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Returns the singleton data retention settings for this property.</p>
+<p class="toc_element">
   <code><a href="#getGoogleSignalsSettings">getGoogleSignalsSettings(name, x__xgafv=None)</a></code></p>
 <p class="firstline">Lookup for Google Signals settings for a property.</p>
 <p class="toc_element">
@@ -154,6 +157,9 @@
   <code><a href="#patch">patch(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Updates a property.</p>
 <p class="toc_element">
+  <code><a href="#updateDataRetentionSettings">updateDataRetentionSettings(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Updates the singleton data retention settings for this property.</p>
+<p class="toc_element">
   <code><a href="#updateGoogleSignalsSettings">updateGoogleSignalsSettings(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Updates Google Signals settings for a property.</p>
 <h3>Method Details</h3>
@@ -266,6 +272,27 @@
 </div>
 
 <div class="method">
+    <code class="details" id="getDataRetentionSettings">getDataRetentionSettings(name, x__xgafv=None)</code>
+  <pre>Returns the singleton data retention settings for this property.
+
+Args:
+  name: string, Required. The name of the settings to lookup. Format: properties/{property}/dataRetentionSettings Example: &quot;properties/1000/dataRetentionSettings&quot; (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Settings values for data retention. This is a singleton resource.
+  &quot;eventDataRetention&quot;: &quot;A String&quot;, # The length of time that event-level data is retained.
+  &quot;name&quot;: &quot;A String&quot;, # Output only. Resource name for this DataRetentionSetting resource. Format: properties/{property}/dataRetentionSettings
+  &quot;resetUserDataOnNewActivity&quot;: True or False, # If true, reset the retention period for the user identifier with every event from that user.
+}</pre>
+</div>
+
+<div class="method">
     <code class="details" id="getGoogleSignalsSettings">getGoogleSignalsSettings(name, x__xgafv=None)</code>
   <pre>Lookup for Google Signals settings for a property.
 
@@ -385,6 +412,37 @@
 </div>
 
 <div class="method">
+    <code class="details" id="updateDataRetentionSettings">updateDataRetentionSettings(name, body=None, updateMask=None, x__xgafv=None)</code>
+  <pre>Updates the singleton data retention settings for this property.
+
+Args:
+  name: string, Output only. Resource name for this DataRetentionSetting resource. Format: properties/{property}/dataRetentionSettings (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Settings values for data retention. This is a singleton resource.
+  &quot;eventDataRetention&quot;: &quot;A String&quot;, # The length of time that event-level data is retained.
+  &quot;name&quot;: &quot;A String&quot;, # Output only. Resource name for this DataRetentionSetting resource. Format: properties/{property}/dataRetentionSettings
+  &quot;resetUserDataOnNewActivity&quot;: True or False, # If true, reset the retention period for the user identifier with every event from that user.
+}
+
+  updateMask: string, Required. The list of fields to be updated. Field names must be in snake case (e.g., &quot;field_to_update&quot;). Omitted fields will not be updated. To replace the entire entity, use one path with the string &quot;*&quot; to match all fields.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Settings values for data retention. This is a singleton resource.
+  &quot;eventDataRetention&quot;: &quot;A String&quot;, # The length of time that event-level data is retained.
+  &quot;name&quot;: &quot;A String&quot;, # Output only. Resource name for this DataRetentionSetting resource. Format: properties/{property}/dataRetentionSettings
+  &quot;resetUserDataOnNewActivity&quot;: True or False, # If true, reset the retention period for the user identifier with every event from that user.
+}</pre>
+</div>
+
+<div class="method">
     <code class="details" id="updateGoogleSignalsSettings">updateGoogleSignalsSettings(name, body=None, updateMask=None, x__xgafv=None)</code>
   <pre>Updates Google Signals settings for a property.
 

docs/dyn/apigateway_v1.projects.locations.apis.configs.html

diff --git a/docs/dyn/apigateway_v1.projects.locations.apis.configs.html b/docs/dyn/apigateway_v1.projects.locations.apis.configs.html
index 24ae68a..c8be294 100644
--- a/docs/dyn/apigateway_v1.projects.locations.apis.configs.html
+++ b/docs/dyn/apigateway_v1.projects.locations.apis.configs.html
@@ -301,7 +301,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -506,7 +506,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -548,7 +548,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/apigateway_v1.projects.locations.apis.html

diff --git a/docs/dyn/apigateway_v1.projects.locations.apis.html b/docs/dyn/apigateway_v1.projects.locations.apis.html
index c7ac66c..2cd0c59 100644
--- a/docs/dyn/apigateway_v1.projects.locations.apis.html
+++ b/docs/dyn/apigateway_v1.projects.locations.apis.html
@@ -243,7 +243,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -390,7 +390,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -432,7 +432,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/apigateway_v1.projects.locations.gateways.html

diff --git a/docs/dyn/apigateway_v1.projects.locations.gateways.html b/docs/dyn/apigateway_v1.projects.locations.gateways.html
index da3a245..54e556d 100644
--- a/docs/dyn/apigateway_v1.projects.locations.gateways.html
+++ b/docs/dyn/apigateway_v1.projects.locations.gateways.html
@@ -240,7 +240,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -389,7 +389,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -431,7 +431,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/apigateway_v1beta.projects.locations.apis.configs.html

diff --git a/docs/dyn/apigateway_v1beta.projects.locations.apis.configs.html b/docs/dyn/apigateway_v1beta.projects.locations.apis.configs.html
index bc81922..5785319 100644
--- a/docs/dyn/apigateway_v1beta.projects.locations.apis.configs.html
+++ b/docs/dyn/apigateway_v1beta.projects.locations.apis.configs.html
@@ -311,7 +311,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -526,7 +526,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -568,7 +568,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/apigateway_v1beta.projects.locations.apis.html

diff --git a/docs/dyn/apigateway_v1beta.projects.locations.apis.html b/docs/dyn/apigateway_v1beta.projects.locations.apis.html
index c85bc5f..95080c4 100644
--- a/docs/dyn/apigateway_v1beta.projects.locations.apis.html
+++ b/docs/dyn/apigateway_v1beta.projects.locations.apis.html
@@ -243,7 +243,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -390,7 +390,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -432,7 +432,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/apigateway_v1beta.projects.locations.gateways.html

diff --git a/docs/dyn/apigateway_v1beta.projects.locations.gateways.html b/docs/dyn/apigateway_v1beta.projects.locations.gateways.html
index 03dad82..8040568 100644
--- a/docs/dyn/apigateway_v1beta.projects.locations.gateways.html
+++ b/docs/dyn/apigateway_v1beta.projects.locations.gateways.html
@@ -240,7 +240,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -389,7 +389,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -431,7 +431,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/apigee_v1.organizations.apis.html

diff --git a/docs/dyn/apigee_v1.organizations.apis.html b/docs/dyn/apigee_v1.organizations.apis.html
index 8837885..e05a245 100644
--- a/docs/dyn/apigee_v1.organizations.apis.html
+++ b/docs/dyn/apigee_v1.organizations.apis.html
@@ -104,6 +104,9 @@
 <p class="toc_element">
   <code><a href="#list">list(parent, includeMetaData=None, includeRevisions=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Lists the names of all API proxies in an organization. The names returned correspond to the names defined in the configuration files for each API proxy.</p>
+<p class="toc_element">
+  <code><a href="#patch">patch(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Updates an existing API proxy.</p>
 <h3>Method Details</h3>
 <div class="method">
     <code class="details" id="close">close()</code>
@@ -297,4 +300,55 @@
 }</pre>
 </div>
 
+<div class="method">
+    <code class="details" id="patch">patch(name, body=None, updateMask=None, x__xgafv=None)</code>
+  <pre>Updates an existing API proxy.
+
+Args:
+  name: string, Required. API proxy to update in the following format: `organizations/{org}/apis/{api}` (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Metadata describing the API proxy
+  &quot;labels&quot;: { # User labels applied to this API Proxy.
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;latestRevisionId&quot;: &quot;A String&quot;, # Output only. The id of the most recently created revision for this api proxy.
+  &quot;metaData&quot;: { # Metadata common to many entities in this API. # Output only. Metadata describing the API proxy.
+    &quot;createdAt&quot;: &quot;A String&quot;, # Time at which the API proxy was created, in milliseconds since epoch.
+    &quot;lastModifiedAt&quot;: &quot;A String&quot;, # Time at which the API proxy was most recently modified, in milliseconds since epoch.
+    &quot;subType&quot;: &quot;A String&quot;, # The type of entity described
+  },
+  &quot;name&quot;: &quot;A String&quot;, # Output only. Name of the API proxy.
+  &quot;revision&quot;: [ # Output only. List of revisons defined for the API proxy.
+    &quot;A String&quot;,
+  ],
+}
+
+  updateMask: string, Required. The list of fields to update.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Metadata describing the API proxy
+  &quot;labels&quot;: { # User labels applied to this API Proxy.
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;latestRevisionId&quot;: &quot;A String&quot;, # Output only. The id of the most recently created revision for this api proxy.
+  &quot;metaData&quot;: { # Metadata common to many entities in this API. # Output only. Metadata describing the API proxy.
+    &quot;createdAt&quot;: &quot;A String&quot;, # Time at which the API proxy was created, in milliseconds since epoch.
+    &quot;lastModifiedAt&quot;: &quot;A String&quot;, # Time at which the API proxy was most recently modified, in milliseconds since epoch.
+    &quot;subType&quot;: &quot;A String&quot;, # The type of entity described
+  },
+  &quot;name&quot;: &quot;A String&quot;, # Output only. Name of the API proxy.
+  &quot;revision&quot;: [ # Output only. List of revisons defined for the API proxy.
+    &quot;A String&quot;,
+  ],
+}</pre>
+</div>
+
 </body></html>
\ No newline at end of file

docs/dyn/apigee_v1.organizations.environments.html

diff --git a/docs/dyn/apigee_v1.organizations.environments.html b/docs/dyn/apigee_v1.organizations.environments.html
index 26d9f29..d24f552 100644
--- a/docs/dyn/apigee_v1.organizations.environments.html
+++ b/docs/dyn/apigee_v1.organizations.environments.html
@@ -553,7 +553,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -620,7 +620,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -662,7 +662,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/appengine_v1.apps.html

diff --git a/docs/dyn/appengine_v1.apps.html b/docs/dyn/appengine_v1.apps.html
index 1510cc1..efba51b 100644
--- a/docs/dyn/appengine_v1.apps.html
+++ b/docs/dyn/appengine_v1.apps.html
@@ -166,6 +166,7 @@
   "id": "A String", # Identifier of the Application resource. This identifier is equivalent to the project ID of the Google Cloud Platform project where you want to deploy your application. Example: myapp.
   "locationId": "A String", # Location from which this application runs. Application instances run out of the data centers in the specified location, which is also where all of the application's end user content is stored.Defaults to us-central.View the list of supported locations (https://cloud.google.com/appengine/docs/locations).
   "name": "A String", # Full path to the Application resource in the API. Example: apps/myapp.@OutputOnly
+  "serviceAccount": "A String", # The service account associated with the application. This is the app-level default identity. If no identity provided during create version, Admin API will fallback to this one.
   "servingStatus": "A String", # Serving status of this application.
 }
 
@@ -240,6 +241,7 @@
   "id": "A String", # Identifier of the Application resource. This identifier is equivalent to the project ID of the Google Cloud Platform project where you want to deploy your application. Example: myapp.
   "locationId": "A String", # Location from which this application runs. Application instances run out of the data centers in the specified location, which is also where all of the application's end user content is stored.Defaults to us-central.View the list of supported locations (https://cloud.google.com/appengine/docs/locations).
   "name": "A String", # Full path to the Application resource in the API. Example: apps/myapp.@OutputOnly
+  "serviceAccount": "A String", # The service account associated with the application. This is the app-level default identity. If no identity provided during create version, Admin API will fallback to this one.
   "servingStatus": "A String", # Serving status of this application.
 }</pre>
 </div>
@@ -281,6 +283,7 @@
   &quot;id&quot;: &quot;A String&quot;, # Identifier of the Application resource. This identifier is equivalent to the project ID of the Google Cloud Platform project where you want to deploy your application. Example: myapp.
   &quot;locationId&quot;: &quot;A String&quot;, # Location from which this application runs. Application instances run out of the data centers in the specified location, which is also where all of the application&#x27;s end user content is stored.Defaults to us-central.View the list of supported locations (https://cloud.google.com/appengine/docs/locations).
   &quot;name&quot;: &quot;A String&quot;, # Full path to the Application resource in the API. Example: apps/myapp.@OutputOnly
+  &quot;serviceAccount&quot;: &quot;A String&quot;, # The service account associated with the application. This is the app-level default identity. If no identity provided during create version, Admin API will fallback to this one.
   &quot;servingStatus&quot;: &quot;A String&quot;, # Serving status of this application.
 }
 

docs/dyn/appengine_v1beta.apps.html

diff --git a/docs/dyn/appengine_v1beta.apps.html b/docs/dyn/appengine_v1beta.apps.html
index 9b71864..b6b9c6b 100644
--- a/docs/dyn/appengine_v1beta.apps.html
+++ b/docs/dyn/appengine_v1beta.apps.html
@@ -166,6 +166,7 @@
   "id": "A String", # Identifier of the Application resource. This identifier is equivalent to the project ID of the Google Cloud Platform project where you want to deploy your application. Example: myapp.
   "locationId": "A String", # Location from which this application runs. Application instances run out of the data centers in the specified location, which is also where all of the application's end user content is stored.Defaults to us-central.View the list of supported locations (https://cloud.google.com/appengine/docs/locations).
   "name": "A String", # Full path to the Application resource in the API. Example: apps/myapp.@OutputOnly
+  "serviceAccount": "A String", # The service account associated with the application. This is the app-level default identity. If no identity provided during create version, Admin API will fallback to this one.
   "servingStatus": "A String", # Serving status of this application.
 }
 
@@ -240,6 +241,7 @@
   "id": "A String", # Identifier of the Application resource. This identifier is equivalent to the project ID of the Google Cloud Platform project where you want to deploy your application. Example: myapp.
   "locationId": "A String", # Location from which this application runs. Application instances run out of the data centers in the specified location, which is also where all of the application's end user content is stored.Defaults to us-central.View the list of supported locations (https://cloud.google.com/appengine/docs/locations).
   "name": "A String", # Full path to the Application resource in the API. Example: apps/myapp.@OutputOnly
+  "serviceAccount": "A String", # The service account associated with the application. This is the app-level default identity. If no identity provided during create version, Admin API will fallback to this one.
   "servingStatus": "A String", # Serving status of this application.
 }</pre>
 </div>
@@ -281,6 +283,7 @@
   &quot;id&quot;: &quot;A String&quot;, # Identifier of the Application resource. This identifier is equivalent to the project ID of the Google Cloud Platform project where you want to deploy your application. Example: myapp.
   &quot;locationId&quot;: &quot;A String&quot;, # Location from which this application runs. Application instances run out of the data centers in the specified location, which is also where all of the application&#x27;s end user content is stored.Defaults to us-central.View the list of supported locations (https://cloud.google.com/appengine/docs/locations).
   &quot;name&quot;: &quot;A String&quot;, # Full path to the Application resource in the API. Example: apps/myapp.@OutputOnly
+  &quot;serviceAccount&quot;: &quot;A String&quot;, # The service account associated with the application. This is the app-level default identity. If no identity provided during create version, Admin API will fallback to this one.
   &quot;servingStatus&quot;: &quot;A String&quot;, # Serving status of this application.
 }
 

docs/dyn/bigquery_v2.routines.html

diff --git a/docs/dyn/bigquery_v2.routines.html b/docs/dyn/bigquery_v2.routines.html
index 4c4d3ad..781a05e 100644
--- a/docs/dyn/bigquery_v2.routines.html
+++ b/docs/dyn/bigquery_v2.routines.html
@@ -144,15 +144,15 @@
   ],
   "creationTime": "A String", # Output only. The time when this routine was created, in milliseconds since the epoch.
   "definitionBody": "A String", # Required. The body of the routine. For functions, this is the expression in the AS clause. If language=SQL, it is the substring inside (but excluding) the parentheses. For example, for the function created with the following statement: `CREATE FUNCTION JoinLines(x string, y string) as (concat(x, "\n", y))` The definition_body is `concat(x, "\n", y)` (\n is not replaced with linebreak). If language=JAVASCRIPT, it is the evaluated string in the AS clause. For example, for the function created with the following statement: `CREATE FUNCTION f() RETURNS STRING LANGUAGE js AS 'return "\n";\n'` The definition_body is `return "\n";\n` Note that both \n are replaced with linebreaks.
-  "description": "A String", # Optional. [Experimental] The description of the routine if defined.
-  "determinismLevel": "A String", # Optional. [Experimental] The determinism level of the JavaScript UDF if defined.
+  "description": "A String", # Optional. The description of the routine, if defined.
+  "determinismLevel": "A String", # Optional. The determinism level of the JavaScript UDF, if defined.
   "etag": "A String", # Output only. A hash of this resource.
   "importedLibraries": [ # Optional. If language = "JAVASCRIPT", this field stores the path of the imported JAVASCRIPT libraries.
     "A String",
   ],
   "language": "A String", # Optional. Defaults to "SQL".
   "lastModifiedTime": "A String", # Output only. The time when this routine was last modified, in milliseconds since the epoch.
-  "returnTableType": { # A table type # Optional. Set only if Routine is a "TABLE_VALUED_FUNCTION".
+  "returnTableType": { # A table type # Optional. Can be set only if routine_type = "TABLE_VALUED_FUNCTION". If absent, the return table type is inferred from definition_body at query time in each query that references this routine. If present, then the columns in the evaluated table result will be cast to match the column types specificed in return table type, at query time.
     "columns": [ # The columns in this table type
       { # A field or a column.
         "name": "A String", # Optional. The name of this field. Can be absent for struct fields.
@@ -168,7 +168,7 @@
       },
     ],
   },
-  "returnType": { # The type of a variable, e.g., a function argument. Examples: INT64: {type_kind="INT64"} ARRAY: {type_kind="ARRAY", array_element_type="STRING"} STRUCT>: {type_kind="STRUCT", struct_type={fields=[ {name="x", type={type_kind="STRING"}}, {name="y", type={type_kind="ARRAY", array_element_type="DATE"}} ]}} # Optional if language = "SQL"; required otherwise. If absent, the return type is inferred from definition_body at query time in each query that references this routine. If present, then the evaluated result will be cast to the specified returned type at query time. For example, for the functions created with the following statements: * `CREATE FUNCTION Add(x FLOAT64, y FLOAT64) RETURNS FLOAT64 AS (x + y);` * `CREATE FUNCTION Increment(x FLOAT64) AS (Add(x, 1));` * `CREATE FUNCTION Decrement(x FLOAT64) RETURNS FLOAT64 AS (Add(x, -1));` The return_type is `{type_kind: "FLOAT64"}` for `Add` and `Decrement`, and is absent for `Increment` (inferred as FLOAT64 at query time). Suppose the function `Add` is replaced by `CREATE OR REPLACE FUNCTION Add(x INT64, y INT64) AS (x + y);` Then the inferred return type of `Increment` is automatically changed to INT64 at query time, while the return type of `Decrement` remains FLOAT64.
+  "returnType": { # The type of a variable, e.g., a function argument. Examples: INT64: {type_kind="INT64"} ARRAY: {type_kind="ARRAY", array_element_type="STRING"} STRUCT>: {type_kind="STRUCT", struct_type={fields=[ {name="x", type={type_kind="STRING"}}, {name="y", type={type_kind="ARRAY", array_element_type="DATE"}} ]}} # Optional if language = "SQL"; required otherwise. Cannot be set if routine_type = "TABLE_VALUED_FUNCTION". If absent, the return type is inferred from definition_body at query time in each query that references this routine. If present, then the evaluated result will be cast to the specified returned type at query time. For example, for the functions created with the following statements: * `CREATE FUNCTION Add(x FLOAT64, y FLOAT64) RETURNS FLOAT64 AS (x + y);` * `CREATE FUNCTION Increment(x FLOAT64) AS (Add(x, 1));` * `CREATE FUNCTION Decrement(x FLOAT64) RETURNS FLOAT64 AS (Add(x, -1));` The return_type is `{type_kind: "FLOAT64"}` for `Add` and `Decrement`, and is absent for `Increment` (inferred as FLOAT64 at query time). Suppose the function `Add` is replaced by `CREATE OR REPLACE FUNCTION Add(x INT64, y INT64) AS (x + y);` Then the inferred return type of `Increment` is automatically changed to INT64 at query time, while the return type of `Decrement` remains FLOAT64.
     "arrayElementType": # Object with schema name: StandardSqlDataType # The type of the array's elements, if type_kind = "ARRAY".
     "structType": { # The fields of this struct, in order, if type_kind = "STRUCT".
       "fields": [
@@ -215,15 +215,15 @@
   ],
   "creationTime": "A String", # Output only. The time when this routine was created, in milliseconds since the epoch.
   "definitionBody": "A String", # Required. The body of the routine. For functions, this is the expression in the AS clause. If language=SQL, it is the substring inside (but excluding) the parentheses. For example, for the function created with the following statement: `CREATE FUNCTION JoinLines(x string, y string) as (concat(x, "\n", y))` The definition_body is `concat(x, "\n", y)` (\n is not replaced with linebreak). If language=JAVASCRIPT, it is the evaluated string in the AS clause. For example, for the function created with the following statement: `CREATE FUNCTION f() RETURNS STRING LANGUAGE js AS 'return "\n";\n'` The definition_body is `return "\n";\n` Note that both \n are replaced with linebreaks.
-  "description": "A String", # Optional. [Experimental] The description of the routine if defined.
-  "determinismLevel": "A String", # Optional. [Experimental] The determinism level of the JavaScript UDF if defined.
+  "description": "A String", # Optional. The description of the routine, if defined.
+  "determinismLevel": "A String", # Optional. The determinism level of the JavaScript UDF, if defined.
   "etag": "A String", # Output only. A hash of this resource.
   "importedLibraries": [ # Optional. If language = "JAVASCRIPT", this field stores the path of the imported JAVASCRIPT libraries.
     "A String",
   ],
   "language": "A String", # Optional. Defaults to "SQL".
   "lastModifiedTime": "A String", # Output only. The time when this routine was last modified, in milliseconds since the epoch.
-  "returnTableType": { # A table type # Optional. Set only if Routine is a "TABLE_VALUED_FUNCTION".
+  "returnTableType": { # A table type # Optional. Can be set only if routine_type = "TABLE_VALUED_FUNCTION". If absent, the return table type is inferred from definition_body at query time in each query that references this routine. If present, then the columns in the evaluated table result will be cast to match the column types specificed in return table type, at query time.
     "columns": [ # The columns in this table type
       { # A field or a column.
         "name": "A String", # Optional. The name of this field. Can be absent for struct fields.
@@ -239,7 +239,7 @@
       },
     ],
   },
-  "returnType": { # The type of a variable, e.g., a function argument. Examples: INT64: {type_kind="INT64"} ARRAY: {type_kind="ARRAY", array_element_type="STRING"} STRUCT>: {type_kind="STRUCT", struct_type={fields=[ {name="x", type={type_kind="STRING"}}, {name="y", type={type_kind="ARRAY", array_element_type="DATE"}} ]}} # Optional if language = "SQL"; required otherwise. If absent, the return type is inferred from definition_body at query time in each query that references this routine. If present, then the evaluated result will be cast to the specified returned type at query time. For example, for the functions created with the following statements: * `CREATE FUNCTION Add(x FLOAT64, y FLOAT64) RETURNS FLOAT64 AS (x + y);` * `CREATE FUNCTION Increment(x FLOAT64) AS (Add(x, 1));` * `CREATE FUNCTION Decrement(x FLOAT64) RETURNS FLOAT64 AS (Add(x, -1));` The return_type is `{type_kind: "FLOAT64"}` for `Add` and `Decrement`, and is absent for `Increment` (inferred as FLOAT64 at query time). Suppose the function `Add` is replaced by `CREATE OR REPLACE FUNCTION Add(x INT64, y INT64) AS (x + y);` Then the inferred return type of `Increment` is automatically changed to INT64 at query time, while the return type of `Decrement` remains FLOAT64.
+  "returnType": { # The type of a variable, e.g., a function argument. Examples: INT64: {type_kind="INT64"} ARRAY: {type_kind="ARRAY", array_element_type="STRING"} STRUCT>: {type_kind="STRUCT", struct_type={fields=[ {name="x", type={type_kind="STRING"}}, {name="y", type={type_kind="ARRAY", array_element_type="DATE"}} ]}} # Optional if language = "SQL"; required otherwise. Cannot be set if routine_type = "TABLE_VALUED_FUNCTION". If absent, the return type is inferred from definition_body at query time in each query that references this routine. If present, then the evaluated result will be cast to the specified returned type at query time. For example, for the functions created with the following statements: * `CREATE FUNCTION Add(x FLOAT64, y FLOAT64) RETURNS FLOAT64 AS (x + y);` * `CREATE FUNCTION Increment(x FLOAT64) AS (Add(x, 1));` * `CREATE FUNCTION Decrement(x FLOAT64) RETURNS FLOAT64 AS (Add(x, -1));` The return_type is `{type_kind: "FLOAT64"}` for `Add` and `Decrement`, and is absent for `Increment` (inferred as FLOAT64 at query time). Suppose the function `Add` is replaced by `CREATE OR REPLACE FUNCTION Add(x INT64, y INT64) AS (x + y);` Then the inferred return type of `Increment` is automatically changed to INT64 at query time, while the return type of `Decrement` remains FLOAT64.
     "arrayElementType": # Object with schema name: StandardSqlDataType # The type of the array's elements, if type_kind = "ARRAY".
     "structType": { # The fields of this struct, in order, if type_kind = "STRUCT".
       "fields": [
@@ -279,15 +279,15 @@
   ],
   "creationTime": "A String", # Output only. The time when this routine was created, in milliseconds since the epoch.
   "definitionBody": "A String", # Required. The body of the routine. For functions, this is the expression in the AS clause. If language=SQL, it is the substring inside (but excluding) the parentheses. For example, for the function created with the following statement: `CREATE FUNCTION JoinLines(x string, y string) as (concat(x, "\n", y))` The definition_body is `concat(x, "\n", y)` (\n is not replaced with linebreak). If language=JAVASCRIPT, it is the evaluated string in the AS clause. For example, for the function created with the following statement: `CREATE FUNCTION f() RETURNS STRING LANGUAGE js AS 'return "\n";\n'` The definition_body is `return "\n";\n` Note that both \n are replaced with linebreaks.
-  "description": "A String", # Optional. [Experimental] The description of the routine if defined.
-  "determinismLevel": "A String", # Optional. [Experimental] The determinism level of the JavaScript UDF if defined.
+  "description": "A String", # Optional. The description of the routine, if defined.
+  "determinismLevel": "A String", # Optional. The determinism level of the JavaScript UDF, if defined.
   "etag": "A String", # Output only. A hash of this resource.
   "importedLibraries": [ # Optional. If language = "JAVASCRIPT", this field stores the path of the imported JAVASCRIPT libraries.
     "A String",
   ],
   "language": "A String", # Optional. Defaults to "SQL".
   "lastModifiedTime": "A String", # Output only. The time when this routine was last modified, in milliseconds since the epoch.
-  "returnTableType": { # A table type # Optional. Set only if Routine is a "TABLE_VALUED_FUNCTION".
+  "returnTableType": { # A table type # Optional. Can be set only if routine_type = "TABLE_VALUED_FUNCTION". If absent, the return table type is inferred from definition_body at query time in each query that references this routine. If present, then the columns in the evaluated table result will be cast to match the column types specificed in return table type, at query time.
     "columns": [ # The columns in this table type
       { # A field or a column.
         "name": "A String", # Optional. The name of this field. Can be absent for struct fields.
@@ -303,7 +303,7 @@
       },
     ],
   },
-  "returnType": { # The type of a variable, e.g., a function argument. Examples: INT64: {type_kind="INT64"} ARRAY: {type_kind="ARRAY", array_element_type="STRING"} STRUCT>: {type_kind="STRUCT", struct_type={fields=[ {name="x", type={type_kind="STRING"}}, {name="y", type={type_kind="ARRAY", array_element_type="DATE"}} ]}} # Optional if language = "SQL"; required otherwise. If absent, the return type is inferred from definition_body at query time in each query that references this routine. If present, then the evaluated result will be cast to the specified returned type at query time. For example, for the functions created with the following statements: * `CREATE FUNCTION Add(x FLOAT64, y FLOAT64) RETURNS FLOAT64 AS (x + y);` * `CREATE FUNCTION Increment(x FLOAT64) AS (Add(x, 1));` * `CREATE FUNCTION Decrement(x FLOAT64) RETURNS FLOAT64 AS (Add(x, -1));` The return_type is `{type_kind: "FLOAT64"}` for `Add` and `Decrement`, and is absent for `Increment` (inferred as FLOAT64 at query time). Suppose the function `Add` is replaced by `CREATE OR REPLACE FUNCTION Add(x INT64, y INT64) AS (x + y);` Then the inferred return type of `Increment` is automatically changed to INT64 at query time, while the return type of `Decrement` remains FLOAT64.
+  "returnType": { # The type of a variable, e.g., a function argument. Examples: INT64: {type_kind="INT64"} ARRAY: {type_kind="ARRAY", array_element_type="STRING"} STRUCT>: {type_kind="STRUCT", struct_type={fields=[ {name="x", type={type_kind="STRING"}}, {name="y", type={type_kind="ARRAY", array_element_type="DATE"}} ]}} # Optional if language = "SQL"; required otherwise. Cannot be set if routine_type = "TABLE_VALUED_FUNCTION". If absent, the return type is inferred from definition_body at query time in each query that references this routine. If present, then the evaluated result will be cast to the specified returned type at query time. For example, for the functions created with the following statements: * `CREATE FUNCTION Add(x FLOAT64, y FLOAT64) RETURNS FLOAT64 AS (x + y);` * `CREATE FUNCTION Increment(x FLOAT64) AS (Add(x, 1));` * `CREATE FUNCTION Decrement(x FLOAT64) RETURNS FLOAT64 AS (Add(x, -1));` The return_type is `{type_kind: "FLOAT64"}` for `Add` and `Decrement`, and is absent for `Increment` (inferred as FLOAT64 at query time). Suppose the function `Add` is replaced by `CREATE OR REPLACE FUNCTION Add(x INT64, y INT64) AS (x + y);` Then the inferred return type of `Increment` is automatically changed to INT64 at query time, while the return type of `Decrement` remains FLOAT64.
     "arrayElementType": # Object with schema name: StandardSqlDataType # The type of the array's elements, if type_kind = "ARRAY".
     "structType": { # The fields of this struct, in order, if type_kind = "STRUCT".
       "fields": [
@@ -358,15 +358,15 @@
       ],
       "creationTime": "A String", # Output only. The time when this routine was created, in milliseconds since the epoch.
       "definitionBody": "A String", # Required. The body of the routine. For functions, this is the expression in the AS clause. If language=SQL, it is the substring inside (but excluding) the parentheses. For example, for the function created with the following statement: `CREATE FUNCTION JoinLines(x string, y string) as (concat(x, "\n", y))` The definition_body is `concat(x, "\n", y)` (\n is not replaced with linebreak). If language=JAVASCRIPT, it is the evaluated string in the AS clause. For example, for the function created with the following statement: `CREATE FUNCTION f() RETURNS STRING LANGUAGE js AS 'return "\n";\n'` The definition_body is `return "\n";\n` Note that both \n are replaced with linebreaks.
-      "description": "A String", # Optional. [Experimental] The description of the routine if defined.
-      "determinismLevel": "A String", # Optional. [Experimental] The determinism level of the JavaScript UDF if defined.
+      "description": "A String", # Optional. The description of the routine, if defined.
+      "determinismLevel": "A String", # Optional. The determinism level of the JavaScript UDF, if defined.
       "etag": "A String", # Output only. A hash of this resource.
       "importedLibraries": [ # Optional. If language = "JAVASCRIPT", this field stores the path of the imported JAVASCRIPT libraries.
         "A String",
       ],
       "language": "A String", # Optional. Defaults to "SQL".
       "lastModifiedTime": "A String", # Output only. The time when this routine was last modified, in milliseconds since the epoch.
-      "returnTableType": { # A table type # Optional. Set only if Routine is a "TABLE_VALUED_FUNCTION".
+      "returnTableType": { # A table type # Optional. Can be set only if routine_type = "TABLE_VALUED_FUNCTION". If absent, the return table type is inferred from definition_body at query time in each query that references this routine. If present, then the columns in the evaluated table result will be cast to match the column types specificed in return table type, at query time.
         "columns": [ # The columns in this table type
           { # A field or a column.
             "name": "A String", # Optional. The name of this field. Can be absent for struct fields.
@@ -382,7 +382,7 @@
           },
         ],
       },
-      "returnType": { # The type of a variable, e.g., a function argument. Examples: INT64: {type_kind="INT64"} ARRAY: {type_kind="ARRAY", array_element_type="STRING"} STRUCT>: {type_kind="STRUCT", struct_type={fields=[ {name="x", type={type_kind="STRING"}}, {name="y", type={type_kind="ARRAY", array_element_type="DATE"}} ]}} # Optional if language = "SQL"; required otherwise. If absent, the return type is inferred from definition_body at query time in each query that references this routine. If present, then the evaluated result will be cast to the specified returned type at query time. For example, for the functions created with the following statements: * `CREATE FUNCTION Add(x FLOAT64, y FLOAT64) RETURNS FLOAT64 AS (x + y);` * `CREATE FUNCTION Increment(x FLOAT64) AS (Add(x, 1));` * `CREATE FUNCTION Decrement(x FLOAT64) RETURNS FLOAT64 AS (Add(x, -1));` The return_type is `{type_kind: "FLOAT64"}` for `Add` and `Decrement`, and is absent for `Increment` (inferred as FLOAT64 at query time). Suppose the function `Add` is replaced by `CREATE OR REPLACE FUNCTION Add(x INT64, y INT64) AS (x + y);` Then the inferred return type of `Increment` is automatically changed to INT64 at query time, while the return type of `Decrement` remains FLOAT64.
+      "returnType": { # The type of a variable, e.g., a function argument. Examples: INT64: {type_kind="INT64"} ARRAY: {type_kind="ARRAY", array_element_type="STRING"} STRUCT>: {type_kind="STRUCT", struct_type={fields=[ {name="x", type={type_kind="STRING"}}, {name="y", type={type_kind="ARRAY", array_element_type="DATE"}} ]}} # Optional if language = "SQL"; required otherwise. Cannot be set if routine_type = "TABLE_VALUED_FUNCTION". If absent, the return type is inferred from definition_body at query time in each query that references this routine. If present, then the evaluated result will be cast to the specified returned type at query time. For example, for the functions created with the following statements: * `CREATE FUNCTION Add(x FLOAT64, y FLOAT64) RETURNS FLOAT64 AS (x + y);` * `CREATE FUNCTION Increment(x FLOAT64) AS (Add(x, 1));` * `CREATE FUNCTION Decrement(x FLOAT64) RETURNS FLOAT64 AS (Add(x, -1));` The return_type is `{type_kind: "FLOAT64"}` for `Add` and `Decrement`, and is absent for `Increment` (inferred as FLOAT64 at query time). Suppose the function `Add` is replaced by `CREATE OR REPLACE FUNCTION Add(x INT64, y INT64) AS (x + y);` Then the inferred return type of `Increment` is automatically changed to INT64 at query time, while the return type of `Decrement` remains FLOAT64.
         "arrayElementType": # Object with schema name: StandardSqlDataType # The type of the array's elements, if type_kind = "ARRAY".
         "structType": { # The fields of this struct, in order, if type_kind = "STRUCT".
           "fields": [
@@ -446,15 +446,15 @@
   ],
   "creationTime": "A String", # Output only. The time when this routine was created, in milliseconds since the epoch.
   "definitionBody": "A String", # Required. The body of the routine. For functions, this is the expression in the AS clause. If language=SQL, it is the substring inside (but excluding) the parentheses. For example, for the function created with the following statement: `CREATE FUNCTION JoinLines(x string, y string) as (concat(x, "\n", y))` The definition_body is `concat(x, "\n", y)` (\n is not replaced with linebreak). If language=JAVASCRIPT, it is the evaluated string in the AS clause. For example, for the function created with the following statement: `CREATE FUNCTION f() RETURNS STRING LANGUAGE js AS 'return "\n";\n'` The definition_body is `return "\n";\n` Note that both \n are replaced with linebreaks.
-  "description": "A String", # Optional. [Experimental] The description of the routine if defined.
-  "determinismLevel": "A String", # Optional. [Experimental] The determinism level of the JavaScript UDF if defined.
+  "description": "A String", # Optional. The description of the routine, if defined.
+  "determinismLevel": "A String", # Optional. The determinism level of the JavaScript UDF, if defined.
   "etag": "A String", # Output only. A hash of this resource.
   "importedLibraries": [ # Optional. If language = "JAVASCRIPT", this field stores the path of the imported JAVASCRIPT libraries.
     "A String",
   ],
   "language": "A String", # Optional. Defaults to "SQL".
   "lastModifiedTime": "A String", # Output only. The time when this routine was last modified, in milliseconds since the epoch.
-  "returnTableType": { # A table type # Optional. Set only if Routine is a "TABLE_VALUED_FUNCTION".
+  "returnTableType": { # A table type # Optional. Can be set only if routine_type = "TABLE_VALUED_FUNCTION". If absent, the return table type is inferred from definition_body at query time in each query that references this routine. If present, then the columns in the evaluated table result will be cast to match the column types specificed in return table type, at query time.
     "columns": [ # The columns in this table type
       { # A field or a column.
         "name": "A String", # Optional. The name of this field. Can be absent for struct fields.
@@ -470,7 +470,7 @@
       },
     ],
   },
-  "returnType": { # The type of a variable, e.g., a function argument. Examples: INT64: {type_kind="INT64"} ARRAY: {type_kind="ARRAY", array_element_type="STRING"} STRUCT>: {type_kind="STRUCT", struct_type={fields=[ {name="x", type={type_kind="STRING"}}, {name="y", type={type_kind="ARRAY", array_element_type="DATE"}} ]}} # Optional if language = "SQL"; required otherwise. If absent, the return type is inferred from definition_body at query time in each query that references this routine. If present, then the evaluated result will be cast to the specified returned type at query time. For example, for the functions created with the following statements: * `CREATE FUNCTION Add(x FLOAT64, y FLOAT64) RETURNS FLOAT64 AS (x + y);` * `CREATE FUNCTION Increment(x FLOAT64) AS (Add(x, 1));` * `CREATE FUNCTION Decrement(x FLOAT64) RETURNS FLOAT64 AS (Add(x, -1));` The return_type is `{type_kind: "FLOAT64"}` for `Add` and `Decrement`, and is absent for `Increment` (inferred as FLOAT64 at query time). Suppose the function `Add` is replaced by `CREATE OR REPLACE FUNCTION Add(x INT64, y INT64) AS (x + y);` Then the inferred return type of `Increment` is automatically changed to INT64 at query time, while the return type of `Decrement` remains FLOAT64.
+  "returnType": { # The type of a variable, e.g., a function argument. Examples: INT64: {type_kind="INT64"} ARRAY: {type_kind="ARRAY", array_element_type="STRING"} STRUCT>: {type_kind="STRUCT", struct_type={fields=[ {name="x", type={type_kind="STRING"}}, {name="y", type={type_kind="ARRAY", array_element_type="DATE"}} ]}} # Optional if language = "SQL"; required otherwise. Cannot be set if routine_type = "TABLE_VALUED_FUNCTION". If absent, the return type is inferred from definition_body at query time in each query that references this routine. If present, then the evaluated result will be cast to the specified returned type at query time. For example, for the functions created with the following statements: * `CREATE FUNCTION Add(x FLOAT64, y FLOAT64) RETURNS FLOAT64 AS (x + y);` * `CREATE FUNCTION Increment(x FLOAT64) AS (Add(x, 1));` * `CREATE FUNCTION Decrement(x FLOAT64) RETURNS FLOAT64 AS (Add(x, -1));` The return_type is `{type_kind: "FLOAT64"}` for `Add` and `Decrement`, and is absent for `Increment` (inferred as FLOAT64 at query time). Suppose the function `Add` is replaced by `CREATE OR REPLACE FUNCTION Add(x INT64, y INT64) AS (x + y);` Then the inferred return type of `Increment` is automatically changed to INT64 at query time, while the return type of `Decrement` remains FLOAT64.
     "arrayElementType": # Object with schema name: StandardSqlDataType # The type of the array's elements, if type_kind = "ARRAY".
     "structType": { # The fields of this struct, in order, if type_kind = "STRUCT".
       "fields": [
@@ -510,15 +510,15 @@
   ],
   "creationTime": "A String", # Output only. The time when this routine was created, in milliseconds since the epoch.
   "definitionBody": "A String", # Required. The body of the routine. For functions, this is the expression in the AS clause. If language=SQL, it is the substring inside (but excluding) the parentheses. For example, for the function created with the following statement: `CREATE FUNCTION JoinLines(x string, y string) as (concat(x, "\n", y))` The definition_body is `concat(x, "\n", y)` (\n is not replaced with linebreak). If language=JAVASCRIPT, it is the evaluated string in the AS clause. For example, for the function created with the following statement: `CREATE FUNCTION f() RETURNS STRING LANGUAGE js AS 'return "\n";\n'` The definition_body is `return "\n";\n` Note that both \n are replaced with linebreaks.
-  "description": "A String", # Optional. [Experimental] The description of the routine if defined.
-  "determinismLevel": "A String", # Optional. [Experimental] The determinism level of the JavaScript UDF if defined.
+  "description": "A String", # Optional. The description of the routine, if defined.
+  "determinismLevel": "A String", # Optional. The determinism level of the JavaScript UDF, if defined.
   "etag": "A String", # Output only. A hash of this resource.
   "importedLibraries": [ # Optional. If language = "JAVASCRIPT", this field stores the path of the imported JAVASCRIPT libraries.
     "A String",
   ],
   "language": "A String", # Optional. Defaults to "SQL".
   "lastModifiedTime": "A String", # Output only. The time when this routine was last modified, in milliseconds since the epoch.
-  "returnTableType": { # A table type # Optional. Set only if Routine is a "TABLE_VALUED_FUNCTION".
+  "returnTableType": { # A table type # Optional. Can be set only if routine_type = "TABLE_VALUED_FUNCTION". If absent, the return table type is inferred from definition_body at query time in each query that references this routine. If present, then the columns in the evaluated table result will be cast to match the column types specificed in return table type, at query time.
     "columns": [ # The columns in this table type
       { # A field or a column.
         "name": "A String", # Optional. The name of this field. Can be absent for struct fields.
@@ -534,7 +534,7 @@
       },
     ],
   },
-  "returnType": { # The type of a variable, e.g., a function argument. Examples: INT64: {type_kind="INT64"} ARRAY: {type_kind="ARRAY", array_element_type="STRING"} STRUCT>: {type_kind="STRUCT", struct_type={fields=[ {name="x", type={type_kind="STRING"}}, {name="y", type={type_kind="ARRAY", array_element_type="DATE"}} ]}} # Optional if language = "SQL"; required otherwise. If absent, the return type is inferred from definition_body at query time in each query that references this routine. If present, then the evaluated result will be cast to the specified returned type at query time. For example, for the functions created with the following statements: * `CREATE FUNCTION Add(x FLOAT64, y FLOAT64) RETURNS FLOAT64 AS (x + y);` * `CREATE FUNCTION Increment(x FLOAT64) AS (Add(x, 1));` * `CREATE FUNCTION Decrement(x FLOAT64) RETURNS FLOAT64 AS (Add(x, -1));` The return_type is `{type_kind: "FLOAT64"}` for `Add` and `Decrement`, and is absent for `Increment` (inferred as FLOAT64 at query time). Suppose the function `Add` is replaced by `CREATE OR REPLACE FUNCTION Add(x INT64, y INT64) AS (x + y);` Then the inferred return type of `Increment` is automatically changed to INT64 at query time, while the return type of `Decrement` remains FLOAT64.
+  "returnType": { # The type of a variable, e.g., a function argument. Examples: INT64: {type_kind="INT64"} ARRAY: {type_kind="ARRAY", array_element_type="STRING"} STRUCT>: {type_kind="STRUCT", struct_type={fields=[ {name="x", type={type_kind="STRING"}}, {name="y", type={type_kind="ARRAY", array_element_type="DATE"}} ]}} # Optional if language = "SQL"; required otherwise. Cannot be set if routine_type = "TABLE_VALUED_FUNCTION". If absent, the return type is inferred from definition_body at query time in each query that references this routine. If present, then the evaluated result will be cast to the specified returned type at query time. For example, for the functions created with the following statements: * `CREATE FUNCTION Add(x FLOAT64, y FLOAT64) RETURNS FLOAT64 AS (x + y);` * `CREATE FUNCTION Increment(x FLOAT64) AS (Add(x, 1));` * `CREATE FUNCTION Decrement(x FLOAT64) RETURNS FLOAT64 AS (Add(x, -1));` The return_type is `{type_kind: "FLOAT64"}` for `Add` and `Decrement`, and is absent for `Increment` (inferred as FLOAT64 at query time). Suppose the function `Add` is replaced by `CREATE OR REPLACE FUNCTION Add(x INT64, y INT64) AS (x + y);` Then the inferred return type of `Increment` is automatically changed to INT64 at query time, while the return type of `Decrement` remains FLOAT64.
     "arrayElementType": # Object with schema name: StandardSqlDataType # The type of the array's elements, if type_kind = "ARRAY".
     "structType": { # The fields of this struct, in order, if type_kind = "STRUCT".
       "fields": [

docs/dyn/bigquery_v2.rowAccessPolicies.html

diff --git a/docs/dyn/bigquery_v2.rowAccessPolicies.html b/docs/dyn/bigquery_v2.rowAccessPolicies.html
index 42290e2..665bd6e 100644
--- a/docs/dyn/bigquery_v2.rowAccessPolicies.html
+++ b/docs/dyn/bigquery_v2.rowAccessPolicies.html
@@ -117,7 +117,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -207,7 +207,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -245,7 +245,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/bigquery_v2.tables.html

diff --git a/docs/dyn/bigquery_v2.tables.html b/docs/dyn/bigquery_v2.tables.html
index e19a427..084dedb 100644
--- a/docs/dyn/bigquery_v2.tables.html
+++ b/docs/dyn/bigquery_v2.tables.html
@@ -383,7 +383,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -1436,7 +1436,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -1474,7 +1474,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/bigqueryconnection_v1beta1.projects.locations.connections.html

diff --git a/docs/dyn/bigqueryconnection_v1beta1.projects.locations.connections.html b/docs/dyn/bigqueryconnection_v1beta1.projects.locations.connections.html
index 095a149..4863ba7 100644
--- a/docs/dyn/bigqueryconnection_v1beta1.projects.locations.connections.html
+++ b/docs/dyn/bigqueryconnection_v1beta1.projects.locations.connections.html
@@ -242,7 +242,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -394,7 +394,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -436,7 +436,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/bigquerydatatransfer_v1.projects.locations.transferConfigs.html

diff --git a/docs/dyn/bigquerydatatransfer_v1.projects.locations.transferConfigs.html b/docs/dyn/bigquerydatatransfer_v1.projects.locations.transferConfigs.html
index 8a2a0ae..3f0b6e9 100644
--- a/docs/dyn/bigquerydatatransfer_v1.projects.locations.transferConfigs.html
+++ b/docs/dyn/bigquerydatatransfer_v1.projects.locations.transferConfigs.html
@@ -133,7 +133,10 @@
   },
   "name": "A String", # The resource name of the transfer config. Transfer config names have the form `projects/{project_id}/locations/{region}/transferConfigs/{config_id}`. Where `config_id` is usually a uuid, even though it is not guaranteed or required. The name is ignored when creating a transfer config.
   "nextRunTime": "A String", # Output only. Next time when data transfer will run.
-  "notificationPubsubTopic": "A String", # Pub/Sub topic where notifications will be sent after transfer runs associated with this transfer config finish.
+  "notificationPubsubTopic": "A String", # Pub/Sub topic where notifications will be sent after transfer runs associated with this transfer config finish. The format for specifying a pubsub topic is: `projects/{project}/topics/{topic}`
+  "ownerInfo": { # Information about a user. # Output only. Information about the user whose credentials are used to transfer data. Populated only for `transferConfigs.get` requests. In case the user information is not available, this field will not be populated.
+    "email": "A String", # E-mail address of the user.
+  },
   "params": { # Parameters specific to each data source. For more information see the bq tab in the 'Setting up a data transfer' section for each data source. For example the parameters for Cloud Storage transfers are listed here: https://cloud.google.com/bigquery-transfer/docs/cloud-storage-transfer#bq
     "a_key": "", # Properties of the object.
   },
@@ -171,7 +174,10 @@
   },
   "name": "A String", # The resource name of the transfer config. Transfer config names have the form `projects/{project_id}/locations/{region}/transferConfigs/{config_id}`. Where `config_id` is usually a uuid, even though it is not guaranteed or required. The name is ignored when creating a transfer config.
   "nextRunTime": "A String", # Output only. Next time when data transfer will run.
-  "notificationPubsubTopic": "A String", # Pub/Sub topic where notifications will be sent after transfer runs associated with this transfer config finish.
+  "notificationPubsubTopic": "A String", # Pub/Sub topic where notifications will be sent after transfer runs associated with this transfer config finish. The format for specifying a pubsub topic is: `projects/{project}/topics/{topic}`
+  "ownerInfo": { # Information about a user. # Output only. Information about the user whose credentials are used to transfer data. Populated only for `transferConfigs.get` requests. In case the user information is not available, this field will not be populated.
+    "email": "A String", # E-mail address of the user.
+  },
   "params": { # Parameters specific to each data source. For more information see the bq tab in the 'Setting up a data transfer' section for each data source. For example the parameters for Cloud Storage transfers are listed here: https://cloud.google.com/bigquery-transfer/docs/cloud-storage-transfer#bq
     "a_key": "", # Properties of the object.
   },
@@ -231,7 +237,10 @@
   },
   "name": "A String", # The resource name of the transfer config. Transfer config names have the form `projects/{project_id}/locations/{region}/transferConfigs/{config_id}`. Where `config_id` is usually a uuid, even though it is not guaranteed or required. The name is ignored when creating a transfer config.
   "nextRunTime": "A String", # Output only. Next time when data transfer will run.
-  "notificationPubsubTopic": "A String", # Pub/Sub topic where notifications will be sent after transfer runs associated with this transfer config finish.
+  "notificationPubsubTopic": "A String", # Pub/Sub topic where notifications will be sent after transfer runs associated with this transfer config finish. The format for specifying a pubsub topic is: `projects/{project}/topics/{topic}`
+  "ownerInfo": { # Information about a user. # Output only. Information about the user whose credentials are used to transfer data. Populated only for `transferConfigs.get` requests. In case the user information is not available, this field will not be populated.
+    "email": "A String", # E-mail address of the user.
+  },
   "params": { # Parameters specific to each data source. For more information see the bq tab in the 'Setting up a data transfer' section for each data source. For example the parameters for Cloud Storage transfers are listed here: https://cloud.google.com/bigquery-transfer/docs/cloud-storage-transfer#bq
     "a_key": "", # Properties of the object.
   },
@@ -279,7 +288,10 @@
       },
       "name": "A String", # The resource name of the transfer config. Transfer config names have the form `projects/{project_id}/locations/{region}/transferConfigs/{config_id}`. Where `config_id` is usually a uuid, even though it is not guaranteed or required. The name is ignored when creating a transfer config.
       "nextRunTime": "A String", # Output only. Next time when data transfer will run.
-      "notificationPubsubTopic": "A String", # Pub/Sub topic where notifications will be sent after transfer runs associated with this transfer config finish.
+      "notificationPubsubTopic": "A String", # Pub/Sub topic where notifications will be sent after transfer runs associated with this transfer config finish. The format for specifying a pubsub topic is: `projects/{project}/topics/{topic}`
+      "ownerInfo": { # Information about a user. # Output only. Information about the user whose credentials are used to transfer data. Populated only for `transferConfigs.get` requests. In case the user information is not available, this field will not be populated.
+        "email": "A String", # E-mail address of the user.
+      },
       "params": { # Parameters specific to each data source. For more information see the bq tab in the 'Setting up a data transfer' section for each data source. For example the parameters for Cloud Storage transfers are listed here: https://cloud.google.com/bigquery-transfer/docs/cloud-storage-transfer#bq
         "a_key": "", # Properties of the object.
       },
@@ -332,7 +344,10 @@
   },
   "name": "A String", # The resource name of the transfer config. Transfer config names have the form `projects/{project_id}/locations/{region}/transferConfigs/{config_id}`. Where `config_id` is usually a uuid, even though it is not guaranteed or required. The name is ignored when creating a transfer config.
   "nextRunTime": "A String", # Output only. Next time when data transfer will run.
-  "notificationPubsubTopic": "A String", # Pub/Sub topic where notifications will be sent after transfer runs associated with this transfer config finish.
+  "notificationPubsubTopic": "A String", # Pub/Sub topic where notifications will be sent after transfer runs associated with this transfer config finish. The format for specifying a pubsub topic is: `projects/{project}/topics/{topic}`
+  "ownerInfo": { # Information about a user. # Output only. Information about the user whose credentials are used to transfer data. Populated only for `transferConfigs.get` requests. In case the user information is not available, this field will not be populated.
+    "email": "A String", # E-mail address of the user.
+  },
   "params": { # Parameters specific to each data source. For more information see the bq tab in the 'Setting up a data transfer' section for each data source. For example the parameters for Cloud Storage transfers are listed here: https://cloud.google.com/bigquery-transfer/docs/cloud-storage-transfer#bq
     "a_key": "", # Properties of the object.
   },
@@ -371,7 +386,10 @@
   },
   "name": "A String", # The resource name of the transfer config. Transfer config names have the form `projects/{project_id}/locations/{region}/transferConfigs/{config_id}`. Where `config_id` is usually a uuid, even though it is not guaranteed or required. The name is ignored when creating a transfer config.
   "nextRunTime": "A String", # Output only. Next time when data transfer will run.
-  "notificationPubsubTopic": "A String", # Pub/Sub topic where notifications will be sent after transfer runs associated with this transfer config finish.
+  "notificationPubsubTopic": "A String", # Pub/Sub topic where notifications will be sent after transfer runs associated with this transfer config finish. The format for specifying a pubsub topic is: `projects/{project}/topics/{topic}`
+  "ownerInfo": { # Information about a user. # Output only. Information about the user whose credentials are used to transfer data. Populated only for `transferConfigs.get` requests. In case the user information is not available, this field will not be populated.
+    "email": "A String", # E-mail address of the user.
+  },
   "params": { # Parameters specific to each data source. For more information see the bq tab in the 'Setting up a data transfer' section for each data source. For example the parameters for Cloud Storage transfers are listed here: https://cloud.google.com/bigquery-transfer/docs/cloud-storage-transfer#bq
     "a_key": "", # Properties of the object.
   },
@@ -428,7 +446,7 @@
         "message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
       },
       "name": "A String", # The resource name of the transfer run. Transfer run names have the form `projects/{project_id}/locations/{location}/transferConfigs/{config_id}/runs/{run_id}`. The name is ignored when creating a transfer run.
-      "notificationPubsubTopic": "A String", # Output only. Pub/Sub topic where a notification will be sent after this transfer run finishes
+      "notificationPubsubTopic": "A String", # Output only. Pub/Sub topic where a notification will be sent after this transfer run finishes. The format for specifying a pubsub topic is: `projects/{project}/topics/{topic}`
       "params": { # Output only. Parameters specific to each data source. For more information see the bq tab in the 'Setting up a data transfer' section for each data source. For example the parameters for Cloud Storage transfers are listed here: https://cloud.google.com/bigquery-transfer/docs/cloud-storage-transfer#bq
         "a_key": "", # Properties of the object.
       },
@@ -488,7 +506,7 @@
         "message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
       },
       "name": "A String", # The resource name of the transfer run. Transfer run names have the form `projects/{project_id}/locations/{location}/transferConfigs/{config_id}/runs/{run_id}`. The name is ignored when creating a transfer run.
-      "notificationPubsubTopic": "A String", # Output only. Pub/Sub topic where a notification will be sent after this transfer run finishes
+      "notificationPubsubTopic": "A String", # Output only. Pub/Sub topic where a notification will be sent after this transfer run finishes. The format for specifying a pubsub topic is: `projects/{project}/topics/{topic}`
       "params": { # Output only. Parameters specific to each data source. For more information see the bq tab in the 'Setting up a data transfer' section for each data source. For example the parameters for Cloud Storage transfers are listed here: https://cloud.google.com/bigquery-transfer/docs/cloud-storage-transfer#bq
         "a_key": "", # Properties of the object.
       },

docs/dyn/bigquerydatatransfer_v1.projects.locations.transferConfigs.runs.html

diff --git a/docs/dyn/bigquerydatatransfer_v1.projects.locations.transferConfigs.runs.html b/docs/dyn/bigquerydatatransfer_v1.projects.locations.transferConfigs.runs.html
index bf0fad6..f0287f9 100644
--- a/docs/dyn/bigquerydatatransfer_v1.projects.locations.transferConfigs.runs.html
+++ b/docs/dyn/bigquerydatatransfer_v1.projects.locations.transferConfigs.runs.html
@@ -149,7 +149,7 @@
     "message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
   },
   "name": "A String", # The resource name of the transfer run. Transfer run names have the form `projects/{project_id}/locations/{location}/transferConfigs/{config_id}/runs/{run_id}`. The name is ignored when creating a transfer run.
-  "notificationPubsubTopic": "A String", # Output only. Pub/Sub topic where a notification will be sent after this transfer run finishes
+  "notificationPubsubTopic": "A String", # Output only. Pub/Sub topic where a notification will be sent after this transfer run finishes. The format for specifying a pubsub topic is: `projects/{project}/topics/{topic}`
   "params": { # Output only. Parameters specific to each data source. For more information see the bq tab in the 'Setting up a data transfer' section for each data source. For example the parameters for Cloud Storage transfers are listed here: https://cloud.google.com/bigquery-transfer/docs/cloud-storage-transfer#bq
     "a_key": "", # Properties of the object.
   },
@@ -211,7 +211,7 @@
         "message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
       },
       "name": "A String", # The resource name of the transfer run. Transfer run names have the form `projects/{project_id}/locations/{location}/transferConfigs/{config_id}/runs/{run_id}`. The name is ignored when creating a transfer run.
-      "notificationPubsubTopic": "A String", # Output only. Pub/Sub topic where a notification will be sent after this transfer run finishes
+      "notificationPubsubTopic": "A String", # Output only. Pub/Sub topic where a notification will be sent after this transfer run finishes. The format for specifying a pubsub topic is: `projects/{project}/topics/{topic}`
       "params": { # Output only. Parameters specific to each data source. For more information see the bq tab in the 'Setting up a data transfer' section for each data source. For example the parameters for Cloud Storage transfers are listed here: https://cloud.google.com/bigquery-transfer/docs/cloud-storage-transfer#bq
         "a_key": "", # Properties of the object.
       },

docs/dyn/bigquerydatatransfer_v1.projects.transferConfigs.html

diff --git a/docs/dyn/bigquerydatatransfer_v1.projects.transferConfigs.html b/docs/dyn/bigquerydatatransfer_v1.projects.transferConfigs.html
index 4862f36..42cf3ac 100644
--- a/docs/dyn/bigquerydatatransfer_v1.projects.transferConfigs.html
+++ b/docs/dyn/bigquerydatatransfer_v1.projects.transferConfigs.html
@@ -133,7 +133,10 @@
   },
   "name": "A String", # The resource name of the transfer config. Transfer config names have the form `projects/{project_id}/locations/{region}/transferConfigs/{config_id}`. Where `config_id` is usually a uuid, even though it is not guaranteed or required. The name is ignored when creating a transfer config.
   "nextRunTime": "A String", # Output only. Next time when data transfer will run.
-  "notificationPubsubTopic": "A String", # Pub/Sub topic where notifications will be sent after transfer runs associated with this transfer config finish.
+  "notificationPubsubTopic": "A String", # Pub/Sub topic where notifications will be sent after transfer runs associated with this transfer config finish. The format for specifying a pubsub topic is: `projects/{project}/topics/{topic}`
+  "ownerInfo": { # Information about a user. # Output only. Information about the user whose credentials are used to transfer data. Populated only for `transferConfigs.get` requests. In case the user information is not available, this field will not be populated.
+    "email": "A String", # E-mail address of the user.
+  },
   "params": { # Parameters specific to each data source. For more information see the bq tab in the 'Setting up a data transfer' section for each data source. For example the parameters for Cloud Storage transfers are listed here: https://cloud.google.com/bigquery-transfer/docs/cloud-storage-transfer#bq
     "a_key": "", # Properties of the object.
   },
@@ -171,7 +174,10 @@
   },
   "name": "A String", # The resource name of the transfer config. Transfer config names have the form `projects/{project_id}/locations/{region}/transferConfigs/{config_id}`. Where `config_id` is usually a uuid, even though it is not guaranteed or required. The name is ignored when creating a transfer config.
   "nextRunTime": "A String", # Output only. Next time when data transfer will run.
-  "notificationPubsubTopic": "A String", # Pub/Sub topic where notifications will be sent after transfer runs associated with this transfer config finish.
+  "notificationPubsubTopic": "A String", # Pub/Sub topic where notifications will be sent after transfer runs associated with this transfer config finish. The format for specifying a pubsub topic is: `projects/{project}/topics/{topic}`
+  "ownerInfo": { # Information about a user. # Output only. Information about the user whose credentials are used to transfer data. Populated only for `transferConfigs.get` requests. In case the user information is not available, this field will not be populated.
+    "email": "A String", # E-mail address of the user.
+  },
   "params": { # Parameters specific to each data source. For more information see the bq tab in the 'Setting up a data transfer' section for each data source. For example the parameters for Cloud Storage transfers are listed here: https://cloud.google.com/bigquery-transfer/docs/cloud-storage-transfer#bq
     "a_key": "", # Properties of the object.
   },
@@ -231,7 +237,10 @@
   },
   "name": "A String", # The resource name of the transfer config. Transfer config names have the form `projects/{project_id}/locations/{region}/transferConfigs/{config_id}`. Where `config_id` is usually a uuid, even though it is not guaranteed or required. The name is ignored when creating a transfer config.
   "nextRunTime": "A String", # Output only. Next time when data transfer will run.
-  "notificationPubsubTopic": "A String", # Pub/Sub topic where notifications will be sent after transfer runs associated with this transfer config finish.
+  "notificationPubsubTopic": "A String", # Pub/Sub topic where notifications will be sent after transfer runs associated with this transfer config finish. The format for specifying a pubsub topic is: `projects/{project}/topics/{topic}`
+  "ownerInfo": { # Information about a user. # Output only. Information about the user whose credentials are used to transfer data. Populated only for `transferConfigs.get` requests. In case the user information is not available, this field will not be populated.
+    "email": "A String", # E-mail address of the user.
+  },
   "params": { # Parameters specific to each data source. For more information see the bq tab in the 'Setting up a data transfer' section for each data source. For example the parameters for Cloud Storage transfers are listed here: https://cloud.google.com/bigquery-transfer/docs/cloud-storage-transfer#bq
     "a_key": "", # Properties of the object.
   },
@@ -279,7 +288,10 @@
       },
       "name": "A String", # The resource name of the transfer config. Transfer config names have the form `projects/{project_id}/locations/{region}/transferConfigs/{config_id}`. Where `config_id` is usually a uuid, even though it is not guaranteed or required. The name is ignored when creating a transfer config.
       "nextRunTime": "A String", # Output only. Next time when data transfer will run.
-      "notificationPubsubTopic": "A String", # Pub/Sub topic where notifications will be sent after transfer runs associated with this transfer config finish.
+      "notificationPubsubTopic": "A String", # Pub/Sub topic where notifications will be sent after transfer runs associated with this transfer config finish. The format for specifying a pubsub topic is: `projects/{project}/topics/{topic}`
+      "ownerInfo": { # Information about a user. # Output only. Information about the user whose credentials are used to transfer data. Populated only for `transferConfigs.get` requests. In case the user information is not available, this field will not be populated.
+        "email": "A String", # E-mail address of the user.
+      },
       "params": { # Parameters specific to each data source. For more information see the bq tab in the 'Setting up a data transfer' section for each data source. For example the parameters for Cloud Storage transfers are listed here: https://cloud.google.com/bigquery-transfer/docs/cloud-storage-transfer#bq
         "a_key": "", # Properties of the object.
       },
@@ -332,7 +344,10 @@
   },
   "name": "A String", # The resource name of the transfer config. Transfer config names have the form `projects/{project_id}/locations/{region}/transferConfigs/{config_id}`. Where `config_id` is usually a uuid, even though it is not guaranteed or required. The name is ignored when creating a transfer config.
   "nextRunTime": "A String", # Output only. Next time when data transfer will run.
-  "notificationPubsubTopic": "A String", # Pub/Sub topic where notifications will be sent after transfer runs associated with this transfer config finish.
+  "notificationPubsubTopic": "A String", # Pub/Sub topic where notifications will be sent after transfer runs associated with this transfer config finish. The format for specifying a pubsub topic is: `projects/{project}/topics/{topic}`
+  "ownerInfo": { # Information about a user. # Output only. Information about the user whose credentials are used to transfer data. Populated only for `transferConfigs.get` requests. In case the user information is not available, this field will not be populated.
+    "email": "A String", # E-mail address of the user.
+  },
   "params": { # Parameters specific to each data source. For more information see the bq tab in the 'Setting up a data transfer' section for each data source. For example the parameters for Cloud Storage transfers are listed here: https://cloud.google.com/bigquery-transfer/docs/cloud-storage-transfer#bq
     "a_key": "", # Properties of the object.
   },
@@ -371,7 +386,10 @@
   },
   "name": "A String", # The resource name of the transfer config. Transfer config names have the form `projects/{project_id}/locations/{region}/transferConfigs/{config_id}`. Where `config_id` is usually a uuid, even though it is not guaranteed or required. The name is ignored when creating a transfer config.
   "nextRunTime": "A String", # Output only. Next time when data transfer will run.
-  "notificationPubsubTopic": "A String", # Pub/Sub topic where notifications will be sent after transfer runs associated with this transfer config finish.
+  "notificationPubsubTopic": "A String", # Pub/Sub topic where notifications will be sent after transfer runs associated with this transfer config finish. The format for specifying a pubsub topic is: `projects/{project}/topics/{topic}`
+  "ownerInfo": { # Information about a user. # Output only. Information about the user whose credentials are used to transfer data. Populated only for `transferConfigs.get` requests. In case the user information is not available, this field will not be populated.
+    "email": "A String", # E-mail address of the user.
+  },
   "params": { # Parameters specific to each data source. For more information see the bq tab in the 'Setting up a data transfer' section for each data source. For example the parameters for Cloud Storage transfers are listed here: https://cloud.google.com/bigquery-transfer/docs/cloud-storage-transfer#bq
     "a_key": "", # Properties of the object.
   },
@@ -428,7 +446,7 @@
         "message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
       },
       "name": "A String", # The resource name of the transfer run. Transfer run names have the form `projects/{project_id}/locations/{location}/transferConfigs/{config_id}/runs/{run_id}`. The name is ignored when creating a transfer run.
-      "notificationPubsubTopic": "A String", # Output only. Pub/Sub topic where a notification will be sent after this transfer run finishes
+      "notificationPubsubTopic": "A String", # Output only. Pub/Sub topic where a notification will be sent after this transfer run finishes. The format for specifying a pubsub topic is: `projects/{project}/topics/{topic}`
       "params": { # Output only. Parameters specific to each data source. For more information see the bq tab in the 'Setting up a data transfer' section for each data source. For example the parameters for Cloud Storage transfers are listed here: https://cloud.google.com/bigquery-transfer/docs/cloud-storage-transfer#bq
         "a_key": "", # Properties of the object.
       },
@@ -488,7 +506,7 @@
         "message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
       },
       "name": "A String", # The resource name of the transfer run. Transfer run names have the form `projects/{project_id}/locations/{location}/transferConfigs/{config_id}/runs/{run_id}`. The name is ignored when creating a transfer run.
-      "notificationPubsubTopic": "A String", # Output only. Pub/Sub topic where a notification will be sent after this transfer run finishes
+      "notificationPubsubTopic": "A String", # Output only. Pub/Sub topic where a notification will be sent after this transfer run finishes. The format for specifying a pubsub topic is: `projects/{project}/topics/{topic}`
       "params": { # Output only. Parameters specific to each data source. For more information see the bq tab in the 'Setting up a data transfer' section for each data source. For example the parameters for Cloud Storage transfers are listed here: https://cloud.google.com/bigquery-transfer/docs/cloud-storage-transfer#bq
         "a_key": "", # Properties of the object.
       },

docs/dyn/bigquerydatatransfer_v1.projects.transferConfigs.runs.html

diff --git a/docs/dyn/bigquerydatatransfer_v1.projects.transferConfigs.runs.html b/docs/dyn/bigquerydatatransfer_v1.projects.transferConfigs.runs.html
index 25012d5..8e4fc26 100644
--- a/docs/dyn/bigquerydatatransfer_v1.projects.transferConfigs.runs.html
+++ b/docs/dyn/bigquerydatatransfer_v1.projects.transferConfigs.runs.html
@@ -149,7 +149,7 @@
     "message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
   },
   "name": "A String", # The resource name of the transfer run. Transfer run names have the form `projects/{project_id}/locations/{location}/transferConfigs/{config_id}/runs/{run_id}`. The name is ignored when creating a transfer run.
-  "notificationPubsubTopic": "A String", # Output only. Pub/Sub topic where a notification will be sent after this transfer run finishes
+  "notificationPubsubTopic": "A String", # Output only. Pub/Sub topic where a notification will be sent after this transfer run finishes. The format for specifying a pubsub topic is: `projects/{project}/topics/{topic}`
   "params": { # Output only. Parameters specific to each data source. For more information see the bq tab in the 'Setting up a data transfer' section for each data source. For example the parameters for Cloud Storage transfers are listed here: https://cloud.google.com/bigquery-transfer/docs/cloud-storage-transfer#bq
     "a_key": "", # Properties of the object.
   },
@@ -211,7 +211,7 @@
         "message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
       },
       "name": "A String", # The resource name of the transfer run. Transfer run names have the form `projects/{project_id}/locations/{location}/transferConfigs/{config_id}/runs/{run_id}`. The name is ignored when creating a transfer run.
-      "notificationPubsubTopic": "A String", # Output only. Pub/Sub topic where a notification will be sent after this transfer run finishes
+      "notificationPubsubTopic": "A String", # Output only. Pub/Sub topic where a notification will be sent after this transfer run finishes. The format for specifying a pubsub topic is: `projects/{project}/topics/{topic}`
       "params": { # Output only. Parameters specific to each data source. For more information see the bq tab in the 'Setting up a data transfer' section for each data source. For example the parameters for Cloud Storage transfers are listed here: https://cloud.google.com/bigquery-transfer/docs/cloud-storage-transfer#bq
         "a_key": "", # Properties of the object.
       },

docs/dyn/billingbudgets_v1.billingAccounts.budgets.html

diff --git a/docs/dyn/billingbudgets_v1.billingAccounts.budgets.html b/docs/dyn/billingbudgets_v1.billingAccounts.budgets.html
index ca8d6b7..0e12b0a 100644
--- a/docs/dyn/billingbudgets_v1.billingAccounts.budgets.html
+++ b/docs/dyn/billingbudgets_v1.billingAccounts.budgets.html
@@ -112,7 +112,7 @@
 
 { # A budget is a plan that describes what you expect to spend on Cloud projects, plus the rules to execute as spend is tracked against that plan, (for example, send an alert when 90% of the target spend is met). The budget time period is configurable, with options such as month (default), quarter, year, or custom time period.
   "amount": { # The budgeted amount for each usage period. # Required. Budgeted amount.
-    "lastPeriodAmount": { # Describes a budget amount targeted to the last Filter.calendar_period spend. At this time, the amount is automatically 100% of the last calendar period's spend; that is, there are no other options yet. Future configuration options will be described here (for example, configuring a percentage of last period's spend). LastPeriodAmount cannot be set for a budget configured with a Filter.custom_period. # Use the last period's actual spend as the budget for the present period. LastPeriodAmount can only be set when the budget's time period is a Filter.calendar_period. It cannot be set in combination with Filter.custom_period.
+    "lastPeriodAmount": { # Describes a budget amount targeted to the last Filter.calendar_period spend. At this time, the amount is automatically 100% of the last calendar period's spend; that is, there are no other options yet. LastPeriodAmount cannot be set for a budget configured with a Filter.custom_period. # Use the last period's actual spend as the budget for the present period. LastPeriodAmount can only be set when the budget's time period is a Filter.calendar_period. It cannot be set in combination with Filter.custom_period.
     },
     "specifiedAmount": { # Represents an amount of money with its currency type. # A specified amount to use as the budget. `currency_code` is optional. If specified when creating a budget, it must match the currency of the billing account. If specified when updating a budget, it must match the currency_code of the existing budget. The `currency_code` is provided on output.
       "currencyCode": "A String", # The three-letter currency code defined in ISO 4217.
@@ -121,7 +121,7 @@
     },
   },
   "budgetFilter": { # A filter for a budget, limiting the scope of the cost to calculate. # Optional. Filters that define which resources are used to compute the actual spend against the budget amount, such as projects, services, and the budget's time period, as well as other filters.
-    "calendarPeriod": "A String", # Optional. Specifies to track usage for recurring calendar period. For example, assume that CalendarPeriod.QUARTER is set. The budget will track usage from April 1 to June 30, when the current calendar month is April, May, June. After that, it will track usage from July 1 to September 30 when the current calendar month is July, August, September, so on.
+    "calendarPeriod": "A String", # Optional. Specifies to track usage for recurring calendar period. For example, assume that CalendarPeriod.QUARTER is set. The budget tracks usage from April 1 to June 30, when the current calendar month is April, May, June. After that, it tracks usage from July 1 to September 30 when the current calendar month is July, August, September, so on.
     "creditTypes": [ # Optional. If Filter.credit_types_treatment is INCLUDE_SPECIFIED_CREDITS, this is a list of credit types to be subtracted from gross cost to determine the spend for threshold calculations. See [a list of acceptable credit type values](https://cloud.google.com/billing/docs/how-to/export-data-bigquery-tables#credits-type). If Filter.credit_types_treatment is **not** INCLUDE_SPECIFIED_CREDITS, this field must be empty.
       "A String",
     ],
@@ -138,30 +138,30 @@
         "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
       },
     },
-    "labels": { # Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. Currently, multiple entries or multiple values per entry are not allowed. If omitted, the report will include all labeled and unlabeled usage.
+    "labels": { # Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. If omitted, the report includes all labeled and unlabeled usage. An object containing a single `"key": value` pair. Example: `{ "name": "wrench" }`. _Currently, multiple entries or multiple values per entry are not allowed._
       "a_key": [
         "",
       ],
     },
-    "projects": [ # Optional. A set of projects of the form `projects/{project}`, specifying that usage from only this set of projects should be included in the budget. If omitted, the report will include all usage for the billing account, regardless of which project the usage occurred on. Only zero or one project can be specified currently.
+    "projects": [ # Optional. A set of projects of the form `projects/{project}`, specifying that usage from only this set of projects should be included in the budget. If omitted, the report includes all usage for the billing account, regardless of which project the usage occurred on. Only zero or one project can be specified currently.
       "A String",
     ],
-    "services": [ # Optional. A set of services of the form `services/{service_id}`, specifying that usage from only this set of services should be included in the budget. If omitted, the report will include usage for all the services. The service names are available through the Catalog API: https://cloud.google.com/billing/v1/how-tos/catalog-api.
+    "services": [ # Optional. A set of services of the form `services/{service_id}`, specifying that usage from only this set of services should be included in the budget. If omitted, the report includes usage for all the services. The service names are available through the Catalog API: https://cloud.google.com/billing/v1/how-tos/catalog-api.
       "A String",
     ],
-    "subaccounts": [ # Optional. A set of subaccounts of the form `billingAccounts/{account_id}`, specifying that usage from only this set of subaccounts should be included in the budget. If a subaccount is set to the name of the parent account, usage from the parent account will be included. If the field is omitted, the report will include usage from the parent account and all subaccounts, if they exist.
+    "subaccounts": [ # Optional. A set of subaccounts of the form `billingAccounts/{account_id}`, specifying that usage from only this set of subaccounts should be included in the budget. If a subaccount is set to the name of the parent account, usage from the parent account is included. If the field is omitted, the report includes usage from the parent account and all subaccounts, if they exist.
       "A String",
     ],
   },
   "displayName": "A String", # User data for display name in UI. The name must be less than or equal to 60 characters.
-  "etag": "A String", # Optional. Etag to validate that the object is unchanged for a read-modify-write operation. An empty etag will cause an update to overwrite other changes.
+  "etag": "A String", # Optional. Etag to validate that the object is unchanged for a read-modify-write operation. An empty etag causes an update to overwrite other changes.
   "name": "A String", # Output only. Resource name of the budget. The resource name implies the scope of a budget. Values are of the form `billingAccounts/{billingAccountId}/budgets/{budgetId}`.
   "notificationsRule": { # NotificationsRule defines notifications that are sent based on budget spend and thresholds. # Optional. Rules to apply to notifications sent based on budget spend and thresholds.
     "disableDefaultIamRecipients": True or False, # Optional. When set to true, disables default notifications sent when a threshold is exceeded. Default notifications are sent to those with Billing Account Administrator and Billing Account User IAM roles for the target account.
-    "monitoringNotificationChannels": [ # Optional. Targets to send notifications to when a threshold is exceeded. This is in addition to default recipients who have billing account IAM roles. The value is the full REST resource name of a monitoring notification channel with the form `projects/{project_id}/notificationChannels/{channel_id}`. A maximum of 5 channels are allowed. See https://cloud.google.com/billing/docs/how-to/budgets-notification-recipients for more details.
+    "monitoringNotificationChannels": [ # Optional. Email targets to send notifications to when a threshold is exceeded. This is in addition to the `DefaultIamRecipients` who receive alert emails based on their billing account IAM role. The value is the full REST resource name of a Cloud Monitoring email notification channel with the form `projects/{project_id}/notificationChannels/{channel_id}`. A maximum of 5 email notifications are allowed. To customize budget alert email recipients with monitoring notification channels, you _must create the monitoring notification channels before you link them to a budget_. For guidance on setting up notification channels to use with budgets, see [Customize budget alert email recipients](https://cloud.google.com/billing/docs/how-to/budgets-notification-recipients). For Cloud Billing budget alerts, you _must use email notification channels_. The other types of notification channels are _not_ supported, such as Slack, SMS, or PagerDuty. If you want to [send budget notifications to Slack](https://cloud.google.com/billing/docs/how-to/notify#send_notifications_to_slack), use a pubsubTopic and configure [programmatic notifications](https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications).
       "A String",
     ],
-    "pubsubTopic": "A String", # Optional. The name of the Pub/Sub topic where budget related messages will be published, in the form `projects/{project_id}/topics/{topic_id}`. Updates are sent at regular intervals to the topic. The topic needs to be created before the budget is created; see https://cloud.google.com/billing/docs/how-to/budgets#manage-notifications for more details. Caller is expected to have `pubsub.topics.setIamPolicy` permission on the topic when it's set for a budget, otherwise, the API call will fail with PERMISSION_DENIED. See https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications for more details on Pub/Sub roles and permissions.
+    "pubsubTopic": "A String", # Optional. The name of the Pub/Sub topic where budget-related messages are published, in the form `projects/{project_id}/topics/{topic_id}`. Updates are sent to the topic at regular intervals; the timing of the updates is not dependent on the [threshold rules](#thresholdrule) you've set. Note that if you want your [Pub/Sub JSON object](https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications#notification_format) to contain data for `alertThresholdExceeded`, you need at least one [alert threshold rule](#thresholdrule). When you set threshold rules, you must also enable at least one of the email notification options, either using the default IAM recipients or Cloud Monitoring email notification channels. To use Pub/Sub topics with budgets, you must do the following: 1. Create the Pub/Sub topic before connecting it to your budget. For guidance, see [Manage programmatic budget alert notifications](https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications). 2. Grant the API caller the `pubsub.topics.setIamPolicy` permission on the Pub/Sub topic. If not set, the API call fails with PERMISSION_DENIED. For additional details on Pub/Sub roles and permissions, see [Permissions required for this task](https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications#permissions_required_for_this_task).
     "schemaVersion": "A String", # Optional. Required when NotificationsRule.pubsub_topic is set. The schema version of the notification sent to NotificationsRule.pubsub_topic. Only "1.0" is accepted. It represents the JSON schema as defined in https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications#notification_format.
   },
   "thresholdRules": [ # Optional. Rules that trigger alerts (notifications of thresholds being crossed) when spend exceeds the specified percentages of the budget. Optional for `pubsubTopic` notifications. Required if using email notifications.
@@ -182,7 +182,7 @@
 
     { # A budget is a plan that describes what you expect to spend on Cloud projects, plus the rules to execute as spend is tracked against that plan, (for example, send an alert when 90% of the target spend is met). The budget time period is configurable, with options such as month (default), quarter, year, or custom time period.
   "amount": { # The budgeted amount for each usage period. # Required. Budgeted amount.
-    "lastPeriodAmount": { # Describes a budget amount targeted to the last Filter.calendar_period spend. At this time, the amount is automatically 100% of the last calendar period's spend; that is, there are no other options yet. Future configuration options will be described here (for example, configuring a percentage of last period's spend). LastPeriodAmount cannot be set for a budget configured with a Filter.custom_period. # Use the last period's actual spend as the budget for the present period. LastPeriodAmount can only be set when the budget's time period is a Filter.calendar_period. It cannot be set in combination with Filter.custom_period.
+    "lastPeriodAmount": { # Describes a budget amount targeted to the last Filter.calendar_period spend. At this time, the amount is automatically 100% of the last calendar period's spend; that is, there are no other options yet. LastPeriodAmount cannot be set for a budget configured with a Filter.custom_period. # Use the last period's actual spend as the budget for the present period. LastPeriodAmount can only be set when the budget's time period is a Filter.calendar_period. It cannot be set in combination with Filter.custom_period.
     },
     "specifiedAmount": { # Represents an amount of money with its currency type. # A specified amount to use as the budget. `currency_code` is optional. If specified when creating a budget, it must match the currency of the billing account. If specified when updating a budget, it must match the currency_code of the existing budget. The `currency_code` is provided on output.
       "currencyCode": "A String", # The three-letter currency code defined in ISO 4217.
@@ -191,7 +191,7 @@
     },
   },
   "budgetFilter": { # A filter for a budget, limiting the scope of the cost to calculate. # Optional. Filters that define which resources are used to compute the actual spend against the budget amount, such as projects, services, and the budget's time period, as well as other filters.
-    "calendarPeriod": "A String", # Optional. Specifies to track usage for recurring calendar period. For example, assume that CalendarPeriod.QUARTER is set. The budget will track usage from April 1 to June 30, when the current calendar month is April, May, June. After that, it will track usage from July 1 to September 30 when the current calendar month is July, August, September, so on.
+    "calendarPeriod": "A String", # Optional. Specifies to track usage for recurring calendar period. For example, assume that CalendarPeriod.QUARTER is set. The budget tracks usage from April 1 to June 30, when the current calendar month is April, May, June. After that, it tracks usage from July 1 to September 30 when the current calendar month is July, August, September, so on.
     "creditTypes": [ # Optional. If Filter.credit_types_treatment is INCLUDE_SPECIFIED_CREDITS, this is a list of credit types to be subtracted from gross cost to determine the spend for threshold calculations. See [a list of acceptable credit type values](https://cloud.google.com/billing/docs/how-to/export-data-bigquery-tables#credits-type). If Filter.credit_types_treatment is **not** INCLUDE_SPECIFIED_CREDITS, this field must be empty.
       "A String",
     ],
@@ -208,30 +208,30 @@
         "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
       },
     },
-    "labels": { # Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. Currently, multiple entries or multiple values per entry are not allowed. If omitted, the report will include all labeled and unlabeled usage.
+    "labels": { # Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. If omitted, the report includes all labeled and unlabeled usage. An object containing a single `"key": value` pair. Example: `{ "name": "wrench" }`. _Currently, multiple entries or multiple values per entry are not allowed._
       "a_key": [
         "",
       ],
     },
-    "projects": [ # Optional. A set of projects of the form `projects/{project}`, specifying that usage from only this set of projects should be included in the budget. If omitted, the report will include all usage for the billing account, regardless of which project the usage occurred on. Only zero or one project can be specified currently.
+    "projects": [ # Optional. A set of projects of the form `projects/{project}`, specifying that usage from only this set of projects should be included in the budget. If omitted, the report includes all usage for the billing account, regardless of which project the usage occurred on. Only zero or one project can be specified currently.
       "A String",
     ],
-    "services": [ # Optional. A set of services of the form `services/{service_id}`, specifying that usage from only this set of services should be included in the budget. If omitted, the report will include usage for all the services. The service names are available through the Catalog API: https://cloud.google.com/billing/v1/how-tos/catalog-api.
+    "services": [ # Optional. A set of services of the form `services/{service_id}`, specifying that usage from only this set of services should be included in the budget. If omitted, the report includes usage for all the services. The service names are available through the Catalog API: https://cloud.google.com/billing/v1/how-tos/catalog-api.
       "A String",
     ],
-    "subaccounts": [ # Optional. A set of subaccounts of the form `billingAccounts/{account_id}`, specifying that usage from only this set of subaccounts should be included in the budget. If a subaccount is set to the name of the parent account, usage from the parent account will be included. If the field is omitted, the report will include usage from the parent account and all subaccounts, if they exist.
+    "subaccounts": [ # Optional. A set of subaccounts of the form `billingAccounts/{account_id}`, specifying that usage from only this set of subaccounts should be included in the budget. If a subaccount is set to the name of the parent account, usage from the parent account is included. If the field is omitted, the report includes usage from the parent account and all subaccounts, if they exist.
       "A String",
     ],
   },
   "displayName": "A String", # User data for display name in UI. The name must be less than or equal to 60 characters.
-  "etag": "A String", # Optional. Etag to validate that the object is unchanged for a read-modify-write operation. An empty etag will cause an update to overwrite other changes.
+  "etag": "A String", # Optional. Etag to validate that the object is unchanged for a read-modify-write operation. An empty etag causes an update to overwrite other changes.
   "name": "A String", # Output only. Resource name of the budget. The resource name implies the scope of a budget. Values are of the form `billingAccounts/{billingAccountId}/budgets/{budgetId}`.
   "notificationsRule": { # NotificationsRule defines notifications that are sent based on budget spend and thresholds. # Optional. Rules to apply to notifications sent based on budget spend and thresholds.
     "disableDefaultIamRecipients": True or False, # Optional. When set to true, disables default notifications sent when a threshold is exceeded. Default notifications are sent to those with Billing Account Administrator and Billing Account User IAM roles for the target account.
-    "monitoringNotificationChannels": [ # Optional. Targets to send notifications to when a threshold is exceeded. This is in addition to default recipients who have billing account IAM roles. The value is the full REST resource name of a monitoring notification channel with the form `projects/{project_id}/notificationChannels/{channel_id}`. A maximum of 5 channels are allowed. See https://cloud.google.com/billing/docs/how-to/budgets-notification-recipients for more details.
+    "monitoringNotificationChannels": [ # Optional. Email targets to send notifications to when a threshold is exceeded. This is in addition to the `DefaultIamRecipients` who receive alert emails based on their billing account IAM role. The value is the full REST resource name of a Cloud Monitoring email notification channel with the form `projects/{project_id}/notificationChannels/{channel_id}`. A maximum of 5 email notifications are allowed. To customize budget alert email recipients with monitoring notification channels, you _must create the monitoring notification channels before you link them to a budget_. For guidance on setting up notification channels to use with budgets, see [Customize budget alert email recipients](https://cloud.google.com/billing/docs/how-to/budgets-notification-recipients). For Cloud Billing budget alerts, you _must use email notification channels_. The other types of notification channels are _not_ supported, such as Slack, SMS, or PagerDuty. If you want to [send budget notifications to Slack](https://cloud.google.com/billing/docs/how-to/notify#send_notifications_to_slack), use a pubsubTopic and configure [programmatic notifications](https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications).
       "A String",
     ],
-    "pubsubTopic": "A String", # Optional. The name of the Pub/Sub topic where budget related messages will be published, in the form `projects/{project_id}/topics/{topic_id}`. Updates are sent at regular intervals to the topic. The topic needs to be created before the budget is created; see https://cloud.google.com/billing/docs/how-to/budgets#manage-notifications for more details. Caller is expected to have `pubsub.topics.setIamPolicy` permission on the topic when it's set for a budget, otherwise, the API call will fail with PERMISSION_DENIED. See https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications for more details on Pub/Sub roles and permissions.
+    "pubsubTopic": "A String", # Optional. The name of the Pub/Sub topic where budget-related messages are published, in the form `projects/{project_id}/topics/{topic_id}`. Updates are sent to the topic at regular intervals; the timing of the updates is not dependent on the [threshold rules](#thresholdrule) you've set. Note that if you want your [Pub/Sub JSON object](https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications#notification_format) to contain data for `alertThresholdExceeded`, you need at least one [alert threshold rule](#thresholdrule). When you set threshold rules, you must also enable at least one of the email notification options, either using the default IAM recipients or Cloud Monitoring email notification channels. To use Pub/Sub topics with budgets, you must do the following: 1. Create the Pub/Sub topic before connecting it to your budget. For guidance, see [Manage programmatic budget alert notifications](https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications). 2. Grant the API caller the `pubsub.topics.setIamPolicy` permission on the Pub/Sub topic. If not set, the API call fails with PERMISSION_DENIED. For additional details on Pub/Sub roles and permissions, see [Permissions required for this task](https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications#permissions_required_for_this_task).
     "schemaVersion": "A String", # Optional. Required when NotificationsRule.pubsub_topic is set. The schema version of the notification sent to NotificationsRule.pubsub_topic. Only "1.0" is accepted. It represents the JSON schema as defined in https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications#notification_format.
   },
   "thresholdRules": [ # Optional. Rules that trigger alerts (notifications of thresholds being crossed) when spend exceeds the specified percentages of the budget. Optional for `pubsubTopic` notifications. Required if using email notifications.
@@ -277,7 +277,7 @@
 
     { # A budget is a plan that describes what you expect to spend on Cloud projects, plus the rules to execute as spend is tracked against that plan, (for example, send an alert when 90% of the target spend is met). The budget time period is configurable, with options such as month (default), quarter, year, or custom time period.
   "amount": { # The budgeted amount for each usage period. # Required. Budgeted amount.
-    "lastPeriodAmount": { # Describes a budget amount targeted to the last Filter.calendar_period spend. At this time, the amount is automatically 100% of the last calendar period's spend; that is, there are no other options yet. Future configuration options will be described here (for example, configuring a percentage of last period's spend). LastPeriodAmount cannot be set for a budget configured with a Filter.custom_period. # Use the last period's actual spend as the budget for the present period. LastPeriodAmount can only be set when the budget's time period is a Filter.calendar_period. It cannot be set in combination with Filter.custom_period.
+    "lastPeriodAmount": { # Describes a budget amount targeted to the last Filter.calendar_period spend. At this time, the amount is automatically 100% of the last calendar period's spend; that is, there are no other options yet. LastPeriodAmount cannot be set for a budget configured with a Filter.custom_period. # Use the last period's actual spend as the budget for the present period. LastPeriodAmount can only be set when the budget's time period is a Filter.calendar_period. It cannot be set in combination with Filter.custom_period.
     },
     "specifiedAmount": { # Represents an amount of money with its currency type. # A specified amount to use as the budget. `currency_code` is optional. If specified when creating a budget, it must match the currency of the billing account. If specified when updating a budget, it must match the currency_code of the existing budget. The `currency_code` is provided on output.
       "currencyCode": "A String", # The three-letter currency code defined in ISO 4217.
@@ -286,7 +286,7 @@
     },
   },
   "budgetFilter": { # A filter for a budget, limiting the scope of the cost to calculate. # Optional. Filters that define which resources are used to compute the actual spend against the budget amount, such as projects, services, and the budget's time period, as well as other filters.
-    "calendarPeriod": "A String", # Optional. Specifies to track usage for recurring calendar period. For example, assume that CalendarPeriod.QUARTER is set. The budget will track usage from April 1 to June 30, when the current calendar month is April, May, June. After that, it will track usage from July 1 to September 30 when the current calendar month is July, August, September, so on.
+    "calendarPeriod": "A String", # Optional. Specifies to track usage for recurring calendar period. For example, assume that CalendarPeriod.QUARTER is set. The budget tracks usage from April 1 to June 30, when the current calendar month is April, May, June. After that, it tracks usage from July 1 to September 30 when the current calendar month is July, August, September, so on.
     "creditTypes": [ # Optional. If Filter.credit_types_treatment is INCLUDE_SPECIFIED_CREDITS, this is a list of credit types to be subtracted from gross cost to determine the spend for threshold calculations. See [a list of acceptable credit type values](https://cloud.google.com/billing/docs/how-to/export-data-bigquery-tables#credits-type). If Filter.credit_types_treatment is **not** INCLUDE_SPECIFIED_CREDITS, this field must be empty.
       "A String",
     ],
@@ -303,30 +303,30 @@
         "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
       },
     },
-    "labels": { # Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. Currently, multiple entries or multiple values per entry are not allowed. If omitted, the report will include all labeled and unlabeled usage.
+    "labels": { # Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. If omitted, the report includes all labeled and unlabeled usage. An object containing a single `"key": value` pair. Example: `{ "name": "wrench" }`. _Currently, multiple entries or multiple values per entry are not allowed._
       "a_key": [
         "",
       ],
     },
-    "projects": [ # Optional. A set of projects of the form `projects/{project}`, specifying that usage from only this set of projects should be included in the budget. If omitted, the report will include all usage for the billing account, regardless of which project the usage occurred on. Only zero or one project can be specified currently.
+    "projects": [ # Optional. A set of projects of the form `projects/{project}`, specifying that usage from only this set of projects should be included in the budget. If omitted, the report includes all usage for the billing account, regardless of which project the usage occurred on. Only zero or one project can be specified currently.
       "A String",
     ],
-    "services": [ # Optional. A set of services of the form `services/{service_id}`, specifying that usage from only this set of services should be included in the budget. If omitted, the report will include usage for all the services. The service names are available through the Catalog API: https://cloud.google.com/billing/v1/how-tos/catalog-api.
+    "services": [ # Optional. A set of services of the form `services/{service_id}`, specifying that usage from only this set of services should be included in the budget. If omitted, the report includes usage for all the services. The service names are available through the Catalog API: https://cloud.google.com/billing/v1/how-tos/catalog-api.
       "A String",
     ],
-    "subaccounts": [ # Optional. A set of subaccounts of the form `billingAccounts/{account_id}`, specifying that usage from only this set of subaccounts should be included in the budget. If a subaccount is set to the name of the parent account, usage from the parent account will be included. If the field is omitted, the report will include usage from the parent account and all subaccounts, if they exist.
+    "subaccounts": [ # Optional. A set of subaccounts of the form `billingAccounts/{account_id}`, specifying that usage from only this set of subaccounts should be included in the budget. If a subaccount is set to the name of the parent account, usage from the parent account is included. If the field is omitted, the report includes usage from the parent account and all subaccounts, if they exist.
       "A String",
     ],
   },
   "displayName": "A String", # User data for display name in UI. The name must be less than or equal to 60 characters.
-  "etag": "A String", # Optional. Etag to validate that the object is unchanged for a read-modify-write operation. An empty etag will cause an update to overwrite other changes.
+  "etag": "A String", # Optional. Etag to validate that the object is unchanged for a read-modify-write operation. An empty etag causes an update to overwrite other changes.
   "name": "A String", # Output only. Resource name of the budget. The resource name implies the scope of a budget. Values are of the form `billingAccounts/{billingAccountId}/budgets/{budgetId}`.
   "notificationsRule": { # NotificationsRule defines notifications that are sent based on budget spend and thresholds. # Optional. Rules to apply to notifications sent based on budget spend and thresholds.
     "disableDefaultIamRecipients": True or False, # Optional. When set to true, disables default notifications sent when a threshold is exceeded. Default notifications are sent to those with Billing Account Administrator and Billing Account User IAM roles for the target account.
-    "monitoringNotificationChannels": [ # Optional. Targets to send notifications to when a threshold is exceeded. This is in addition to default recipients who have billing account IAM roles. The value is the full REST resource name of a monitoring notification channel with the form `projects/{project_id}/notificationChannels/{channel_id}`. A maximum of 5 channels are allowed. See https://cloud.google.com/billing/docs/how-to/budgets-notification-recipients for more details.
+    "monitoringNotificationChannels": [ # Optional. Email targets to send notifications to when a threshold is exceeded. This is in addition to the `DefaultIamRecipients` who receive alert emails based on their billing account IAM role. The value is the full REST resource name of a Cloud Monitoring email notification channel with the form `projects/{project_id}/notificationChannels/{channel_id}`. A maximum of 5 email notifications are allowed. To customize budget alert email recipients with monitoring notification channels, you _must create the monitoring notification channels before you link them to a budget_. For guidance on setting up notification channels to use with budgets, see [Customize budget alert email recipients](https://cloud.google.com/billing/docs/how-to/budgets-notification-recipients). For Cloud Billing budget alerts, you _must use email notification channels_. The other types of notification channels are _not_ supported, such as Slack, SMS, or PagerDuty. If you want to [send budget notifications to Slack](https://cloud.google.com/billing/docs/how-to/notify#send_notifications_to_slack), use a pubsubTopic and configure [programmatic notifications](https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications).
       "A String",
     ],
-    "pubsubTopic": "A String", # Optional. The name of the Pub/Sub topic where budget related messages will be published, in the form `projects/{project_id}/topics/{topic_id}`. Updates are sent at regular intervals to the topic. The topic needs to be created before the budget is created; see https://cloud.google.com/billing/docs/how-to/budgets#manage-notifications for more details. Caller is expected to have `pubsub.topics.setIamPolicy` permission on the topic when it's set for a budget, otherwise, the API call will fail with PERMISSION_DENIED. See https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications for more details on Pub/Sub roles and permissions.
+    "pubsubTopic": "A String", # Optional. The name of the Pub/Sub topic where budget-related messages are published, in the form `projects/{project_id}/topics/{topic_id}`. Updates are sent to the topic at regular intervals; the timing of the updates is not dependent on the [threshold rules](#thresholdrule) you've set. Note that if you want your [Pub/Sub JSON object](https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications#notification_format) to contain data for `alertThresholdExceeded`, you need at least one [alert threshold rule](#thresholdrule). When you set threshold rules, you must also enable at least one of the email notification options, either using the default IAM recipients or Cloud Monitoring email notification channels. To use Pub/Sub topics with budgets, you must do the following: 1. Create the Pub/Sub topic before connecting it to your budget. For guidance, see [Manage programmatic budget alert notifications](https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications). 2. Grant the API caller the `pubsub.topics.setIamPolicy` permission on the Pub/Sub topic. If not set, the API call fails with PERMISSION_DENIED. For additional details on Pub/Sub roles and permissions, see [Permissions required for this task](https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications#permissions_required_for_this_task).
     "schemaVersion": "A String", # Optional. Required when NotificationsRule.pubsub_topic is set. The schema version of the notification sent to NotificationsRule.pubsub_topic. Only "1.0" is accepted. It represents the JSON schema as defined in https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications#notification_format.
   },
   "thresholdRules": [ # Optional. Rules that trigger alerts (notifications of thresholds being crossed) when spend exceeds the specified percentages of the budget. Optional for `pubsubTopic` notifications. Required if using email notifications.
@@ -358,7 +358,7 @@
   "budgets": [ # List of the budgets owned by the requested billing account.
     { # A budget is a plan that describes what you expect to spend on Cloud projects, plus the rules to execute as spend is tracked against that plan, (for example, send an alert when 90% of the target spend is met). The budget time period is configurable, with options such as month (default), quarter, year, or custom time period.
       "amount": { # The budgeted amount for each usage period. # Required. Budgeted amount.
-        "lastPeriodAmount": { # Describes a budget amount targeted to the last Filter.calendar_period spend. At this time, the amount is automatically 100% of the last calendar period's spend; that is, there are no other options yet. Future configuration options will be described here (for example, configuring a percentage of last period's spend). LastPeriodAmount cannot be set for a budget configured with a Filter.custom_period. # Use the last period's actual spend as the budget for the present period. LastPeriodAmount can only be set when the budget's time period is a Filter.calendar_period. It cannot be set in combination with Filter.custom_period.
+        "lastPeriodAmount": { # Describes a budget amount targeted to the last Filter.calendar_period spend. At this time, the amount is automatically 100% of the last calendar period's spend; that is, there are no other options yet. LastPeriodAmount cannot be set for a budget configured with a Filter.custom_period. # Use the last period's actual spend as the budget for the present period. LastPeriodAmount can only be set when the budget's time period is a Filter.calendar_period. It cannot be set in combination with Filter.custom_period.
         },
         "specifiedAmount": { # Represents an amount of money with its currency type. # A specified amount to use as the budget. `currency_code` is optional. If specified when creating a budget, it must match the currency of the billing account. If specified when updating a budget, it must match the currency_code of the existing budget. The `currency_code` is provided on output.
           "currencyCode": "A String", # The three-letter currency code defined in ISO 4217.
@@ -367,7 +367,7 @@
         },
       },
       "budgetFilter": { # A filter for a budget, limiting the scope of the cost to calculate. # Optional. Filters that define which resources are used to compute the actual spend against the budget amount, such as projects, services, and the budget's time period, as well as other filters.
-        "calendarPeriod": "A String", # Optional. Specifies to track usage for recurring calendar period. For example, assume that CalendarPeriod.QUARTER is set. The budget will track usage from April 1 to June 30, when the current calendar month is April, May, June. After that, it will track usage from July 1 to September 30 when the current calendar month is July, August, September, so on.
+        "calendarPeriod": "A String", # Optional. Specifies to track usage for recurring calendar period. For example, assume that CalendarPeriod.QUARTER is set. The budget tracks usage from April 1 to June 30, when the current calendar month is April, May, June. After that, it tracks usage from July 1 to September 30 when the current calendar month is July, August, September, so on.
         "creditTypes": [ # Optional. If Filter.credit_types_treatment is INCLUDE_SPECIFIED_CREDITS, this is a list of credit types to be subtracted from gross cost to determine the spend for threshold calculations. See [a list of acceptable credit type values](https://cloud.google.com/billing/docs/how-to/export-data-bigquery-tables#credits-type). If Filter.credit_types_treatment is **not** INCLUDE_SPECIFIED_CREDITS, this field must be empty.
           "A String",
         ],
@@ -384,30 +384,30 @@
             "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
           },
         },
-        "labels": { # Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. Currently, multiple entries or multiple values per entry are not allowed. If omitted, the report will include all labeled and unlabeled usage.
+        "labels": { # Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. If omitted, the report includes all labeled and unlabeled usage. An object containing a single `"key": value` pair. Example: `{ "name": "wrench" }`. _Currently, multiple entries or multiple values per entry are not allowed._
           "a_key": [
             "",
           ],
         },
-        "projects": [ # Optional. A set of projects of the form `projects/{project}`, specifying that usage from only this set of projects should be included in the budget. If omitted, the report will include all usage for the billing account, regardless of which project the usage occurred on. Only zero or one project can be specified currently.
+        "projects": [ # Optional. A set of projects of the form `projects/{project}`, specifying that usage from only this set of projects should be included in the budget. If omitted, the report includes all usage for the billing account, regardless of which project the usage occurred on. Only zero or one project can be specified currently.
           "A String",
         ],
-        "services": [ # Optional. A set of services of the form `services/{service_id}`, specifying that usage from only this set of services should be included in the budget. If omitted, the report will include usage for all the services. The service names are available through the Catalog API: https://cloud.google.com/billing/v1/how-tos/catalog-api.
+        "services": [ # Optional. A set of services of the form `services/{service_id}`, specifying that usage from only this set of services should be included in the budget. If omitted, the report includes usage for all the services. The service names are available through the Catalog API: https://cloud.google.com/billing/v1/how-tos/catalog-api.
           "A String",
         ],
-        "subaccounts": [ # Optional. A set of subaccounts of the form `billingAccounts/{account_id}`, specifying that usage from only this set of subaccounts should be included in the budget. If a subaccount is set to the name of the parent account, usage from the parent account will be included. If the field is omitted, the report will include usage from the parent account and all subaccounts, if they exist.
+        "subaccounts": [ # Optional. A set of subaccounts of the form `billingAccounts/{account_id}`, specifying that usage from only this set of subaccounts should be included in the budget. If a subaccount is set to the name of the parent account, usage from the parent account is included. If the field is omitted, the report includes usage from the parent account and all subaccounts, if they exist.
           "A String",
         ],
       },
       "displayName": "A String", # User data for display name in UI. The name must be less than or equal to 60 characters.
-      "etag": "A String", # Optional. Etag to validate that the object is unchanged for a read-modify-write operation. An empty etag will cause an update to overwrite other changes.
+      "etag": "A String", # Optional. Etag to validate that the object is unchanged for a read-modify-write operation. An empty etag causes an update to overwrite other changes.
       "name": "A String", # Output only. Resource name of the budget. The resource name implies the scope of a budget. Values are of the form `billingAccounts/{billingAccountId}/budgets/{budgetId}`.
       "notificationsRule": { # NotificationsRule defines notifications that are sent based on budget spend and thresholds. # Optional. Rules to apply to notifications sent based on budget spend and thresholds.
         "disableDefaultIamRecipients": True or False, # Optional. When set to true, disables default notifications sent when a threshold is exceeded. Default notifications are sent to those with Billing Account Administrator and Billing Account User IAM roles for the target account.
-        "monitoringNotificationChannels": [ # Optional. Targets to send notifications to when a threshold is exceeded. This is in addition to default recipients who have billing account IAM roles. The value is the full REST resource name of a monitoring notification channel with the form `projects/{project_id}/notificationChannels/{channel_id}`. A maximum of 5 channels are allowed. See https://cloud.google.com/billing/docs/how-to/budgets-notification-recipients for more details.
+        "monitoringNotificationChannels": [ # Optional. Email targets to send notifications to when a threshold is exceeded. This is in addition to the `DefaultIamRecipients` who receive alert emails based on their billing account IAM role. The value is the full REST resource name of a Cloud Monitoring email notification channel with the form `projects/{project_id}/notificationChannels/{channel_id}`. A maximum of 5 email notifications are allowed. To customize budget alert email recipients with monitoring notification channels, you _must create the monitoring notification channels before you link them to a budget_. For guidance on setting up notification channels to use with budgets, see [Customize budget alert email recipients](https://cloud.google.com/billing/docs/how-to/budgets-notification-recipients). For Cloud Billing budget alerts, you _must use email notification channels_. The other types of notification channels are _not_ supported, such as Slack, SMS, or PagerDuty. If you want to [send budget notifications to Slack](https://cloud.google.com/billing/docs/how-to/notify#send_notifications_to_slack), use a pubsubTopic and configure [programmatic notifications](https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications).
           "A String",
         ],
-        "pubsubTopic": "A String", # Optional. The name of the Pub/Sub topic where budget related messages will be published, in the form `projects/{project_id}/topics/{topic_id}`. Updates are sent at regular intervals to the topic. The topic needs to be created before the budget is created; see https://cloud.google.com/billing/docs/how-to/budgets#manage-notifications for more details. Caller is expected to have `pubsub.topics.setIamPolicy` permission on the topic when it's set for a budget, otherwise, the API call will fail with PERMISSION_DENIED. See https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications for more details on Pub/Sub roles and permissions.
+        "pubsubTopic": "A String", # Optional. The name of the Pub/Sub topic where budget-related messages are published, in the form `projects/{project_id}/topics/{topic_id}`. Updates are sent to the topic at regular intervals; the timing of the updates is not dependent on the [threshold rules](#thresholdrule) you've set. Note that if you want your [Pub/Sub JSON object](https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications#notification_format) to contain data for `alertThresholdExceeded`, you need at least one [alert threshold rule](#thresholdrule). When you set threshold rules, you must also enable at least one of the email notification options, either using the default IAM recipients or Cloud Monitoring email notification channels. To use Pub/Sub topics with budgets, you must do the following: 1. Create the Pub/Sub topic before connecting it to your budget. For guidance, see [Manage programmatic budget alert notifications](https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications). 2. Grant the API caller the `pubsub.topics.setIamPolicy` permission on the Pub/Sub topic. If not set, the API call fails with PERMISSION_DENIED. For additional details on Pub/Sub roles and permissions, see [Permissions required for this task](https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications#permissions_required_for_this_task).
         "schemaVersion": "A String", # Optional. Required when NotificationsRule.pubsub_topic is set. The schema version of the notification sent to NotificationsRule.pubsub_topic. Only "1.0" is accepted. It represents the JSON schema as defined in https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications#notification_format.
       },
       "thresholdRules": [ # Optional. Rules that trigger alerts (notifications of thresholds being crossed) when spend exceeds the specified percentages of the budget. Optional for `pubsubTopic` notifications. Required if using email notifications.
@@ -447,7 +447,7 @@
 
 { # A budget is a plan that describes what you expect to spend on Cloud projects, plus the rules to execute as spend is tracked against that plan, (for example, send an alert when 90% of the target spend is met). The budget time period is configurable, with options such as month (default), quarter, year, or custom time period.
   "amount": { # The budgeted amount for each usage period. # Required. Budgeted amount.
-    "lastPeriodAmount": { # Describes a budget amount targeted to the last Filter.calendar_period spend. At this time, the amount is automatically 100% of the last calendar period's spend; that is, there are no other options yet. Future configuration options will be described here (for example, configuring a percentage of last period's spend). LastPeriodAmount cannot be set for a budget configured with a Filter.custom_period. # Use the last period's actual spend as the budget for the present period. LastPeriodAmount can only be set when the budget's time period is a Filter.calendar_period. It cannot be set in combination with Filter.custom_period.
+    "lastPeriodAmount": { # Describes a budget amount targeted to the last Filter.calendar_period spend. At this time, the amount is automatically 100% of the last calendar period's spend; that is, there are no other options yet. LastPeriodAmount cannot be set for a budget configured with a Filter.custom_period. # Use the last period's actual spend as the budget for the present period. LastPeriodAmount can only be set when the budget's time period is a Filter.calendar_period. It cannot be set in combination with Filter.custom_period.
     },
     "specifiedAmount": { # Represents an amount of money with its currency type. # A specified amount to use as the budget. `currency_code` is optional. If specified when creating a budget, it must match the currency of the billing account. If specified when updating a budget, it must match the currency_code of the existing budget. The `currency_code` is provided on output.
       "currencyCode": "A String", # The three-letter currency code defined in ISO 4217.
@@ -456,7 +456,7 @@
     },
   },
   "budgetFilter": { # A filter for a budget, limiting the scope of the cost to calculate. # Optional. Filters that define which resources are used to compute the actual spend against the budget amount, such as projects, services, and the budget's time period, as well as other filters.
-    "calendarPeriod": "A String", # Optional. Specifies to track usage for recurring calendar period. For example, assume that CalendarPeriod.QUARTER is set. The budget will track usage from April 1 to June 30, when the current calendar month is April, May, June. After that, it will track usage from July 1 to September 30 when the current calendar month is July, August, September, so on.
+    "calendarPeriod": "A String", # Optional. Specifies to track usage for recurring calendar period. For example, assume that CalendarPeriod.QUARTER is set. The budget tracks usage from April 1 to June 30, when the current calendar month is April, May, June. After that, it tracks usage from July 1 to September 30 when the current calendar month is July, August, September, so on.
     "creditTypes": [ # Optional. If Filter.credit_types_treatment is INCLUDE_SPECIFIED_CREDITS, this is a list of credit types to be subtracted from gross cost to determine the spend for threshold calculations. See [a list of acceptable credit type values](https://cloud.google.com/billing/docs/how-to/export-data-bigquery-tables#credits-type). If Filter.credit_types_treatment is **not** INCLUDE_SPECIFIED_CREDITS, this field must be empty.
       "A String",
     ],
@@ -473,30 +473,30 @@
         "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
       },
     },
-    "labels": { # Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. Currently, multiple entries or multiple values per entry are not allowed. If omitted, the report will include all labeled and unlabeled usage.
+    "labels": { # Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. If omitted, the report includes all labeled and unlabeled usage. An object containing a single `"key": value` pair. Example: `{ "name": "wrench" }`. _Currently, multiple entries or multiple values per entry are not allowed._
       "a_key": [
         "",
       ],
     },
-    "projects": [ # Optional. A set of projects of the form `projects/{project}`, specifying that usage from only this set of projects should be included in the budget. If omitted, the report will include all usage for the billing account, regardless of which project the usage occurred on. Only zero or one project can be specified currently.
+    "projects": [ # Optional. A set of projects of the form `projects/{project}`, specifying that usage from only this set of projects should be included in the budget. If omitted, the report includes all usage for the billing account, regardless of which project the usage occurred on. Only zero or one project can be specified currently.
       "A String",
     ],
-    "services": [ # Optional. A set of services of the form `services/{service_id}`, specifying that usage from only this set of services should be included in the budget. If omitted, the report will include usage for all the services. The service names are available through the Catalog API: https://cloud.google.com/billing/v1/how-tos/catalog-api.
+    "services": [ # Optional. A set of services of the form `services/{service_id}`, specifying that usage from only this set of services should be included in the budget. If omitted, the report includes usage for all the services. The service names are available through the Catalog API: https://cloud.google.com/billing/v1/how-tos/catalog-api.
       "A String",
     ],
-    "subaccounts": [ # Optional. A set of subaccounts of the form `billingAccounts/{account_id}`, specifying that usage from only this set of subaccounts should be included in the budget. If a subaccount is set to the name of the parent account, usage from the parent account will be included. If the field is omitted, the report will include usage from the parent account and all subaccounts, if they exist.
+    "subaccounts": [ # Optional. A set of subaccounts of the form `billingAccounts/{account_id}`, specifying that usage from only this set of subaccounts should be included in the budget. If a subaccount is set to the name of the parent account, usage from the parent account is included. If the field is omitted, the report includes usage from the parent account and all subaccounts, if they exist.
       "A String",
     ],
   },
   "displayName": "A String", # User data for display name in UI. The name must be less than or equal to 60 characters.
-  "etag": "A String", # Optional. Etag to validate that the object is unchanged for a read-modify-write operation. An empty etag will cause an update to overwrite other changes.
+  "etag": "A String", # Optional. Etag to validate that the object is unchanged for a read-modify-write operation. An empty etag causes an update to overwrite other changes.
   "name": "A String", # Output only. Resource name of the budget. The resource name implies the scope of a budget. Values are of the form `billingAccounts/{billingAccountId}/budgets/{budgetId}`.
   "notificationsRule": { # NotificationsRule defines notifications that are sent based on budget spend and thresholds. # Optional. Rules to apply to notifications sent based on budget spend and thresholds.
     "disableDefaultIamRecipients": True or False, # Optional. When set to true, disables default notifications sent when a threshold is exceeded. Default notifications are sent to those with Billing Account Administrator and Billing Account User IAM roles for the target account.
-    "monitoringNotificationChannels": [ # Optional. Targets to send notifications to when a threshold is exceeded. This is in addition to default recipients who have billing account IAM roles. The value is the full REST resource name of a monitoring notification channel with the form `projects/{project_id}/notificationChannels/{channel_id}`. A maximum of 5 channels are allowed. See https://cloud.google.com/billing/docs/how-to/budgets-notification-recipients for more details.
+    "monitoringNotificationChannels": [ # Optional. Email targets to send notifications to when a threshold is exceeded. This is in addition to the `DefaultIamRecipients` who receive alert emails based on their billing account IAM role. The value is the full REST resource name of a Cloud Monitoring email notification channel with the form `projects/{project_id}/notificationChannels/{channel_id}`. A maximum of 5 email notifications are allowed. To customize budget alert email recipients with monitoring notification channels, you _must create the monitoring notification channels before you link them to a budget_. For guidance on setting up notification channels to use with budgets, see [Customize budget alert email recipients](https://cloud.google.com/billing/docs/how-to/budgets-notification-recipients). For Cloud Billing budget alerts, you _must use email notification channels_. The other types of notification channels are _not_ supported, such as Slack, SMS, or PagerDuty. If you want to [send budget notifications to Slack](https://cloud.google.com/billing/docs/how-to/notify#send_notifications_to_slack), use a pubsubTopic and configure [programmatic notifications](https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications).
       "A String",
     ],
-    "pubsubTopic": "A String", # Optional. The name of the Pub/Sub topic where budget related messages will be published, in the form `projects/{project_id}/topics/{topic_id}`. Updates are sent at regular intervals to the topic. The topic needs to be created before the budget is created; see https://cloud.google.com/billing/docs/how-to/budgets#manage-notifications for more details. Caller is expected to have `pubsub.topics.setIamPolicy` permission on the topic when it's set for a budget, otherwise, the API call will fail with PERMISSION_DENIED. See https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications for more details on Pub/Sub roles and permissions.
+    "pubsubTopic": "A String", # Optional. The name of the Pub/Sub topic where budget-related messages are published, in the form `projects/{project_id}/topics/{topic_id}`. Updates are sent to the topic at regular intervals; the timing of the updates is not dependent on the [threshold rules](#thresholdrule) you've set. Note that if you want your [Pub/Sub JSON object](https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications#notification_format) to contain data for `alertThresholdExceeded`, you need at least one [alert threshold rule](#thresholdrule). When you set threshold rules, you must also enable at least one of the email notification options, either using the default IAM recipients or Cloud Monitoring email notification channels. To use Pub/Sub topics with budgets, you must do the following: 1. Create the Pub/Sub topic before connecting it to your budget. For guidance, see [Manage programmatic budget alert notifications](https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications). 2. Grant the API caller the `pubsub.topics.setIamPolicy` permission on the Pub/Sub topic. If not set, the API call fails with PERMISSION_DENIED. For additional details on Pub/Sub roles and permissions, see [Permissions required for this task](https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications#permissions_required_for_this_task).
     "schemaVersion": "A String", # Optional. Required when NotificationsRule.pubsub_topic is set. The schema version of the notification sent to NotificationsRule.pubsub_topic. Only "1.0" is accepted. It represents the JSON schema as defined in https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications#notification_format.
   },
   "thresholdRules": [ # Optional. Rules that trigger alerts (notifications of thresholds being crossed) when spend exceeds the specified percentages of the budget. Optional for `pubsubTopic` notifications. Required if using email notifications.
@@ -518,7 +518,7 @@
 
     { # A budget is a plan that describes what you expect to spend on Cloud projects, plus the rules to execute as spend is tracked against that plan, (for example, send an alert when 90% of the target spend is met). The budget time period is configurable, with options such as month (default), quarter, year, or custom time period.
   "amount": { # The budgeted amount for each usage period. # Required. Budgeted amount.
-    "lastPeriodAmount": { # Describes a budget amount targeted to the last Filter.calendar_period spend. At this time, the amount is automatically 100% of the last calendar period's spend; that is, there are no other options yet. Future configuration options will be described here (for example, configuring a percentage of last period's spend). LastPeriodAmount cannot be set for a budget configured with a Filter.custom_period. # Use the last period's actual spend as the budget for the present period. LastPeriodAmount can only be set when the budget's time period is a Filter.calendar_period. It cannot be set in combination with Filter.custom_period.
+    "lastPeriodAmount": { # Describes a budget amount targeted to the last Filter.calendar_period spend. At this time, the amount is automatically 100% of the last calendar period's spend; that is, there are no other options yet. LastPeriodAmount cannot be set for a budget configured with a Filter.custom_period. # Use the last period's actual spend as the budget for the present period. LastPeriodAmount can only be set when the budget's time period is a Filter.calendar_period. It cannot be set in combination with Filter.custom_period.
     },
     "specifiedAmount": { # Represents an amount of money with its currency type. # A specified amount to use as the budget. `currency_code` is optional. If specified when creating a budget, it must match the currency of the billing account. If specified when updating a budget, it must match the currency_code of the existing budget. The `currency_code` is provided on output.
       "currencyCode": "A String", # The three-letter currency code defined in ISO 4217.
@@ -527,7 +527,7 @@
     },
   },
   "budgetFilter": { # A filter for a budget, limiting the scope of the cost to calculate. # Optional. Filters that define which resources are used to compute the actual spend against the budget amount, such as projects, services, and the budget's time period, as well as other filters.
-    "calendarPeriod": "A String", # Optional. Specifies to track usage for recurring calendar period. For example, assume that CalendarPeriod.QUARTER is set. The budget will track usage from April 1 to June 30, when the current calendar month is April, May, June. After that, it will track usage from July 1 to September 30 when the current calendar month is July, August, September, so on.
+    "calendarPeriod": "A String", # Optional. Specifies to track usage for recurring calendar period. For example, assume that CalendarPeriod.QUARTER is set. The budget tracks usage from April 1 to June 30, when the current calendar month is April, May, June. After that, it tracks usage from July 1 to September 30 when the current calendar month is July, August, September, so on.
     "creditTypes": [ # Optional. If Filter.credit_types_treatment is INCLUDE_SPECIFIED_CREDITS, this is a list of credit types to be subtracted from gross cost to determine the spend for threshold calculations. See [a list of acceptable credit type values](https://cloud.google.com/billing/docs/how-to/export-data-bigquery-tables#credits-type). If Filter.credit_types_treatment is **not** INCLUDE_SPECIFIED_CREDITS, this field must be empty.
       "A String",
     ],
@@ -544,30 +544,30 @@
         "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
       },
     },
-    "labels": { # Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. Currently, multiple entries or multiple values per entry are not allowed. If omitted, the report will include all labeled and unlabeled usage.
+    "labels": { # Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. If omitted, the report includes all labeled and unlabeled usage. An object containing a single `"key": value` pair. Example: `{ "name": "wrench" }`. _Currently, multiple entries or multiple values per entry are not allowed._
       "a_key": [
         "",
       ],
     },
-    "projects": [ # Optional. A set of projects of the form `projects/{project}`, specifying that usage from only this set of projects should be included in the budget. If omitted, the report will include all usage for the billing account, regardless of which project the usage occurred on. Only zero or one project can be specified currently.
+    "projects": [ # Optional. A set of projects of the form `projects/{project}`, specifying that usage from only this set of projects should be included in the budget. If omitted, the report includes all usage for the billing account, regardless of which project the usage occurred on. Only zero or one project can be specified currently.
       "A String",
     ],
-    "services": [ # Optional. A set of services of the form `services/{service_id}`, specifying that usage from only this set of services should be included in the budget. If omitted, the report will include usage for all the services. The service names are available through the Catalog API: https://cloud.google.com/billing/v1/how-tos/catalog-api.
+    "services": [ # Optional. A set of services of the form `services/{service_id}`, specifying that usage from only this set of services should be included in the budget. If omitted, the report includes usage for all the services. The service names are available through the Catalog API: https://cloud.google.com/billing/v1/how-tos/catalog-api.
       "A String",
     ],
-    "subaccounts": [ # Optional. A set of subaccounts of the form `billingAccounts/{account_id}`, specifying that usage from only this set of subaccounts should be included in the budget. If a subaccount is set to the name of the parent account, usage from the parent account will be included. If the field is omitted, the report will include usage from the parent account and all subaccounts, if they exist.
+    "subaccounts": [ # Optional. A set of subaccounts of the form `billingAccounts/{account_id}`, specifying that usage from only this set of subaccounts should be included in the budget. If a subaccount is set to the name of the parent account, usage from the parent account is included. If the field is omitted, the report includes usage from the parent account and all subaccounts, if they exist.
       "A String",
     ],
   },
   "displayName": "A String", # User data for display name in UI. The name must be less than or equal to 60 characters.
-  "etag": "A String", # Optional. Etag to validate that the object is unchanged for a read-modify-write operation. An empty etag will cause an update to overwrite other changes.
+  "etag": "A String", # Optional. Etag to validate that the object is unchanged for a read-modify-write operation. An empty etag causes an update to overwrite other changes.
   "name": "A String", # Output only. Resource name of the budget. The resource name implies the scope of a budget. Values are of the form `billingAccounts/{billingAccountId}/budgets/{budgetId}`.
   "notificationsRule": { # NotificationsRule defines notifications that are sent based on budget spend and thresholds. # Optional. Rules to apply to notifications sent based on budget spend and thresholds.
     "disableDefaultIamRecipients": True or False, # Optional. When set to true, disables default notifications sent when a threshold is exceeded. Default notifications are sent to those with Billing Account Administrator and Billing Account User IAM roles for the target account.
-    "monitoringNotificationChannels": [ # Optional. Targets to send notifications to when a threshold is exceeded. This is in addition to default recipients who have billing account IAM roles. The value is the full REST resource name of a monitoring notification channel with the form `projects/{project_id}/notificationChannels/{channel_id}`. A maximum of 5 channels are allowed. See https://cloud.google.com/billing/docs/how-to/budgets-notification-recipients for more details.
+    "monitoringNotificationChannels": [ # Optional. Email targets to send notifications to when a threshold is exceeded. This is in addition to the `DefaultIamRecipients` who receive alert emails based on their billing account IAM role. The value is the full REST resource name of a Cloud Monitoring email notification channel with the form `projects/{project_id}/notificationChannels/{channel_id}`. A maximum of 5 email notifications are allowed. To customize budget alert email recipients with monitoring notification channels, you _must create the monitoring notification channels before you link them to a budget_. For guidance on setting up notification channels to use with budgets, see [Customize budget alert email recipients](https://cloud.google.com/billing/docs/how-to/budgets-notification-recipients). For Cloud Billing budget alerts, you _must use email notification channels_. The other types of notification channels are _not_ supported, such as Slack, SMS, or PagerDuty. If you want to [send budget notifications to Slack](https://cloud.google.com/billing/docs/how-to/notify#send_notifications_to_slack), use a pubsubTopic and configure [programmatic notifications](https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications).
       "A String",
     ],
-    "pubsubTopic": "A String", # Optional. The name of the Pub/Sub topic where budget related messages will be published, in the form `projects/{project_id}/topics/{topic_id}`. Updates are sent at regular intervals to the topic. The topic needs to be created before the budget is created; see https://cloud.google.com/billing/docs/how-to/budgets#manage-notifications for more details. Caller is expected to have `pubsub.topics.setIamPolicy` permission on the topic when it's set for a budget, otherwise, the API call will fail with PERMISSION_DENIED. See https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications for more details on Pub/Sub roles and permissions.
+    "pubsubTopic": "A String", # Optional. The name of the Pub/Sub topic where budget-related messages are published, in the form `projects/{project_id}/topics/{topic_id}`. Updates are sent to the topic at regular intervals; the timing of the updates is not dependent on the [threshold rules](#thresholdrule) you've set. Note that if you want your [Pub/Sub JSON object](https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications#notification_format) to contain data for `alertThresholdExceeded`, you need at least one [alert threshold rule](#thresholdrule). When you set threshold rules, you must also enable at least one of the email notification options, either using the default IAM recipients or Cloud Monitoring email notification channels. To use Pub/Sub topics with budgets, you must do the following: 1. Create the Pub/Sub topic before connecting it to your budget. For guidance, see [Manage programmatic budget alert notifications](https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications). 2. Grant the API caller the `pubsub.topics.setIamPolicy` permission on the Pub/Sub topic. If not set, the API call fails with PERMISSION_DENIED. For additional details on Pub/Sub roles and permissions, see [Permissions required for this task](https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications#permissions_required_for_this_task).
     "schemaVersion": "A String", # Optional. Required when NotificationsRule.pubsub_topic is set. The schema version of the notification sent to NotificationsRule.pubsub_topic. Only "1.0" is accepted. It represents the JSON schema as defined in https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications#notification_format.
   },
   "thresholdRules": [ # Optional. Rules that trigger alerts (notifications of thresholds being crossed) when spend exceeds the specified percentages of the budget. Optional for `pubsubTopic` notifications. Required if using email notifications.

docs/dyn/billingbudgets_v1beta1.billingAccounts.budgets.html

diff --git a/docs/dyn/billingbudgets_v1beta1.billingAccounts.budgets.html b/docs/dyn/billingbudgets_v1beta1.billingAccounts.budgets.html
index 46e7bb4..ebb3e66 100644
--- a/docs/dyn/billingbudgets_v1beta1.billingAccounts.budgets.html
+++ b/docs/dyn/billingbudgets_v1beta1.billingAccounts.budgets.html
@@ -147,7 +147,7 @@
           "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
         },
       },
-      "labels": { # Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. Currently, multiple entries or multiple values per entry are not allowed. If omitted, the report will include all labeled and unlabeled usage.
+      "labels": { # Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. If omitted, the report will include all labeled and unlabeled usage. An object containing a single `"key": value` pair. Example: `{ "name": "wrench" }`. _Currently, multiple entries or multiple values per entry are not allowed._
         "a_key": [
           "",
         ],
@@ -218,7 +218,7 @@
         "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
       },
     },
-    "labels": { # Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. Currently, multiple entries or multiple values per entry are not allowed. If omitted, the report will include all labeled and unlabeled usage.
+    "labels": { # Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. If omitted, the report will include all labeled and unlabeled usage. An object containing a single `"key": value` pair. Example: `{ "name": "wrench" }`. _Currently, multiple entries or multiple values per entry are not allowed._
       "a_key": [
         "",
       ],
@@ -313,7 +313,7 @@
         "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
       },
     },
-    "labels": { # Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. Currently, multiple entries or multiple values per entry are not allowed. If omitted, the report will include all labeled and unlabeled usage.
+    "labels": { # Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. If omitted, the report will include all labeled and unlabeled usage. An object containing a single `"key": value` pair. Example: `{ "name": "wrench" }`. _Currently, multiple entries or multiple values per entry are not allowed._
       "a_key": [
         "",
       ],
@@ -394,7 +394,7 @@
             "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
           },
         },
-        "labels": { # Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. Currently, multiple entries or multiple values per entry are not allowed. If omitted, the report will include all labeled and unlabeled usage.
+        "labels": { # Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. If omitted, the report will include all labeled and unlabeled usage. An object containing a single `"key": value` pair. Example: `{ "name": "wrench" }`. _Currently, multiple entries or multiple values per entry are not allowed._
           "a_key": [
             "",
           ],
@@ -484,7 +484,7 @@
           "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
         },
       },
-      "labels": { # Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. Currently, multiple entries or multiple values per entry are not allowed. If omitted, the report will include all labeled and unlabeled usage.
+      "labels": { # Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. If omitted, the report will include all labeled and unlabeled usage. An object containing a single `"key": value` pair. Example: `{ "name": "wrench" }`. _Currently, multiple entries or multiple values per entry are not allowed._
         "a_key": [
           "",
         ],
@@ -556,7 +556,7 @@
         "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
       },
     },
-    "labels": { # Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. Currently, multiple entries or multiple values per entry are not allowed. If omitted, the report will include all labeled and unlabeled usage.
+    "labels": { # Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. If omitted, the report will include all labeled and unlabeled usage. An object containing a single `"key": value` pair. Example: `{ "name": "wrench" }`. _Currently, multiple entries or multiple values per entry are not allowed._
       "a_key": [
         "",
       ],

docs/dyn/binaryauthorization_v1.projects.attestors.html

diff --git a/docs/dyn/binaryauthorization_v1.projects.attestors.html b/docs/dyn/binaryauthorization_v1.projects.attestors.html
index 4bd9c46..169b49c 100644
--- a/docs/dyn/binaryauthorization_v1.projects.attestors.html
+++ b/docs/dyn/binaryauthorization_v1.projects.attestors.html
@@ -243,7 +243,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -330,7 +330,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
         "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -358,7 +358,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/binaryauthorization_v1.projects.policy.html

diff --git a/docs/dyn/binaryauthorization_v1.projects.policy.html b/docs/dyn/binaryauthorization_v1.projects.policy.html
index a8e90e9..b93c9cc 100644
--- a/docs/dyn/binaryauthorization_v1.projects.policy.html
+++ b/docs/dyn/binaryauthorization_v1.projects.policy.html
@@ -107,7 +107,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -137,7 +137,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
         "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -165,7 +165,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/binaryauthorization_v1beta1.projects.attestors.html

diff --git a/docs/dyn/binaryauthorization_v1beta1.projects.attestors.html b/docs/dyn/binaryauthorization_v1beta1.projects.attestors.html
index 467f92c..c9f1da5 100644
--- a/docs/dyn/binaryauthorization_v1beta1.projects.attestors.html
+++ b/docs/dyn/binaryauthorization_v1beta1.projects.attestors.html
@@ -243,7 +243,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -330,7 +330,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
         "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -358,7 +358,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/binaryauthorization_v1beta1.projects.policy.html

diff --git a/docs/dyn/binaryauthorization_v1beta1.projects.policy.html b/docs/dyn/binaryauthorization_v1beta1.projects.policy.html
index 2e181fa..0ecbb74 100644
--- a/docs/dyn/binaryauthorization_v1beta1.projects.policy.html
+++ b/docs/dyn/binaryauthorization_v1beta1.projects.policy.html
@@ -107,7 +107,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -137,7 +137,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
         "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -165,7 +165,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/chat_v1.dms.conversations.html

diff --git a/docs/dyn/chat_v1.dms.conversations.html b/docs/dyn/chat_v1.dms.conversations.html
index 632da2d..5101a9b 100644
--- a/docs/dyn/chat_v1.dms.conversations.html
+++ b/docs/dyn/chat_v1.dms.conversations.html
@@ -860,7 +860,7 @@
   },
 }
 
-  threadKey: string, Opaque thread identifier string that can be specified to group messages into a single thread. If this is the first message with a given thread identifier, a new thread is created. Subsequent messages with the same thread identifier will be posted into the same thread. This relieves bots and webhooks from having to store the Hangouts Chat thread ID of a thread (created earlier by them) to post further updates to it. Has no effect if thread field, corresponding to an existing thread, is set in message.
+  threadKey: string, Optional. Opaque thread identifier string that can be specified to group messages into a single thread. If this is the first message with a given thread identifier, a new thread is created. Subsequent messages with the same thread identifier will be posted into the same thread. This relieves bots and webhooks from having to store the Hangouts Chat thread ID of a thread (created earlier by them) to post further updates to it. Has no effect if thread field, corresponding to an existing thread, is set in message.
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format

docs/dyn/chat_v1.dms.html

diff --git a/docs/dyn/chat_v1.dms.html b/docs/dyn/chat_v1.dms.html
index 9117d85..d5ed2a4 100644
--- a/docs/dyn/chat_v1.dms.html
+++ b/docs/dyn/chat_v1.dms.html
@@ -868,7 +868,7 @@
   },
 }
 
-  threadKey: string, Opaque thread identifier string that can be specified to group messages into a single thread. If this is the first message with a given thread identifier, a new thread is created. Subsequent messages with the same thread identifier will be posted into the same thread. This relieves bots and webhooks from having to store the Hangouts Chat thread ID of a thread (created earlier by them) to post further updates to it. Has no effect if thread field, corresponding to an existing thread, is set in message.
+  threadKey: string, Optional. Opaque thread identifier string that can be specified to group messages into a single thread. If this is the first message with a given thread identifier, a new thread is created. Subsequent messages with the same thread identifier will be posted into the same thread. This relieves bots and webhooks from having to store the Hangouts Chat thread ID of a thread (created earlier by them) to post further updates to it. Has no effect if thread field, corresponding to an existing thread, is set in message.
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
@@ -2417,7 +2417,7 @@
   },
 }
 
-  threadKey: string, Opaque thread identifier string that can be specified to group messages into a single thread. If this is the first message with a given thread identifier, a new thread is created. Subsequent messages with the same thread identifier will be posted into the same thread. This relieves bots and webhooks from having to store the Hangouts Chat thread ID of a thread (created earlier by them) to post further updates to it. Has no effect if thread field, corresponding to an existing thread, is set in message.
+  threadKey: string, Optional. Opaque thread identifier string that can be specified to group messages into a single thread. If this is the first message with a given thread identifier, a new thread is created. Subsequent messages with the same thread identifier will be posted into the same thread. This relieves bots and webhooks from having to store the Hangouts Chat thread ID of a thread (created earlier by them) to post further updates to it. Has no effect if thread field, corresponding to an existing thread, is set in message.
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format

docs/dyn/chat_v1.rooms.conversations.html

diff --git a/docs/dyn/chat_v1.rooms.conversations.html b/docs/dyn/chat_v1.rooms.conversations.html
index 26e5fd1..04a3436 100644
--- a/docs/dyn/chat_v1.rooms.conversations.html
+++ b/docs/dyn/chat_v1.rooms.conversations.html
@@ -860,7 +860,7 @@
   },
 }
 
-  threadKey: string, Opaque thread identifier string that can be specified to group messages into a single thread. If this is the first message with a given thread identifier, a new thread is created. Subsequent messages with the same thread identifier will be posted into the same thread. This relieves bots and webhooks from having to store the Hangouts Chat thread ID of a thread (created earlier by them) to post further updates to it. Has no effect if thread field, corresponding to an existing thread, is set in message.
+  threadKey: string, Optional. Opaque thread identifier string that can be specified to group messages into a single thread. If this is the first message with a given thread identifier, a new thread is created. Subsequent messages with the same thread identifier will be posted into the same thread. This relieves bots and webhooks from having to store the Hangouts Chat thread ID of a thread (created earlier by them) to post further updates to it. Has no effect if thread field, corresponding to an existing thread, is set in message.
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format

docs/dyn/chat_v1.rooms.html

diff --git a/docs/dyn/chat_v1.rooms.html b/docs/dyn/chat_v1.rooms.html
index 382d7a4..e62d121 100644
--- a/docs/dyn/chat_v1.rooms.html
+++ b/docs/dyn/chat_v1.rooms.html
@@ -868,7 +868,7 @@
   },
 }
 
-  threadKey: string, Opaque thread identifier string that can be specified to group messages into a single thread. If this is the first message with a given thread identifier, a new thread is created. Subsequent messages with the same thread identifier will be posted into the same thread. This relieves bots and webhooks from having to store the Hangouts Chat thread ID of a thread (created earlier by them) to post further updates to it. Has no effect if thread field, corresponding to an existing thread, is set in message.
+  threadKey: string, Optional. Opaque thread identifier string that can be specified to group messages into a single thread. If this is the first message with a given thread identifier, a new thread is created. Subsequent messages with the same thread identifier will be posted into the same thread. This relieves bots and webhooks from having to store the Hangouts Chat thread ID of a thread (created earlier by them) to post further updates to it. Has no effect if thread field, corresponding to an existing thread, is set in message.
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
@@ -2417,7 +2417,7 @@
   },
 }
 
-  threadKey: string, Opaque thread identifier string that can be specified to group messages into a single thread. If this is the first message with a given thread identifier, a new thread is created. Subsequent messages with the same thread identifier will be posted into the same thread. This relieves bots and webhooks from having to store the Hangouts Chat thread ID of a thread (created earlier by them) to post further updates to it. Has no effect if thread field, corresponding to an existing thread, is set in message.
+  threadKey: string, Optional. Opaque thread identifier string that can be specified to group messages into a single thread. If this is the first message with a given thread identifier, a new thread is created. Subsequent messages with the same thread identifier will be posted into the same thread. This relieves bots and webhooks from having to store the Hangouts Chat thread ID of a thread (created earlier by them) to post further updates to it. Has no effect if thread field, corresponding to an existing thread, is set in message.
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format

docs/dyn/chat_v1.spaces.html

diff --git a/docs/dyn/chat_v1.spaces.html b/docs/dyn/chat_v1.spaces.html
index d2f718a..cd9fed4 100644
--- a/docs/dyn/chat_v1.spaces.html
+++ b/docs/dyn/chat_v1.spaces.html
@@ -945,7 +945,7 @@
   },
 }
 
-  threadKey: string, Opaque thread identifier string that can be specified to group messages into a single thread. If this is the first message with a given thread identifier, a new thread is created. Subsequent messages with the same thread identifier will be posted into the same thread. This relieves bots and webhooks from having to store the Hangouts Chat thread ID of a thread (created earlier by them) to post further updates to it. Has no effect if thread field, corresponding to an existing thread, is set in message.
+  threadKey: string, Optional. Opaque thread identifier string that can be specified to group messages into a single thread. If this is the first message with a given thread identifier, a new thread is created. Subsequent messages with the same thread identifier will be posted into the same thread. This relieves bots and webhooks from having to store the Hangouts Chat thread ID of a thread (created earlier by them) to post further updates to it. Has no effect if thread field, corresponding to an existing thread, is set in message.
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format

docs/dyn/chat_v1.spaces.messages.html

diff --git a/docs/dyn/chat_v1.spaces.messages.html b/docs/dyn/chat_v1.spaces.messages.html
index 8612be1..84273d9 100644
--- a/docs/dyn/chat_v1.spaces.messages.html
+++ b/docs/dyn/chat_v1.spaces.messages.html
@@ -874,7 +874,7 @@
   },
 }
 
-  threadKey: string, Opaque thread identifier string that can be specified to group messages into a single thread. If this is the first message with a given thread identifier, a new thread is created. Subsequent messages with the same thread identifier will be posted into the same thread. This relieves bots and webhooks from having to store the Hangouts Chat thread ID of a thread (created earlier by them) to post further updates to it. Has no effect if thread field, corresponding to an existing thread, is set in message.
+  threadKey: string, Optional. Opaque thread identifier string that can be specified to group messages into a single thread. If this is the first message with a given thread identifier, a new thread is created. Subsequent messages with the same thread identifier will be posted into the same thread. This relieves bots and webhooks from having to store the Hangouts Chat thread ID of a thread (created earlier by them) to post further updates to it. Has no effect if thread field, corresponding to an existing thread, is set in message.
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format

docs/dyn/cloudasset_v1.assets.html

diff --git a/docs/dyn/cloudasset_v1.assets.html b/docs/dyn/cloudasset_v1.assets.html
index 784049d..cf0477c 100644
--- a/docs/dyn/cloudasset_v1.assets.html
+++ b/docs/dyn/cloudasset_v1.assets.html
@@ -181,7 +181,7 @@
         "A String",
       ],
       "assetType": "A String", # The type of the asset. Example: `compute.googleapis.com/Disk` See [Supported asset types](https://cloud.google.com/asset-inventory/docs/supported-asset-types) for more information.
-      "iamPolicy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # A representation of the Cloud IAM policy set on a Google Cloud resource. There can be a maximum of one Cloud IAM policy set on any given resource. In addition, Cloud IAM policies inherit their granted access scope from any policies set on parent resources in the resource hierarchy. Therefore, the effectively policy is the union of both the policy set on this resource and each policy set on all of the resource's ancestry resource levels in the hierarchy. See [this topic](https://cloud.google.com/iam/docs/policies#inheritance) for more information.
+      "iamPolicy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # A representation of the Cloud IAM policy set on a Google Cloud resource. There can be a maximum of one Cloud IAM policy set on any given resource. In addition, Cloud IAM policies inherit their granted access scope from any policies set on parent resources in the resource hierarchy. Therefore, the effectively policy is the union of both the policy set on this resource and each policy set on all of the resource's ancestry resource levels in the hierarchy. See [this topic](https://cloud.google.com/iam/docs/policies#inheritance) for more information.
         "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
           { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
             "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/cloudasset_v1.v1.html

diff --git a/docs/dyn/cloudasset_v1.v1.html b/docs/dyn/cloudasset_v1.v1.html
index 5f21c7f..afe541d 100644
--- a/docs/dyn/cloudasset_v1.v1.html
+++ b/docs/dyn/cloudasset_v1.v1.html
@@ -568,7 +568,7 @@
           "A String",
         ],
         "assetType": "A String", # The type of the asset. Example: `compute.googleapis.com/Disk` See [Supported asset types](https://cloud.google.com/asset-inventory/docs/supported-asset-types) for more information.
-        "iamPolicy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # A representation of the Cloud IAM policy set on a Google Cloud resource. There can be a maximum of one Cloud IAM policy set on any given resource. In addition, Cloud IAM policies inherit their granted access scope from any policies set on parent resources in the resource hierarchy. Therefore, the effectively policy is the union of both the policy set on this resource and each policy set on all of the resource's ancestry resource levels in the hierarchy. See [this topic](https://cloud.google.com/iam/docs/policies#inheritance) for more information.
+        "iamPolicy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # A representation of the Cloud IAM policy set on a Google Cloud resource. There can be a maximum of one Cloud IAM policy set on any given resource. In addition, Cloud IAM policies inherit their granted access scope from any policies set on parent resources in the resource hierarchy. Therefore, the effectively policy is the union of both the policy set on this resource and each policy set on all of the resource's ancestry resource levels in the hierarchy. See [this topic](https://cloud.google.com/iam/docs/policies#inheritance) for more information.
           "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
             { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
               "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -1015,7 +1015,7 @@
           "A String",
         ],
         "assetType": "A String", # The type of the asset. Example: `compute.googleapis.com/Disk` See [Supported asset types](https://cloud.google.com/asset-inventory/docs/supported-asset-types) for more information.
-        "iamPolicy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # A representation of the Cloud IAM policy set on a Google Cloud resource. There can be a maximum of one Cloud IAM policy set on any given resource. In addition, Cloud IAM policies inherit their granted access scope from any policies set on parent resources in the resource hierarchy. Therefore, the effectively policy is the union of both the policy set on this resource and each policy set on all of the resource's ancestry resource levels in the hierarchy. See [this topic](https://cloud.google.com/iam/docs/policies#inheritance) for more information.
+        "iamPolicy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # A representation of the Cloud IAM policy set on a Google Cloud resource. There can be a maximum of one Cloud IAM policy set on any given resource. In addition, Cloud IAM policies inherit their granted access scope from any policies set on parent resources in the resource hierarchy. Therefore, the effectively policy is the union of both the policy set on this resource and each policy set on all of the resource's ancestry resource levels in the hierarchy. See [this topic](https://cloud.google.com/iam/docs/policies#inheritance) for more information.
           "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
             { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
               "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -1515,7 +1515,7 @@
         "A String",
       ],
       "organization": "A String", # The organization that the IAM policy belongs to, in the form of organizations/{ORGANIZATION_NUMBER}. This field is available when the IAM policy belongs to an organization. To search against `organization`: * use a field query. Example: `organization:123` * use a free text query. Example: `123` * specify the `scope` field as this organization in your search request.
-      "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy directly set on the given resource. Note that the original IAM policy can contain multiple bindings. This only contains the bindings that match the given query. For queries that don't contain a constrain on policies (e.g., an empty query), this contains all the bindings. To search against the `policy` bindings: * use a field query: - query by the policy contained members. Example: `policy:amy@gmail.com` - query by the policy contained roles. Example: `policy:roles/compute.admin` - query by the policy contained roles' included permissions. Example: `policy.role.permissions:compute.instances.create`
+      "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy directly set on the given resource. Note that the original IAM policy can contain multiple bindings. This only contains the bindings that match the given query. For queries that don't contain a constrain on policies (e.g., an empty query), this contains all the bindings. To search against the `policy` bindings: * use a field query: - query by the policy contained members. Example: `policy:amy@gmail.com` - query by the policy contained roles. Example: `policy:roles/compute.admin` - query by the policy contained roles' included permissions. Example: `policy.role.permissions:compute.instances.create`
         "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
           { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
             "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/cloudasset_v1beta1.organizations.html

diff --git a/docs/dyn/cloudasset_v1beta1.organizations.html b/docs/dyn/cloudasset_v1beta1.organizations.html
index bd02138..867b001 100644
--- a/docs/dyn/cloudasset_v1beta1.organizations.html
+++ b/docs/dyn/cloudasset_v1beta1.organizations.html
@@ -173,7 +173,7 @@
           "title": "A String", # Required. Human readable title. Does not affect behavior.
         },
         "assetType": "A String", # The type of the asset. Example: `compute.googleapis.com/Disk` See [Supported asset types](https://cloud.google.com/asset-inventory/docs/supported-asset-types) for more information.
-        "iamPolicy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # A representation of the Cloud IAM policy set on a Google Cloud resource. There can be a maximum of one Cloud IAM policy set on any given resource. In addition, Cloud IAM policies inherit their granted access scope from any policies set on parent resources in the resource hierarchy. Therefore, the effectively policy is the union of both the policy set on this resource and each policy set on all of the resource's ancestry resource levels in the hierarchy. See [this topic](https://cloud.google.com/iam/docs/policies#inheritance) for more information.
+        "iamPolicy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # A representation of the Cloud IAM policy set on a Google Cloud resource. There can be a maximum of one Cloud IAM policy set on any given resource. In addition, Cloud IAM policies inherit their granted access scope from any policies set on parent resources in the resource hierarchy. Therefore, the effectively policy is the union of both the policy set on this resource and each policy set on all of the resource's ancestry resource levels in the hierarchy. See [this topic](https://cloud.google.com/iam/docs/policies#inheritance) for more information.
           "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
             { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
               "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/cloudasset_v1beta1.projects.html

diff --git a/docs/dyn/cloudasset_v1beta1.projects.html b/docs/dyn/cloudasset_v1beta1.projects.html
index a3c72db..e9b8a6f 100644
--- a/docs/dyn/cloudasset_v1beta1.projects.html
+++ b/docs/dyn/cloudasset_v1beta1.projects.html
@@ -173,7 +173,7 @@
           "title": "A String", # Required. Human readable title. Does not affect behavior.
         },
         "assetType": "A String", # The type of the asset. Example: `compute.googleapis.com/Disk` See [Supported asset types](https://cloud.google.com/asset-inventory/docs/supported-asset-types) for more information.
-        "iamPolicy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # A representation of the Cloud IAM policy set on a Google Cloud resource. There can be a maximum of one Cloud IAM policy set on any given resource. In addition, Cloud IAM policies inherit their granted access scope from any policies set on parent resources in the resource hierarchy. Therefore, the effectively policy is the union of both the policy set on this resource and each policy set on all of the resource's ancestry resource levels in the hierarchy. See [this topic](https://cloud.google.com/iam/docs/policies#inheritance) for more information.
+        "iamPolicy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # A representation of the Cloud IAM policy set on a Google Cloud resource. There can be a maximum of one Cloud IAM policy set on any given resource. In addition, Cloud IAM policies inherit their granted access scope from any policies set on parent resources in the resource hierarchy. Therefore, the effectively policy is the union of both the policy set on this resource and each policy set on all of the resource's ancestry resource levels in the hierarchy. See [this topic](https://cloud.google.com/iam/docs/policies#inheritance) for more information.
           "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
             { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
               "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/cloudasset_v1p1beta1.iamPolicies.html

diff --git a/docs/dyn/cloudasset_v1p1beta1.iamPolicies.html b/docs/dyn/cloudasset_v1p1beta1.iamPolicies.html
index 9235145..ae45405 100644
--- a/docs/dyn/cloudasset_v1p1beta1.iamPolicies.html
+++ b/docs/dyn/cloudasset_v1p1beta1.iamPolicies.html
@@ -119,7 +119,7 @@
           },
         },
       },
-      "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the specified resource. Note that the original IAM policy can contain multiple bindings. This only contains the bindings that match the given query. For queries that don't contain a constraint on policies (e.g. an empty query), this contains all the bindings.
+      "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the specified resource. Note that the original IAM policy can contain multiple bindings. This only contains the bindings that match the given query. For queries that don't contain a constraint on policies (e.g. an empty query), this contains all the bindings.
         "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
           { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
             "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/cloudasset_v1p5beta1.assets.html

diff --git a/docs/dyn/cloudasset_v1p5beta1.assets.html b/docs/dyn/cloudasset_v1p5beta1.assets.html
index b3a65e6..92eafb0 100644
--- a/docs/dyn/cloudasset_v1p5beta1.assets.html
+++ b/docs/dyn/cloudasset_v1p5beta1.assets.html
@@ -178,7 +178,7 @@
         "A String",
       ],
       "assetType": "A String", # The type of the asset. Example: `compute.googleapis.com/Disk` See [Supported asset types](https://cloud.google.com/asset-inventory/docs/supported-asset-types) for more information.
-      "iamPolicy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # A representation of the Cloud IAM policy set on a Google Cloud resource. There can be a maximum of one Cloud IAM policy set on any given resource. In addition, Cloud IAM policies inherit their granted access scope from any policies set on parent resources in the resource hierarchy. Therefore, the effectively policy is the union of both the policy set on this resource and each policy set on all of the resource's ancestry resource levels in the hierarchy. See [this topic](https://cloud.google.com/iam/docs/policies#inheritance) for more information.
+      "iamPolicy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # A representation of the Cloud IAM policy set on a Google Cloud resource. There can be a maximum of one Cloud IAM policy set on any given resource. In addition, Cloud IAM policies inherit their granted access scope from any policies set on parent resources in the resource hierarchy. Therefore, the effectively policy is the union of both the policy set on this resource and each policy set on all of the resource's ancestry resource levels in the hierarchy. See [this topic](https://cloud.google.com/iam/docs/policies#inheritance) for more information.
         "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
           { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
             "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/cloudbuild_v1.projects.builds.html

diff --git a/docs/dyn/cloudbuild_v1.projects.builds.html b/docs/dyn/cloudbuild_v1.projects.builds.html
index cc107d9..c02ec89 100644
--- a/docs/dyn/cloudbuild_v1.projects.builds.html
+++ b/docs/dyn/cloudbuild_v1.projects.builds.html
@@ -111,7 +111,7 @@
 { # Request to approve or reject a pending build.
   "approvalResult": { # ApprovalResult describes the decision and associated metadata of a manual approval of a build. # Approval decision and metadata.
     "approvalTime": "A String", # Output only. The time when the approval decision was made.
-    "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called (the user's actual email that is tied to their GAIA ID may have changed). This field is not stored, rather, it is calculated on the fly using approver_id.
+    "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called.
     "comment": "A String", # Optional. An optional comment for this manual approval result.
     "decision": "A String", # Required. The decision of this manual approval.
     "url": "A String", # Optional. An optional URL tied to this manual approval result. This field is essentially the same as comment, except that it will be rendered by the UI differently. An example use case is a link to an external job that approved this Build.
@@ -171,14 +171,14 @@
 Returns:
   An object of the form:
 
-    { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA.
+    { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $LOCATION: the location/region of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA.
   "approval": { # BuildApproval describes a build's approval configuration, state, and result. # Output only. Describes this build's approval configuration, status, and result.
     "config": { # ApprovalConfig describes configuration for manual approval of a build. # Output only. Configuration for manual approval of this build.
       "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
     },
     "result": { # ApprovalResult describes the decision and associated metadata of a manual approval of a build. # Output only. Result of manual approval for this Build.
       "approvalTime": "A String", # Output only. The time when the approval decision was made.
-      "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called (the user's actual email that is tied to their GAIA ID may have changed). This field is not stored, rather, it is calculated on the fly using approver_id.
+      "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called.
       "comment": "A String", # Optional. An optional comment for this manual approval result.
       "decision": "A String", # Required. The decision of this manual approval.
       "url": "A String", # Optional. An optional URL tied to this manual approval result. This field is essentially the same as comment, except that it will be rendered by the UI differently. An example use case is a link to an external job that approved this Build.
@@ -427,14 +427,14 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA.
+{ # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $LOCATION: the location/region of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA.
   "approval": { # BuildApproval describes a build's approval configuration, state, and result. # Output only. Describes this build's approval configuration, status, and result.
     "config": { # ApprovalConfig describes configuration for manual approval of a build. # Output only. Configuration for manual approval of this build.
       "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
     },
     "result": { # ApprovalResult describes the decision and associated metadata of a manual approval of a build. # Output only. Result of manual approval for this Build.
       "approvalTime": "A String", # Output only. The time when the approval decision was made.
-      "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called (the user's actual email that is tied to their GAIA ID may have changed). This field is not stored, rather, it is calculated on the fly using approver_id.
+      "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called.
       "comment": "A String", # Optional. An optional comment for this manual approval result.
       "decision": "A String", # Required. The decision of this manual approval.
       "url": "A String", # Optional. An optional URL tied to this manual approval result. This field is essentially the same as comment, except that it will be rendered by the UI differently. An example use case is a link to an external job that approved this Build.
@@ -714,14 +714,14 @@
 Returns:
   An object of the form:
 
-    { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA.
+    { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $LOCATION: the location/region of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA.
   "approval": { # BuildApproval describes a build's approval configuration, state, and result. # Output only. Describes this build's approval configuration, status, and result.
     "config": { # ApprovalConfig describes configuration for manual approval of a build. # Output only. Configuration for manual approval of this build.
       "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
     },
     "result": { # ApprovalResult describes the decision and associated metadata of a manual approval of a build. # Output only. Result of manual approval for this Build.
       "approvalTime": "A String", # Output only. The time when the approval decision was made.
-      "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called (the user's actual email that is tied to their GAIA ID may have changed). This field is not stored, rather, it is calculated on the fly using approver_id.
+      "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called.
       "comment": "A String", # Optional. An optional comment for this manual approval result.
       "decision": "A String", # Required. The decision of this manual approval.
       "url": "A String", # Optional. An optional URL tied to this manual approval result. This field is essentially the same as comment, except that it will be rendered by the UI differently. An example use case is a link to an external job that approved this Build.
@@ -976,14 +976,14 @@
 
     { # Response including listed builds.
   "builds": [ # Builds will be sorted by `create_time`, descending.
-    { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA.
+    { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $LOCATION: the location/region of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA.
       "approval": { # BuildApproval describes a build's approval configuration, state, and result. # Output only. Describes this build's approval configuration, status, and result.
         "config": { # ApprovalConfig describes configuration for manual approval of a build. # Output only. Configuration for manual approval of this build.
           "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
         },
         "result": { # ApprovalResult describes the decision and associated metadata of a manual approval of a build. # Output only. Result of manual approval for this Build.
           "approvalTime": "A String", # Output only. The time when the approval decision was made.
-          "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called (the user's actual email that is tied to their GAIA ID may have changed). This field is not stored, rather, it is calculated on the fly using approver_id.
+          "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called.
           "comment": "A String", # Optional. An optional comment for this manual approval result.
           "decision": "A String", # Required. The decision of this manual approval.
           "url": "A String", # Optional. An optional URL tied to this manual approval result. This field is essentially the same as comment, except that it will be rendered by the UI differently. An example use case is a link to an external job that approved this Build.

docs/dyn/cloudbuild_v1.projects.githubEnterpriseConfigs.html

diff --git a/docs/dyn/cloudbuild_v1.projects.githubEnterpriseConfigs.html b/docs/dyn/cloudbuild_v1.projects.githubEnterpriseConfigs.html
index 944b2b4..f4742c0 100644
--- a/docs/dyn/cloudbuild_v1.projects.githubEnterpriseConfigs.html
+++ b/docs/dyn/cloudbuild_v1.projects.githubEnterpriseConfigs.html
@@ -112,7 +112,7 @@
   "createTime": "A String", # Output only. Time when the installation was associated with the project.
   "displayName": "A String", # Name to display for this config.
   "hostUrl": "A String", # The URL of the github enterprise host the configuration is for.
-  "name": "A String", # Optional. The full resource name for the GitHubEnterpriseConfig For example: "projects/{$project_id}/githubEnterpriseConfig/{$config_id}"
+  "name": "A String", # Optional. The full resource name for the GitHubEnterpriseConfig For example: "projects/{$project_id}/githubEnterpriseConfigs/{$config_id}"
   "peeredNetwork": "A String", # Optional. The network to be used when reaching out to the GitHub Enterprise server. The VPC network must be enabled for private service connection. This should be set if the GitHub Enterprise server is hosted on-premises and not reachable by public internet. If this field is left empty, no network peering will occur and calls to the GitHub Enterprise server will be made over the public internet. Must be in the format `projects/{project}/global/networks/{network}`, where {project} is a project number or id and {network} is the name of a VPC network in the project.
   "secrets": { # GitHubEnterpriseSecrets represents the names of all necessary secrets in Secret Manager for a GitHub Enterprise server. Format is: projects//secrets/. # Names of secrets in Secret Manager.
     "oauthClientIdName": "A String", # The resource name for the OAuth client ID secret in Secret Manager.
@@ -163,7 +163,7 @@
   <pre>Delete an association between a GCP project and a GitHub Enterprise server. This API is experimental.
 
 Args:
-  name: string, This field should contain the name of the enterprise config resource. For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot; (required)
+  name: string, This field should contain the name of the enterprise config resource. For example: &quot;projects/{$project_id}/githubEnterpriseConfigs/{$config_id}&quot; (required)
   configId: string, Unique identifier of the `GitHubEnterpriseConfig`
   projectId: string, ID of the project
   x__xgafv: string, V1 error format.
@@ -200,7 +200,7 @@
   <pre>Retrieve a GitHubEnterpriseConfig. This API is experimental.
 
 Args:
-  name: string, This field should contain the name of the enterprise config resource. For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot; (required)
+  name: string, This field should contain the name of the enterprise config resource. For example: &quot;projects/{$project_id}/githubEnterpriseConfigs/{$config_id}&quot; (required)
   configId: string, Unique identifier of the `GitHubEnterpriseConfig`
   projectId: string, ID of the project
   x__xgafv: string, V1 error format.
@@ -216,7 +216,7 @@
   &quot;createTime&quot;: &quot;A String&quot;, # Output only. Time when the installation was associated with the project.
   &quot;displayName&quot;: &quot;A String&quot;, # Name to display for this config.
   &quot;hostUrl&quot;: &quot;A String&quot;, # The URL of the github enterprise host the configuration is for.
-  &quot;name&quot;: &quot;A String&quot;, # Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
+  &quot;name&quot;: &quot;A String&quot;, # Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfigs/{$config_id}&quot;
   &quot;peeredNetwork&quot;: &quot;A String&quot;, # Optional. The network to be used when reaching out to the GitHub Enterprise server. The VPC network must be enabled for private service connection. This should be set if the GitHub Enterprise server is hosted on-premises and not reachable by public internet. If this field is left empty, no network peering will occur and calls to the GitHub Enterprise server will be made over the public internet. Must be in the format `projects/{project}/global/networks/{network}`, where {project} is a project number or id and {network} is the name of a VPC network in the project.
   &quot;secrets&quot;: { # GitHubEnterpriseSecrets represents the names of all necessary secrets in Secret Manager for a GitHub Enterprise server. Format is: projects//secrets/. # Names of secrets in Secret Manager.
     &quot;oauthClientIdName&quot;: &quot;A String&quot;, # The resource name for the OAuth client ID secret in Secret Manager.
@@ -255,7 +255,7 @@
       &quot;createTime&quot;: &quot;A String&quot;, # Output only. Time when the installation was associated with the project.
       &quot;displayName&quot;: &quot;A String&quot;, # Name to display for this config.
       &quot;hostUrl&quot;: &quot;A String&quot;, # The URL of the github enterprise host the configuration is for.
-      &quot;name&quot;: &quot;A String&quot;, # Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
+      &quot;name&quot;: &quot;A String&quot;, # Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfigs/{$config_id}&quot;
       &quot;peeredNetwork&quot;: &quot;A String&quot;, # Optional. The network to be used when reaching out to the GitHub Enterprise server. The VPC network must be enabled for private service connection. This should be set if the GitHub Enterprise server is hosted on-premises and not reachable by public internet. If this field is left empty, no network peering will occur and calls to the GitHub Enterprise server will be made over the public internet. Must be in the format `projects/{project}/global/networks/{network}`, where {project} is a project number or id and {network} is the name of a VPC network in the project.
       &quot;secrets&quot;: { # GitHubEnterpriseSecrets represents the names of all necessary secrets in Secret Manager for a GitHub Enterprise server. Format is: projects//secrets/. # Names of secrets in Secret Manager.
         &quot;oauthClientIdName&quot;: &quot;A String&quot;, # The resource name for the OAuth client ID secret in Secret Manager.
@@ -279,7 +279,7 @@
   <pre>Update an association between a GCP project and a GitHub Enterprise server. This API is experimental.
 
 Args:
-  name: string, Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot; (required)
+  name: string, Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfigs/{$config_id}&quot; (required)
   body: object, The request body.
     The object takes the form of:
 
@@ -288,7 +288,7 @@
   &quot;createTime&quot;: &quot;A String&quot;, # Output only. Time when the installation was associated with the project.
   &quot;displayName&quot;: &quot;A String&quot;, # Name to display for this config.
   &quot;hostUrl&quot;: &quot;A String&quot;, # The URL of the github enterprise host the configuration is for.
-  &quot;name&quot;: &quot;A String&quot;, # Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
+  &quot;name&quot;: &quot;A String&quot;, # Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfigs/{$config_id}&quot;
   &quot;peeredNetwork&quot;: &quot;A String&quot;, # Optional. The network to be used when reaching out to the GitHub Enterprise server. The VPC network must be enabled for private service connection. This should be set if the GitHub Enterprise server is hosted on-premises and not reachable by public internet. If this field is left empty, no network peering will occur and calls to the GitHub Enterprise server will be made over the public internet. Must be in the format `projects/{project}/global/networks/{network}`, where {project} is a project number or id and {network} is the name of a VPC network in the project.
   &quot;secrets&quot;: { # GitHubEnterpriseSecrets represents the names of all necessary secrets in Secret Manager for a GitHub Enterprise server. Format is: projects//secrets/. # Names of secrets in Secret Manager.
     &quot;oauthClientIdName&quot;: &quot;A String&quot;, # The resource name for the OAuth client ID secret in Secret Manager.

docs/dyn/cloudbuild_v1.projects.locations.builds.html

diff --git a/docs/dyn/cloudbuild_v1.projects.locations.builds.html b/docs/dyn/cloudbuild_v1.projects.locations.builds.html
index b358d26..47f41ee 100644
--- a/docs/dyn/cloudbuild_v1.projects.locations.builds.html
+++ b/docs/dyn/cloudbuild_v1.projects.locations.builds.html
@@ -111,7 +111,7 @@
 { # Request to approve or reject a pending build.
   "approvalResult": { # ApprovalResult describes the decision and associated metadata of a manual approval of a build. # Approval decision and metadata.
     "approvalTime": "A String", # Output only. The time when the approval decision was made.
-    "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called (the user's actual email that is tied to their GAIA ID may have changed). This field is not stored, rather, it is calculated on the fly using approver_id.
+    "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called.
     "comment": "A String", # Optional. An optional comment for this manual approval result.
     "decision": "A String", # Required. The decision of this manual approval.
     "url": "A String", # Optional. An optional URL tied to this manual approval result. This field is essentially the same as comment, except that it will be rendered by the UI differently. An example use case is a link to an external job that approved this Build.
@@ -170,14 +170,14 @@
 Returns:
   An object of the form:
 
-    { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA.
+    { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $LOCATION: the location/region of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA.
   "approval": { # BuildApproval describes a build's approval configuration, state, and result. # Output only. Describes this build's approval configuration, status, and result.
     "config": { # ApprovalConfig describes configuration for manual approval of a build. # Output only. Configuration for manual approval of this build.
       "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
     },
     "result": { # ApprovalResult describes the decision and associated metadata of a manual approval of a build. # Output only. Result of manual approval for this Build.
       "approvalTime": "A String", # Output only. The time when the approval decision was made.
-      "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called (the user's actual email that is tied to their GAIA ID may have changed). This field is not stored, rather, it is calculated on the fly using approver_id.
+      "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called.
       "comment": "A String", # Optional. An optional comment for this manual approval result.
       "decision": "A String", # Required. The decision of this manual approval.
       "url": "A String", # Optional. An optional URL tied to this manual approval result. This field is essentially the same as comment, except that it will be rendered by the UI differently. An example use case is a link to an external job that approved this Build.
@@ -426,14 +426,14 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA.
+{ # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $LOCATION: the location/region of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA.
   "approval": { # BuildApproval describes a build's approval configuration, state, and result. # Output only. Describes this build's approval configuration, status, and result.
     "config": { # ApprovalConfig describes configuration for manual approval of a build. # Output only. Configuration for manual approval of this build.
       "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
     },
     "result": { # ApprovalResult describes the decision and associated metadata of a manual approval of a build. # Output only. Result of manual approval for this Build.
       "approvalTime": "A String", # Output only. The time when the approval decision was made.
-      "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called (the user's actual email that is tied to their GAIA ID may have changed). This field is not stored, rather, it is calculated on the fly using approver_id.
+      "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called.
       "comment": "A String", # Optional. An optional comment for this manual approval result.
       "decision": "A String", # Required. The decision of this manual approval.
       "url": "A String", # Optional. An optional URL tied to this manual approval result. This field is essentially the same as comment, except that it will be rendered by the UI differently. An example use case is a link to an external job that approved this Build.
@@ -713,14 +713,14 @@
 Returns:
   An object of the form:
 
-    { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA.
+    { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $LOCATION: the location/region of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA.
   "approval": { # BuildApproval describes a build's approval configuration, state, and result. # Output only. Describes this build's approval configuration, status, and result.
     "config": { # ApprovalConfig describes configuration for manual approval of a build. # Output only. Configuration for manual approval of this build.
       "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
     },
     "result": { # ApprovalResult describes the decision and associated metadata of a manual approval of a build. # Output only. Result of manual approval for this Build.
       "approvalTime": "A String", # Output only. The time when the approval decision was made.
-      "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called (the user's actual email that is tied to their GAIA ID may have changed). This field is not stored, rather, it is calculated on the fly using approver_id.
+      "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called.
       "comment": "A String", # Optional. An optional comment for this manual approval result.
       "decision": "A String", # Required. The decision of this manual approval.
       "url": "A String", # Optional. An optional URL tied to this manual approval result. This field is essentially the same as comment, except that it will be rendered by the UI differently. An example use case is a link to an external job that approved this Build.
@@ -975,14 +975,14 @@
 
     { # Response including listed builds.
   "builds": [ # Builds will be sorted by `create_time`, descending.
-    { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA.
+    { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $LOCATION: the location/region of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA.
       "approval": { # BuildApproval describes a build's approval configuration, state, and result. # Output only. Describes this build's approval configuration, status, and result.
         "config": { # ApprovalConfig describes configuration for manual approval of a build. # Output only. Configuration for manual approval of this build.
           "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
         },
         "result": { # ApprovalResult describes the decision and associated metadata of a manual approval of a build. # Output only. Result of manual approval for this Build.
           "approvalTime": "A String", # Output only. The time when the approval decision was made.
-          "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called (the user's actual email that is tied to their GAIA ID may have changed). This field is not stored, rather, it is calculated on the fly using approver_id.
+          "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called.
           "comment": "A String", # Optional. An optional comment for this manual approval result.
           "decision": "A String", # Required. The decision of this manual approval.
           "url": "A String", # Optional. An optional URL tied to this manual approval result. This field is essentially the same as comment, except that it will be rendered by the UI differently. An example use case is a link to an external job that approved this Build.

docs/dyn/cloudbuild_v1.projects.locations.githubEnterpriseConfigs.html

diff --git a/docs/dyn/cloudbuild_v1.projects.locations.githubEnterpriseConfigs.html b/docs/dyn/cloudbuild_v1.projects.locations.githubEnterpriseConfigs.html
index 8a09497..3d893b5 100644
--- a/docs/dyn/cloudbuild_v1.projects.locations.githubEnterpriseConfigs.html
+++ b/docs/dyn/cloudbuild_v1.projects.locations.githubEnterpriseConfigs.html
@@ -112,7 +112,7 @@
   "createTime": "A String", # Output only. Time when the installation was associated with the project.
   "displayName": "A String", # Name to display for this config.
   "hostUrl": "A String", # The URL of the github enterprise host the configuration is for.
-  "name": "A String", # Optional. The full resource name for the GitHubEnterpriseConfig For example: "projects/{$project_id}/githubEnterpriseConfig/{$config_id}"
+  "name": "A String", # Optional. The full resource name for the GitHubEnterpriseConfig For example: "projects/{$project_id}/githubEnterpriseConfigs/{$config_id}"
   "peeredNetwork": "A String", # Optional. The network to be used when reaching out to the GitHub Enterprise server. The VPC network must be enabled for private service connection. This should be set if the GitHub Enterprise server is hosted on-premises and not reachable by public internet. If this field is left empty, no network peering will occur and calls to the GitHub Enterprise server will be made over the public internet. Must be in the format `projects/{project}/global/networks/{network}`, where {project} is a project number or id and {network} is the name of a VPC network in the project.
   "secrets": { # GitHubEnterpriseSecrets represents the names of all necessary secrets in Secret Manager for a GitHub Enterprise server. Format is: projects//secrets/. # Names of secrets in Secret Manager.
     "oauthClientIdName": "A String", # The resource name for the OAuth client ID secret in Secret Manager.
@@ -163,7 +163,7 @@
   <pre>Delete an association between a GCP project and a GitHub Enterprise server. This API is experimental.
 
 Args:
-  name: string, This field should contain the name of the enterprise config resource. For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot; (required)
+  name: string, This field should contain the name of the enterprise config resource. For example: &quot;projects/{$project_id}/githubEnterpriseConfigs/{$config_id}&quot; (required)
   configId: string, Unique identifier of the `GitHubEnterpriseConfig`
   projectId: string, ID of the project
   x__xgafv: string, V1 error format.
@@ -200,7 +200,7 @@
   <pre>Retrieve a GitHubEnterpriseConfig. This API is experimental.
 
 Args:
-  name: string, This field should contain the name of the enterprise config resource. For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot; (required)
+  name: string, This field should contain the name of the enterprise config resource. For example: &quot;projects/{$project_id}/githubEnterpriseConfigs/{$config_id}&quot; (required)
   configId: string, Unique identifier of the `GitHubEnterpriseConfig`
   projectId: string, ID of the project
   x__xgafv: string, V1 error format.
@@ -216,7 +216,7 @@
   &quot;createTime&quot;: &quot;A String&quot;, # Output only. Time when the installation was associated with the project.
   &quot;displayName&quot;: &quot;A String&quot;, # Name to display for this config.
   &quot;hostUrl&quot;: &quot;A String&quot;, # The URL of the github enterprise host the configuration is for.
-  &quot;name&quot;: &quot;A String&quot;, # Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
+  &quot;name&quot;: &quot;A String&quot;, # Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfigs/{$config_id}&quot;
   &quot;peeredNetwork&quot;: &quot;A String&quot;, # Optional. The network to be used when reaching out to the GitHub Enterprise server. The VPC network must be enabled for private service connection. This should be set if the GitHub Enterprise server is hosted on-premises and not reachable by public internet. If this field is left empty, no network peering will occur and calls to the GitHub Enterprise server will be made over the public internet. Must be in the format `projects/{project}/global/networks/{network}`, where {project} is a project number or id and {network} is the name of a VPC network in the project.
   &quot;secrets&quot;: { # GitHubEnterpriseSecrets represents the names of all necessary secrets in Secret Manager for a GitHub Enterprise server. Format is: projects//secrets/. # Names of secrets in Secret Manager.
     &quot;oauthClientIdName&quot;: &quot;A String&quot;, # The resource name for the OAuth client ID secret in Secret Manager.
@@ -255,7 +255,7 @@
       &quot;createTime&quot;: &quot;A String&quot;, # Output only. Time when the installation was associated with the project.
       &quot;displayName&quot;: &quot;A String&quot;, # Name to display for this config.
       &quot;hostUrl&quot;: &quot;A String&quot;, # The URL of the github enterprise host the configuration is for.
-      &quot;name&quot;: &quot;A String&quot;, # Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
+      &quot;name&quot;: &quot;A String&quot;, # Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfigs/{$config_id}&quot;
       &quot;peeredNetwork&quot;: &quot;A String&quot;, # Optional. The network to be used when reaching out to the GitHub Enterprise server. The VPC network must be enabled for private service connection. This should be set if the GitHub Enterprise server is hosted on-premises and not reachable by public internet. If this field is left empty, no network peering will occur and calls to the GitHub Enterprise server will be made over the public internet. Must be in the format `projects/{project}/global/networks/{network}`, where {project} is a project number or id and {network} is the name of a VPC network in the project.
       &quot;secrets&quot;: { # GitHubEnterpriseSecrets represents the names of all necessary secrets in Secret Manager for a GitHub Enterprise server. Format is: projects//secrets/. # Names of secrets in Secret Manager.
         &quot;oauthClientIdName&quot;: &quot;A String&quot;, # The resource name for the OAuth client ID secret in Secret Manager.
@@ -279,7 +279,7 @@
   <pre>Update an association between a GCP project and a GitHub Enterprise server. This API is experimental.
 
 Args:
-  name: string, Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot; (required)
+  name: string, Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfigs/{$config_id}&quot; (required)
   body: object, The request body.
     The object takes the form of:
 
@@ -288,7 +288,7 @@
   &quot;createTime&quot;: &quot;A String&quot;, # Output only. Time when the installation was associated with the project.
   &quot;displayName&quot;: &quot;A String&quot;, # Name to display for this config.
   &quot;hostUrl&quot;: &quot;A String&quot;, # The URL of the github enterprise host the configuration is for.
-  &quot;name&quot;: &quot;A String&quot;, # Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
+  &quot;name&quot;: &quot;A String&quot;, # Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfigs/{$config_id}&quot;
   &quot;peeredNetwork&quot;: &quot;A String&quot;, # Optional. The network to be used when reaching out to the GitHub Enterprise server. The VPC network must be enabled for private service connection. This should be set if the GitHub Enterprise server is hosted on-premises and not reachable by public internet. If this field is left empty, no network peering will occur and calls to the GitHub Enterprise server will be made over the public internet. Must be in the format `projects/{project}/global/networks/{network}`, where {project} is a project number or id and {network} is the name of a VPC network in the project.
   &quot;secrets&quot;: { # GitHubEnterpriseSecrets represents the names of all necessary secrets in Secret Manager for a GitHub Enterprise server. Format is: projects//secrets/. # Names of secrets in Secret Manager.
     &quot;oauthClientIdName&quot;: &quot;A String&quot;, # The resource name for the OAuth client ID secret in Secret Manager.

docs/dyn/cloudbuild_v1.projects.locations.triggers.html

diff --git a/docs/dyn/cloudbuild_v1.projects.locations.triggers.html b/docs/dyn/cloudbuild_v1.projects.locations.triggers.html
index 0a77d3a..7f2b339 100644
--- a/docs/dyn/cloudbuild_v1.projects.locations.triggers.html
+++ b/docs/dyn/cloudbuild_v1.projects.locations.triggers.html
@@ -121,14 +121,14 @@
     "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
   },
   "autodetect": True or False, # Autodetect build configuration. The following precedence is used (case insensitive): 1. cloudbuild.yaml 2. cloudbuild.yml 3. cloudbuild.json 4. Dockerfile Currently only available for GitHub App Triggers.
-  "build": { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA. # Contents of the build template.
+  "build": { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $LOCATION: the location/region of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA. # Contents of the build template.
     "approval": { # BuildApproval describes a build's approval configuration, state, and result. # Output only. Describes this build's approval configuration, status, and result.
       "config": { # ApprovalConfig describes configuration for manual approval of a build. # Output only. Configuration for manual approval of this build.
         "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
       },
       "result": { # ApprovalResult describes the decision and associated metadata of a manual approval of a build. # Output only. Result of manual approval for this Build.
         "approvalTime": "A String", # Output only. The time when the approval decision was made.
-        "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called (the user's actual email that is tied to their GAIA ID may have changed). This field is not stored, rather, it is calculated on the fly using approver_id.
+        "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called.
         "comment": "A String", # Optional. An optional comment for this manual approval result.
         "decision": "A String", # Required. The decision of this manual approval.
         "url": "A String", # Optional. An optional URL tied to this manual approval result. This field is essentially the same as comment, except that it will be rendered by the UI differently. An example use case is a link to an external job that approved this Build.
@@ -373,7 +373,7 @@
     "uri": "A String", # The URI of the repo (optional). If unspecified, the repo from which the trigger invocation originated is assumed to be the repo from which to read the specified path.
   },
   "github": { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
-    "enterpriseConfigResourceName": "A String", # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: "projects/{$project_id}/githubEnterpriseConfig/{$config_id}"
+    "enterpriseConfigResourceName": "A String", # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: "projects/{$project_id}/githubEnterpriseConfigs/{$config_id}"
     "installationId": "A String", # The installationID that emits the GitHub event.
     "name": "A String", # Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is "cloud-builders".
     "owner": "A String", # Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is "googlecloudplatform".
@@ -447,14 +447,14 @@
     "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
   },
   "autodetect": True or False, # Autodetect build configuration. The following precedence is used (case insensitive): 1. cloudbuild.yaml 2. cloudbuild.yml 3. cloudbuild.json 4. Dockerfile Currently only available for GitHub App Triggers.
-  "build": { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA. # Contents of the build template.
+  "build": { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $LOCATION: the location/region of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA. # Contents of the build template.
     "approval": { # BuildApproval describes a build's approval configuration, state, and result. # Output only. Describes this build's approval configuration, status, and result.
       "config": { # ApprovalConfig describes configuration for manual approval of a build. # Output only. Configuration for manual approval of this build.
         "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
       },
       "result": { # ApprovalResult describes the decision and associated metadata of a manual approval of a build. # Output only. Result of manual approval for this Build.
         "approvalTime": "A String", # Output only. The time when the approval decision was made.
-        "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called (the user's actual email that is tied to their GAIA ID may have changed). This field is not stored, rather, it is calculated on the fly using approver_id.
+        "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called.
         "comment": "A String", # Optional. An optional comment for this manual approval result.
         "decision": "A String", # Required. The decision of this manual approval.
         "url": "A String", # Optional. An optional URL tied to this manual approval result. This field is essentially the same as comment, except that it will be rendered by the UI differently. An example use case is a link to an external job that approved this Build.
@@ -699,7 +699,7 @@
     "uri": "A String", # The URI of the repo (optional). If unspecified, the repo from which the trigger invocation originated is assumed to be the repo from which to read the specified path.
   },
   "github": { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
-    "enterpriseConfigResourceName": "A String", # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: "projects/{$project_id}/githubEnterpriseConfig/{$config_id}"
+    "enterpriseConfigResourceName": "A String", # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: "projects/{$project_id}/githubEnterpriseConfigs/{$config_id}"
     "installationId": "A String", # The installationID that emits the GitHub event.
     "name": "A String", # Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is "cloud-builders".
     "owner": "A String", # Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is "googlecloudplatform".
@@ -801,14 +801,14 @@
     "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
   },
   "autodetect": True or False, # Autodetect build configuration. The following precedence is used (case insensitive): 1. cloudbuild.yaml 2. cloudbuild.yml 3. cloudbuild.json 4. Dockerfile Currently only available for GitHub App Triggers.
-  "build": { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA. # Contents of the build template.
+  "build": { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $LOCATION: the location/region of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA. # Contents of the build template.
     "approval": { # BuildApproval describes a build's approval configuration, state, and result. # Output only. Describes this build's approval configuration, status, and result.
       "config": { # ApprovalConfig describes configuration for manual approval of a build. # Output only. Configuration for manual approval of this build.
         "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
       },
       "result": { # ApprovalResult describes the decision and associated metadata of a manual approval of a build. # Output only. Result of manual approval for this Build.
         "approvalTime": "A String", # Output only. The time when the approval decision was made.
-        "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called (the user's actual email that is tied to their GAIA ID may have changed). This field is not stored, rather, it is calculated on the fly using approver_id.
+        "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called.
         "comment": "A String", # Optional. An optional comment for this manual approval result.
         "decision": "A String", # Required. The decision of this manual approval.
         "url": "A String", # Optional. An optional URL tied to this manual approval result. This field is essentially the same as comment, except that it will be rendered by the UI differently. An example use case is a link to an external job that approved this Build.
@@ -1053,7 +1053,7 @@
     "uri": "A String", # The URI of the repo (optional). If unspecified, the repo from which the trigger invocation originated is assumed to be the repo from which to read the specified path.
   },
   "github": { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
-    "enterpriseConfigResourceName": "A String", # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: "projects/{$project_id}/githubEnterpriseConfig/{$config_id}"
+    "enterpriseConfigResourceName": "A String", # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: "projects/{$project_id}/githubEnterpriseConfigs/{$config_id}"
     "installationId": "A String", # The installationID that emits the GitHub event.
     "name": "A String", # Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is "cloud-builders".
     "owner": "A String", # Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is "googlecloudplatform".
@@ -1139,14 +1139,14 @@
         "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
       },
       "autodetect": True or False, # Autodetect build configuration. The following precedence is used (case insensitive): 1. cloudbuild.yaml 2. cloudbuild.yml 3. cloudbuild.json 4. Dockerfile Currently only available for GitHub App Triggers.
-      "build": { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA. # Contents of the build template.
+      "build": { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $LOCATION: the location/region of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA. # Contents of the build template.
         "approval": { # BuildApproval describes a build's approval configuration, state, and result. # Output only. Describes this build's approval configuration, status, and result.
           "config": { # ApprovalConfig describes configuration for manual approval of a build. # Output only. Configuration for manual approval of this build.
             "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
           },
           "result": { # ApprovalResult describes the decision and associated metadata of a manual approval of a build. # Output only. Result of manual approval for this Build.
             "approvalTime": "A String", # Output only. The time when the approval decision was made.
-            "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called (the user's actual email that is tied to their GAIA ID may have changed). This field is not stored, rather, it is calculated on the fly using approver_id.
+            "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called.
             "comment": "A String", # Optional. An optional comment for this manual approval result.
             "decision": "A String", # Required. The decision of this manual approval.
             "url": "A String", # Optional. An optional URL tied to this manual approval result. This field is essentially the same as comment, except that it will be rendered by the UI differently. An example use case is a link to an external job that approved this Build.
@@ -1391,7 +1391,7 @@
         "uri": "A String", # The URI of the repo (optional). If unspecified, the repo from which the trigger invocation originated is assumed to be the repo from which to read the specified path.
       },
       "github": { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
-        "enterpriseConfigResourceName": "A String", # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: "projects/{$project_id}/githubEnterpriseConfig/{$config_id}"
+        "enterpriseConfigResourceName": "A String", # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: "projects/{$project_id}/githubEnterpriseConfigs/{$config_id}"
         "installationId": "A String", # The installationID that emits the GitHub event.
         "name": "A String", # Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is "cloud-builders".
         "owner": "A String", # Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is "googlecloudplatform".
@@ -1482,14 +1482,14 @@
     "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
   },
   "autodetect": True or False, # Autodetect build configuration. The following precedence is used (case insensitive): 1. cloudbuild.yaml 2. cloudbuild.yml 3. cloudbuild.json 4. Dockerfile Currently only available for GitHub App Triggers.
-  "build": { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA. # Contents of the build template.
+  "build": { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $LOCATION: the location/region of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA. # Contents of the build template.
     "approval": { # BuildApproval describes a build's approval configuration, state, and result. # Output only. Describes this build's approval configuration, status, and result.
       "config": { # ApprovalConfig describes configuration for manual approval of a build. # Output only. Configuration for manual approval of this build.
         "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
       },
       "result": { # ApprovalResult describes the decision and associated metadata of a manual approval of a build. # Output only. Result of manual approval for this Build.
         "approvalTime": "A String", # Output only. The time when the approval decision was made.
-        "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called (the user's actual email that is tied to their GAIA ID may have changed). This field is not stored, rather, it is calculated on the fly using approver_id.
+        "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called.
         "comment": "A String", # Optional. An optional comment for this manual approval result.
         "decision": "A String", # Required. The decision of this manual approval.
         "url": "A String", # Optional. An optional URL tied to this manual approval result. This field is essentially the same as comment, except that it will be rendered by the UI differently. An example use case is a link to an external job that approved this Build.
@@ -1734,7 +1734,7 @@
     "uri": "A String", # The URI of the repo (optional). If unspecified, the repo from which the trigger invocation originated is assumed to be the repo from which to read the specified path.
   },
   "github": { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
-    "enterpriseConfigResourceName": "A String", # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: "projects/{$project_id}/githubEnterpriseConfig/{$config_id}"
+    "enterpriseConfigResourceName": "A String", # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: "projects/{$project_id}/githubEnterpriseConfigs/{$config_id}"
     "installationId": "A String", # The installationID that emits the GitHub event.
     "name": "A String", # Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is "cloud-builders".
     "owner": "A String", # Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is "googlecloudplatform".
@@ -1809,14 +1809,14 @@
     "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
   },
   "autodetect": True or False, # Autodetect build configuration. The following precedence is used (case insensitive): 1. cloudbuild.yaml 2. cloudbuild.yml 3. cloudbuild.json 4. Dockerfile Currently only available for GitHub App Triggers.
-  "build": { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA. # Contents of the build template.
+  "build": { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $LOCATION: the location/region of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA. # Contents of the build template.
     "approval": { # BuildApproval describes a build's approval configuration, state, and result. # Output only. Describes this build's approval configuration, status, and result.
       "config": { # ApprovalConfig describes configuration for manual approval of a build. # Output only. Configuration for manual approval of this build.
         "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
       },
       "result": { # ApprovalResult describes the decision and associated metadata of a manual approval of a build. # Output only. Result of manual approval for this Build.
         "approvalTime": "A String", # Output only. The time when the approval decision was made.
-        "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called (the user's actual email that is tied to their GAIA ID may have changed). This field is not stored, rather, it is calculated on the fly using approver_id.
+        "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called.
         "comment": "A String", # Optional. An optional comment for this manual approval result.
         "decision": "A String", # Required. The decision of this manual approval.
         "url": "A String", # Optional. An optional URL tied to this manual approval result. This field is essentially the same as comment, except that it will be rendered by the UI differently. An example use case is a link to an external job that approved this Build.
@@ -2061,7 +2061,7 @@
     "uri": "A String", # The URI of the repo (optional). If unspecified, the repo from which the trigger invocation originated is assumed to be the repo from which to read the specified path.
   },
   "github": { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
-    "enterpriseConfigResourceName": "A String", # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: "projects/{$project_id}/githubEnterpriseConfig/{$config_id}"
+    "enterpriseConfigResourceName": "A String", # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: "projects/{$project_id}/githubEnterpriseConfigs/{$config_id}"
     "installationId": "A String", # The installationID that emits the GitHub event.
     "name": "A String", # Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is "cloud-builders".
     "owner": "A String", # Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is "googlecloudplatform".

docs/dyn/cloudbuild_v1.projects.triggers.html

diff --git a/docs/dyn/cloudbuild_v1.projects.triggers.html b/docs/dyn/cloudbuild_v1.projects.triggers.html
index 2d4f1fa..5c0863c 100644
--- a/docs/dyn/cloudbuild_v1.projects.triggers.html
+++ b/docs/dyn/cloudbuild_v1.projects.triggers.html
@@ -121,14 +121,14 @@
     "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
   },
   "autodetect": True or False, # Autodetect build configuration. The following precedence is used (case insensitive): 1. cloudbuild.yaml 2. cloudbuild.yml 3. cloudbuild.json 4. Dockerfile Currently only available for GitHub App Triggers.
-  "build": { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA. # Contents of the build template.
+  "build": { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $LOCATION: the location/region of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA. # Contents of the build template.
     "approval": { # BuildApproval describes a build's approval configuration, state, and result. # Output only. Describes this build's approval configuration, status, and result.
       "config": { # ApprovalConfig describes configuration for manual approval of a build. # Output only. Configuration for manual approval of this build.
         "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
       },
       "result": { # ApprovalResult describes the decision and associated metadata of a manual approval of a build. # Output only. Result of manual approval for this Build.
         "approvalTime": "A String", # Output only. The time when the approval decision was made.
-        "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called (the user's actual email that is tied to their GAIA ID may have changed). This field is not stored, rather, it is calculated on the fly using approver_id.
+        "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called.
         "comment": "A String", # Optional. An optional comment for this manual approval result.
         "decision": "A String", # Required. The decision of this manual approval.
         "url": "A String", # Optional. An optional URL tied to this manual approval result. This field is essentially the same as comment, except that it will be rendered by the UI differently. An example use case is a link to an external job that approved this Build.
@@ -373,7 +373,7 @@
     "uri": "A String", # The URI of the repo (optional). If unspecified, the repo from which the trigger invocation originated is assumed to be the repo from which to read the specified path.
   },
   "github": { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
-    "enterpriseConfigResourceName": "A String", # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: "projects/{$project_id}/githubEnterpriseConfig/{$config_id}"
+    "enterpriseConfigResourceName": "A String", # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: "projects/{$project_id}/githubEnterpriseConfigs/{$config_id}"
     "installationId": "A String", # The installationID that emits the GitHub event.
     "name": "A String", # Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is "cloud-builders".
     "owner": "A String", # Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is "googlecloudplatform".
@@ -447,14 +447,14 @@
     "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
   },
   "autodetect": True or False, # Autodetect build configuration. The following precedence is used (case insensitive): 1. cloudbuild.yaml 2. cloudbuild.yml 3. cloudbuild.json 4. Dockerfile Currently only available for GitHub App Triggers.
-  "build": { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA. # Contents of the build template.
+  "build": { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $LOCATION: the location/region of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA. # Contents of the build template.
     "approval": { # BuildApproval describes a build's approval configuration, state, and result. # Output only. Describes this build's approval configuration, status, and result.
       "config": { # ApprovalConfig describes configuration for manual approval of a build. # Output only. Configuration for manual approval of this build.
         "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
       },
       "result": { # ApprovalResult describes the decision and associated metadata of a manual approval of a build. # Output only. Result of manual approval for this Build.
         "approvalTime": "A String", # Output only. The time when the approval decision was made.
-        "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called (the user's actual email that is tied to their GAIA ID may have changed). This field is not stored, rather, it is calculated on the fly using approver_id.
+        "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called.
         "comment": "A String", # Optional. An optional comment for this manual approval result.
         "decision": "A String", # Required. The decision of this manual approval.
         "url": "A String", # Optional. An optional URL tied to this manual approval result. This field is essentially the same as comment, except that it will be rendered by the UI differently. An example use case is a link to an external job that approved this Build.
@@ -699,7 +699,7 @@
     "uri": "A String", # The URI of the repo (optional). If unspecified, the repo from which the trigger invocation originated is assumed to be the repo from which to read the specified path.
   },
   "github": { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
-    "enterpriseConfigResourceName": "A String", # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: "projects/{$project_id}/githubEnterpriseConfig/{$config_id}"
+    "enterpriseConfigResourceName": "A String", # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: "projects/{$project_id}/githubEnterpriseConfigs/{$config_id}"
     "installationId": "A String", # The installationID that emits the GitHub event.
     "name": "A String", # Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is "cloud-builders".
     "owner": "A String", # Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is "googlecloudplatform".
@@ -801,14 +801,14 @@
     "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
   },
   "autodetect": True or False, # Autodetect build configuration. The following precedence is used (case insensitive): 1. cloudbuild.yaml 2. cloudbuild.yml 3. cloudbuild.json 4. Dockerfile Currently only available for GitHub App Triggers.
-  "build": { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA. # Contents of the build template.
+  "build": { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $LOCATION: the location/region of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA. # Contents of the build template.
     "approval": { # BuildApproval describes a build's approval configuration, state, and result. # Output only. Describes this build's approval configuration, status, and result.
       "config": { # ApprovalConfig describes configuration for manual approval of a build. # Output only. Configuration for manual approval of this build.
         "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
       },
       "result": { # ApprovalResult describes the decision and associated metadata of a manual approval of a build. # Output only. Result of manual approval for this Build.
         "approvalTime": "A String", # Output only. The time when the approval decision was made.
-        "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called (the user's actual email that is tied to their GAIA ID may have changed). This field is not stored, rather, it is calculated on the fly using approver_id.
+        "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called.
         "comment": "A String", # Optional. An optional comment for this manual approval result.
         "decision": "A String", # Required. The decision of this manual approval.
         "url": "A String", # Optional. An optional URL tied to this manual approval result. This field is essentially the same as comment, except that it will be rendered by the UI differently. An example use case is a link to an external job that approved this Build.
@@ -1053,7 +1053,7 @@
     "uri": "A String", # The URI of the repo (optional). If unspecified, the repo from which the trigger invocation originated is assumed to be the repo from which to read the specified path.
   },
   "github": { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
-    "enterpriseConfigResourceName": "A String", # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: "projects/{$project_id}/githubEnterpriseConfig/{$config_id}"
+    "enterpriseConfigResourceName": "A String", # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: "projects/{$project_id}/githubEnterpriseConfigs/{$config_id}"
     "installationId": "A String", # The installationID that emits the GitHub event.
     "name": "A String", # Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is "cloud-builders".
     "owner": "A String", # Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is "googlecloudplatform".
@@ -1139,14 +1139,14 @@
         "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
       },
       "autodetect": True or False, # Autodetect build configuration. The following precedence is used (case insensitive): 1. cloudbuild.yaml 2. cloudbuild.yml 3. cloudbuild.json 4. Dockerfile Currently only available for GitHub App Triggers.
-      "build": { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA. # Contents of the build template.
+      "build": { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $LOCATION: the location/region of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA. # Contents of the build template.
         "approval": { # BuildApproval describes a build's approval configuration, state, and result. # Output only. Describes this build's approval configuration, status, and result.
           "config": { # ApprovalConfig describes configuration for manual approval of a build. # Output only. Configuration for manual approval of this build.
             "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
           },
           "result": { # ApprovalResult describes the decision and associated metadata of a manual approval of a build. # Output only. Result of manual approval for this Build.
             "approvalTime": "A String", # Output only. The time when the approval decision was made.
-            "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called (the user's actual email that is tied to their GAIA ID may have changed). This field is not stored, rather, it is calculated on the fly using approver_id.
+            "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called.
             "comment": "A String", # Optional. An optional comment for this manual approval result.
             "decision": "A String", # Required. The decision of this manual approval.
             "url": "A String", # Optional. An optional URL tied to this manual approval result. This field is essentially the same as comment, except that it will be rendered by the UI differently. An example use case is a link to an external job that approved this Build.
@@ -1391,7 +1391,7 @@
         "uri": "A String", # The URI of the repo (optional). If unspecified, the repo from which the trigger invocation originated is assumed to be the repo from which to read the specified path.
       },
       "github": { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
-        "enterpriseConfigResourceName": "A String", # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: "projects/{$project_id}/githubEnterpriseConfig/{$config_id}"
+        "enterpriseConfigResourceName": "A String", # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: "projects/{$project_id}/githubEnterpriseConfigs/{$config_id}"
         "installationId": "A String", # The installationID that emits the GitHub event.
         "name": "A String", # Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is "cloud-builders".
         "owner": "A String", # Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is "googlecloudplatform".
@@ -1483,14 +1483,14 @@
     "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
   },
   "autodetect": True or False, # Autodetect build configuration. The following precedence is used (case insensitive): 1. cloudbuild.yaml 2. cloudbuild.yml 3. cloudbuild.json 4. Dockerfile Currently only available for GitHub App Triggers.
-  "build": { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA. # Contents of the build template.
+  "build": { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $LOCATION: the location/region of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA. # Contents of the build template.
     "approval": { # BuildApproval describes a build's approval configuration, state, and result. # Output only. Describes this build's approval configuration, status, and result.
       "config": { # ApprovalConfig describes configuration for manual approval of a build. # Output only. Configuration for manual approval of this build.
         "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
       },
       "result": { # ApprovalResult describes the decision and associated metadata of a manual approval of a build. # Output only. Result of manual approval for this Build.
         "approvalTime": "A String", # Output only. The time when the approval decision was made.
-        "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called (the user's actual email that is tied to their GAIA ID may have changed). This field is not stored, rather, it is calculated on the fly using approver_id.
+        "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called.
         "comment": "A String", # Optional. An optional comment for this manual approval result.
         "decision": "A String", # Required. The decision of this manual approval.
         "url": "A String", # Optional. An optional URL tied to this manual approval result. This field is essentially the same as comment, except that it will be rendered by the UI differently. An example use case is a link to an external job that approved this Build.
@@ -1735,7 +1735,7 @@
     "uri": "A String", # The URI of the repo (optional). If unspecified, the repo from which the trigger invocation originated is assumed to be the repo from which to read the specified path.
   },
   "github": { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
-    "enterpriseConfigResourceName": "A String", # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: "projects/{$project_id}/githubEnterpriseConfig/{$config_id}"
+    "enterpriseConfigResourceName": "A String", # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: "projects/{$project_id}/githubEnterpriseConfigs/{$config_id}"
     "installationId": "A String", # The installationID that emits the GitHub event.
     "name": "A String", # Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is "cloud-builders".
     "owner": "A String", # Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is "googlecloudplatform".
@@ -1808,14 +1808,14 @@
     "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
   },
   "autodetect": True or False, # Autodetect build configuration. The following precedence is used (case insensitive): 1. cloudbuild.yaml 2. cloudbuild.yml 3. cloudbuild.json 4. Dockerfile Currently only available for GitHub App Triggers.
-  "build": { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA. # Contents of the build template.
+  "build": { # A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $LOCATION: the location/region of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA. # Contents of the build template.
     "approval": { # BuildApproval describes a build's approval configuration, state, and result. # Output only. Describes this build's approval configuration, status, and result.
       "config": { # ApprovalConfig describes configuration for manual approval of a build. # Output only. Configuration for manual approval of this build.
         "approvalRequired": True or False, # Whether or not approval is needed. If this is set on a build, it will become pending when created, and will need to be explicitly approved to start.
       },
       "result": { # ApprovalResult describes the decision and associated metadata of a manual approval of a build. # Output only. Result of manual approval for this Build.
         "approvalTime": "A String", # Output only. The time when the approval decision was made.
-        "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called (the user's actual email that is tied to their GAIA ID may have changed). This field is not stored, rather, it is calculated on the fly using approver_id.
+        "approverAccount": "A String", # Output only. Email of the user that called the ApproveBuild API to approve or reject a build at the time that the API was called.
         "comment": "A String", # Optional. An optional comment for this manual approval result.
         "decision": "A String", # Required. The decision of this manual approval.
         "url": "A String", # Optional. An optional URL tied to this manual approval result. This field is essentially the same as comment, except that it will be rendered by the UI differently. An example use case is a link to an external job that approved this Build.
@@ -2060,7 +2060,7 @@
     "uri": "A String", # The URI of the repo (optional). If unspecified, the repo from which the trigger invocation originated is assumed to be the repo from which to read the specified path.
   },
   "github": { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
-    "enterpriseConfigResourceName": "A String", # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: "projects/{$project_id}/githubEnterpriseConfig/{$config_id}"
+    "enterpriseConfigResourceName": "A String", # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: "projects/{$project_id}/githubEnterpriseConfigs/{$config_id}"
     "installationId": "A String", # The installationID that emits the GitHub event.
     "name": "A String", # Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is "cloud-builders".
     "owner": "A String", # Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is "googlecloudplatform".

docs/dyn/cloudfunctions_v1.projects.locations.functions.html

diff --git a/docs/dyn/cloudfunctions_v1.projects.locations.functions.html b/docs/dyn/cloudfunctions_v1.projects.locations.functions.html
index 2cca722..290f56f 100644
--- a/docs/dyn/cloudfunctions_v1.projects.locations.functions.html
+++ b/docs/dyn/cloudfunctions_v1.projects.locations.functions.html
@@ -162,6 +162,7 @@
     "a_key": "A String",
   },
   "buildId": "A String", # Output only. The Cloud Build ID of the latest successful deployment of the function.
+  "buildName": "A String", # Output only. The Cloud Build Name of the function deployment. projects//locations//builds/.
   "buildWorkerPool": "A String", # Name of the Cloud Build Custom Worker Pool that should be used to build the function. The format of this field is `projects/{project}/locations/{region}/workerPools/{workerPool}` where {project} and {region} are the project id and region respectively where the worker pool is defined and {workerPool} is the short name of the worker pool. If the project id is not the same as the function, then the Cloud Functions Service Agent (service-@gcf-admin-robot.iam.gserviceaccount.com) must be granted the role Cloud Build Custom Workers Builder (roles/cloudbuild.customworkers.builder) in the project.
   "description": "A String", # User-provided description of a function.
   "entryPoint": "A String", # The name of the function (as defined in source code) that will be executed. Defaults to the resource name suffix, if not specified. For backward compatibility, if function with given name is not found, then the system will try to use function named "function". For Node.js this is name of a function exported by the module specified in `source_location`.
@@ -186,6 +187,7 @@
     "a_key": "A String",
   },
   "maxInstances": 42, # The limit on the maximum number of function instances that may coexist at a given time. In some cases, such as rapid traffic surges, Cloud Functions may, for a short period of time, create more instances than the specified max instances limit. If your function cannot tolerate this temporary behavior, you may want to factor in a safety margin and set a lower max instances value than your function can tolerate. See the [Max Instances](https://cloud.google.com/functions/docs/max-instances) Guide for more details.
+  "minInstances": 42, # A lower bound for the number function instances that may coexist at a given time.
   "name": "A String", # A user-defined name of the function. Function names must be unique globally and match pattern `projects/*/locations/*/functions/*`
   "network": "A String", # The VPC Network that this cloud function can connect to. It can be either the fully-qualified URI, or the short name of the network resource. If the short network name is used, the network must belong to the same project. Otherwise, it must belong to a project within the same organization. The format of this field is either `projects/{project}/global/networks/{network}` or `{network}`, where {project} is a project id where the network is defined, and {network} is the short name of the network. This field is mutually exclusive with `vpc_connector` and will be replaced by it. See [the VPC documentation](https://cloud.google.com/compute/docs/vpc) for more information on connecting Cloud projects.
   "runtime": "A String", # The runtime in which to run the function. Required when deploying a new function, optional when updating an existing function. For a complete list of possible choices, see the [`gcloud` command reference](/sdk/gcloud/reference/functions/deploy#--runtime).
@@ -361,6 +363,7 @@
     "a_key": "A String",
   },
   "buildId": "A String", # Output only. The Cloud Build ID of the latest successful deployment of the function.
+  "buildName": "A String", # Output only. The Cloud Build Name of the function deployment. projects//locations//builds/.
   "buildWorkerPool": "A String", # Name of the Cloud Build Custom Worker Pool that should be used to build the function. The format of this field is `projects/{project}/locations/{region}/workerPools/{workerPool}` where {project} and {region} are the project id and region respectively where the worker pool is defined and {workerPool} is the short name of the worker pool. If the project id is not the same as the function, then the Cloud Functions Service Agent (service-@gcf-admin-robot.iam.gserviceaccount.com) must be granted the role Cloud Build Custom Workers Builder (roles/cloudbuild.customworkers.builder) in the project.
   "description": "A String", # User-provided description of a function.
   "entryPoint": "A String", # The name of the function (as defined in source code) that will be executed. Defaults to the resource name suffix, if not specified. For backward compatibility, if function with given name is not found, then the system will try to use function named "function". For Node.js this is name of a function exported by the module specified in `source_location`.
@@ -385,6 +388,7 @@
     "a_key": "A String",
   },
   "maxInstances": 42, # The limit on the maximum number of function instances that may coexist at a given time. In some cases, such as rapid traffic surges, Cloud Functions may, for a short period of time, create more instances than the specified max instances limit. If your function cannot tolerate this temporary behavior, you may want to factor in a safety margin and set a lower max instances value than your function can tolerate. See the [Max Instances](https://cloud.google.com/functions/docs/max-instances) Guide for more details.
+  "minInstances": 42, # A lower bound for the number function instances that may coexist at a given time.
   "name": "A String", # A user-defined name of the function. Function names must be unique globally and match pattern `projects/*/locations/*/functions/*`
   "network": "A String", # The VPC Network that this cloud function can connect to. It can be either the fully-qualified URI, or the short name of the network resource. If the short network name is used, the network must belong to the same project. Otherwise, it must belong to a project within the same organization. The format of this field is either `projects/{project}/global/networks/{network}` or `{network}`, where {project} is a project id where the network is defined, and {network} is the short name of the network. This field is mutually exclusive with `vpc_connector` and will be replaced by it. See [the VPC documentation](https://cloud.google.com/compute/docs/vpc) for more information on connecting Cloud projects.
   "runtime": "A String", # The runtime in which to run the function. Required when deploying a new function, optional when updating an existing function. For a complete list of possible choices, see the [`gcloud` command reference](/sdk/gcloud/reference/functions/deploy#--runtime).
@@ -441,7 +445,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -498,6 +502,7 @@
         "a_key": "A String",
       },
       "buildId": "A String", # Output only. The Cloud Build ID of the latest successful deployment of the function.
+      "buildName": "A String", # Output only. The Cloud Build Name of the function deployment. projects//locations//builds/.
       "buildWorkerPool": "A String", # Name of the Cloud Build Custom Worker Pool that should be used to build the function. The format of this field is `projects/{project}/locations/{region}/workerPools/{workerPool}` where {project} and {region} are the project id and region respectively where the worker pool is defined and {workerPool} is the short name of the worker pool. If the project id is not the same as the function, then the Cloud Functions Service Agent (service-@gcf-admin-robot.iam.gserviceaccount.com) must be granted the role Cloud Build Custom Workers Builder (roles/cloudbuild.customworkers.builder) in the project.
       "description": "A String", # User-provided description of a function.
       "entryPoint": "A String", # The name of the function (as defined in source code) that will be executed. Defaults to the resource name suffix, if not specified. For backward compatibility, if function with given name is not found, then the system will try to use function named "function". For Node.js this is name of a function exported by the module specified in `source_location`.
@@ -522,6 +527,7 @@
         "a_key": "A String",
       },
       "maxInstances": 42, # The limit on the maximum number of function instances that may coexist at a given time. In some cases, such as rapid traffic surges, Cloud Functions may, for a short period of time, create more instances than the specified max instances limit. If your function cannot tolerate this temporary behavior, you may want to factor in a safety margin and set a lower max instances value than your function can tolerate. See the [Max Instances](https://cloud.google.com/functions/docs/max-instances) Guide for more details.
+      "minInstances": 42, # A lower bound for the number function instances that may coexist at a given time.
       "name": "A String", # A user-defined name of the function. Function names must be unique globally and match pattern `projects/*/locations/*/functions/*`
       "network": "A String", # The VPC Network that this cloud function can connect to. It can be either the fully-qualified URI, or the short name of the network resource. If the short network name is used, the network must belong to the same project. Otherwise, it must belong to a project within the same organization. The format of this field is either `projects/{project}/global/networks/{network}` or `{network}`, where {project} is a project id where the network is defined, and {network} is the short name of the network. This field is mutually exclusive with `vpc_connector` and will be replaced by it. See [the VPC documentation](https://cloud.google.com/compute/docs/vpc) for more information on connecting Cloud projects.
       "runtime": "A String", # The runtime in which to run the function. Required when deploying a new function, optional when updating an existing function. For a complete list of possible choices, see the [`gcloud` command reference](/sdk/gcloud/reference/functions/deploy#--runtime).
@@ -598,6 +604,7 @@
     "a_key": "A String",
   },
   "buildId": "A String", # Output only. The Cloud Build ID of the latest successful deployment of the function.
+  "buildName": "A String", # Output only. The Cloud Build Name of the function deployment. projects//locations//builds/.
   "buildWorkerPool": "A String", # Name of the Cloud Build Custom Worker Pool that should be used to build the function. The format of this field is `projects/{project}/locations/{region}/workerPools/{workerPool}` where {project} and {region} are the project id and region respectively where the worker pool is defined and {workerPool} is the short name of the worker pool. If the project id is not the same as the function, then the Cloud Functions Service Agent (service-@gcf-admin-robot.iam.gserviceaccount.com) must be granted the role Cloud Build Custom Workers Builder (roles/cloudbuild.customworkers.builder) in the project.
   "description": "A String", # User-provided description of a function.
   "entryPoint": "A String", # The name of the function (as defined in source code) that will be executed. Defaults to the resource name suffix, if not specified. For backward compatibility, if function with given name is not found, then the system will try to use function named "function". For Node.js this is name of a function exported by the module specified in `source_location`.
@@ -622,6 +629,7 @@
     "a_key": "A String",
   },
   "maxInstances": 42, # The limit on the maximum number of function instances that may coexist at a given time. In some cases, such as rapid traffic surges, Cloud Functions may, for a short period of time, create more instances than the specified max instances limit. If your function cannot tolerate this temporary behavior, you may want to factor in a safety margin and set a lower max instances value than your function can tolerate. See the [Max Instances](https://cloud.google.com/functions/docs/max-instances) Guide for more details.
+  "minInstances": 42, # A lower bound for the number function instances that may coexist at a given time.
   "name": "A String", # A user-defined name of the function. Function names must be unique globally and match pattern `projects/*/locations/*/functions/*`
   "network": "A String", # The VPC Network that this cloud function can connect to. It can be either the fully-qualified URI, or the short name of the network resource. If the short network name is used, the network must belong to the same project. Otherwise, it must belong to a project within the same organization. The format of this field is either `projects/{project}/global/networks/{network}` or `{network}`, where {project} is a project id where the network is defined, and {network} is the short name of the network. This field is mutually exclusive with `vpc_connector` and will be replaced by it. See [the VPC documentation](https://cloud.google.com/compute/docs/vpc) for more information on connecting Cloud projects.
   "runtime": "A String", # The runtime in which to run the function. Required when deploying a new function, optional when updating an existing function. For a complete list of possible choices, see the [`gcloud` command reference](/sdk/gcloud/reference/functions/deploy#--runtime).
@@ -702,7 +710,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -744,7 +752,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/cloudresourcemanager_v1.organizations.html

diff --git a/docs/dyn/cloudresourcemanager_v1.organizations.html b/docs/dyn/cloudresourcemanager_v1.organizations.html
index 929e4a0..de9665e 100644
--- a/docs/dyn/cloudresourcemanager_v1.organizations.html
+++ b/docs/dyn/cloudresourcemanager_v1.organizations.html
@@ -244,7 +244,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -505,7 +505,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -547,7 +547,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/cloudresourcemanager_v1.projects.html

diff --git a/docs/dyn/cloudresourcemanager_v1.projects.html b/docs/dyn/cloudresourcemanager_v1.projects.html
index f5ef271..ea6c85f 100644
--- a/docs/dyn/cloudresourcemanager_v1.projects.html
+++ b/docs/dyn/cloudresourcemanager_v1.projects.html
@@ -366,7 +366,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -626,7 +626,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -668,7 +668,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/cloudresourcemanager_v1beta1.organizations.html

diff --git a/docs/dyn/cloudresourcemanager_v1beta1.organizations.html b/docs/dyn/cloudresourcemanager_v1beta1.organizations.html
index b38ec2c..5f904fd 100644
--- a/docs/dyn/cloudresourcemanager_v1beta1.organizations.html
+++ b/docs/dyn/cloudresourcemanager_v1beta1.organizations.html
@@ -154,7 +154,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -244,7 +244,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -286,7 +286,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/cloudresourcemanager_v1beta1.projects.html

diff --git a/docs/dyn/cloudresourcemanager_v1beta1.projects.html b/docs/dyn/cloudresourcemanager_v1beta1.projects.html
index 9d208ef..41a80cf 100644
--- a/docs/dyn/cloudresourcemanager_v1beta1.projects.html
+++ b/docs/dyn/cloudresourcemanager_v1beta1.projects.html
@@ -267,7 +267,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -361,7 +361,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -403,7 +403,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/cloudresourcemanager_v2.folders.html

diff --git a/docs/dyn/cloudresourcemanager_v2.folders.html b/docs/dyn/cloudresourcemanager_v2.folders.html
index 417ef4b..50c8116 100644
--- a/docs/dyn/cloudresourcemanager_v2.folders.html
+++ b/docs/dyn/cloudresourcemanager_v2.folders.html
@@ -237,7 +237,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -452,7 +452,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -494,7 +494,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/cloudresourcemanager_v2beta1.folders.html

diff --git a/docs/dyn/cloudresourcemanager_v2beta1.folders.html b/docs/dyn/cloudresourcemanager_v2beta1.folders.html
index 6dd8bcf..4287ff0 100644
--- a/docs/dyn/cloudresourcemanager_v2beta1.folders.html
+++ b/docs/dyn/cloudresourcemanager_v2beta1.folders.html
@@ -237,7 +237,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -452,7 +452,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -494,7 +494,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/cloudresourcemanager_v3.folders.html

diff --git a/docs/dyn/cloudresourcemanager_v3.folders.html b/docs/dyn/cloudresourcemanager_v3.folders.html
index 90038a7..98b3b31 100644
--- a/docs/dyn/cloudresourcemanager_v3.folders.html
+++ b/docs/dyn/cloudresourcemanager_v3.folders.html
@@ -254,7 +254,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -484,7 +484,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -526,7 +526,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/cloudresourcemanager_v3.organizations.html

diff --git a/docs/dyn/cloudresourcemanager_v3.organizations.html b/docs/dyn/cloudresourcemanager_v3.organizations.html
index ec18c89..0d84c3a 100644
--- a/docs/dyn/cloudresourcemanager_v3.organizations.html
+++ b/docs/dyn/cloudresourcemanager_v3.organizations.html
@@ -150,7 +150,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -240,7 +240,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -282,7 +282,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/cloudresourcemanager_v3.projects.html

diff --git a/docs/dyn/cloudresourcemanager_v3.projects.html b/docs/dyn/cloudresourcemanager_v3.projects.html
index 0a28419..76c34b4 100644
--- a/docs/dyn/cloudresourcemanager_v3.projects.html
+++ b/docs/dyn/cloudresourcemanager_v3.projects.html
@@ -88,7 +88,7 @@
 <p class="firstline">Retrieves the project identified by the specified `name` (for example, `projects/415104041262`). The caller must have `resourcemanager.projects.get` permission for this project.</p>
 <p class="toc_element">
   <code><a href="#getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Returns the IAM access control policy for the specified project. Permission is denied if the policy or the resource do not exist.</p>
+<p class="firstline">Returns the IAM access control policy for the specified project, in the format `projects/{ProjectIdOrNumber}` e.g. projects/123. Permission is denied if the policy or the resource do not exist.</p>
 <p class="toc_element">
   <code><a href="#list">list(pageSize=None, pageToken=None, parent=None, showDeleted=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Lists projects that are direct children of the specified folder or organization resource. `list()` provides a strongly consistent view of the projects underneath the specified parent resource. `list()` returns projects sorted based upon the (ascending) lexical ordering of their `display_name`. The caller must have `resourcemanager.projects.list` permission on the identified parent.</p>
@@ -109,10 +109,10 @@
 <p class="firstline">Retrieves the next page of results.</p>
 <p class="toc_element">
   <code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Sets the IAM access control policy for the specified project. CAUTION: This method will replace the existing policy, and cannot be used to append additional IAM settings. Note: Removing service accounts from policies or changing their roles can render services completely inoperable. It is important to understand how the service account is being used before removing or updating its roles. The following constraints apply when using `setIamPolicy()`: + Project does not support `allUsers` and `allAuthenticatedUsers` as `members` in a `Binding` of a `Policy`. + The owner role can be granted to a `user`, `serviceAccount`, or a group that is part of an organization. For example, group@myownpersonaldomain.com could be added as an owner to a project in the myownpersonaldomain.com organization, but not the examplepetstore.com organization. + Service accounts can be made owners of a project directly without any restrictions. However, to be added as an owner, a user must be invited using the Cloud Platform console and must accept the invitation. + A user cannot be granted the owner role using `setIamPolicy()`. The user must be granted the owner role using the Cloud Platform Console and must explicitly accept the invitation. + Invitations to grant the owner role cannot be sent using `setIamPolicy()`; they must be sent only using the Cloud Platform Console. + Membership changes that leave the project without any owners that have accepted the Terms of Service (ToS) will be rejected. + If the project is not part of an organization, there must be at least one owner who has accepted the Terms of Service (ToS) agreement in the policy. Calling `setIamPolicy()` to remove the last ToS-accepted owner from the policy will fail. This restriction also applies to legacy projects that no longer have owners who have accepted the ToS. Edits to IAM policies will be rejected until the lack of a ToS-accepting owner is rectified. + Calling this method requires enabling the App Engine Admin API.</p>
+<p class="firstline">Sets the IAM access control policy for the specified project, in the format `projects/{ProjectIdOrNumber}` e.g. projects/123. CAUTION: This method will replace the existing policy, and cannot be used to append additional IAM settings. Note: Removing service accounts from policies or changing their roles can render services completely inoperable. It is important to understand how the service account is being used before removing or updating its roles. The following constraints apply when using `setIamPolicy()`: + Project does not support `allUsers` and `allAuthenticatedUsers` as `members` in a `Binding` of a `Policy`. + The owner role can be granted to a `user`, `serviceAccount`, or a group that is part of an organization. For example, group@myownpersonaldomain.com could be added as an owner to a project in the myownpersonaldomain.com organization, but not the examplepetstore.com organization. + Service accounts can be made owners of a project directly without any restrictions. However, to be added as an owner, a user must be invited using the Cloud Platform console and must accept the invitation. + A user cannot be granted the owner role using `setIamPolicy()`. The user must be granted the owner role using the Cloud Platform Console and must explicitly accept the invitation. + Invitations to grant the owner role cannot be sent using `setIamPolicy()`; they must be sent only using the Cloud Platform Console. + Membership changes that leave the project without any owners that have accepted the Terms of Service (ToS) will be rejected. + If the project is not part of an organization, there must be at least one owner who has accepted the Terms of Service (ToS) agreement in the policy. Calling `setIamPolicy()` to remove the last ToS-accepted owner from the policy will fail. This restriction also applies to legacy projects that no longer have owners who have accepted the ToS. Edits to IAM policies will be rejected until the lack of a ToS-accepting owner is rectified. + Calling this method requires enabling the App Engine Admin API.</p>
 <p class="toc_element">
   <code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Returns permissions that a caller has on the specified project.</p>
+<p class="firstline">Returns permissions that a caller has on the specified project, in the format `projects/{ProjectIdOrNumber}` e.g. projects/123..</p>
 <p class="toc_element">
   <code><a href="#undelete">undelete(name, body=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Restores the project identified by the specified `name` (for example, `projects/415104041262`). You can only use this method for a project that has a lifecycle state of DELETE_REQUESTED. After deletion starts, the project cannot be restored. The caller must have `resourcemanager.projects.undelete` permission for this project.</p>
@@ -241,7 +241,7 @@
 
 <div class="method">
     <code class="details" id="getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</code>
-  <pre>Returns the IAM access control policy for the specified project. Permission is denied if the policy or the resource do not exist.
+  <pre>Returns the IAM access control policy for the specified project, in the format `projects/{ProjectIdOrNumber}` e.g. projects/123. Permission is denied if the policy or the resource do not exist.
 
 Args:
   resource: string, REQUIRED: The resource for which the policy is being requested. See the operation documentation for the appropriate value for this field. (required)
@@ -262,7 +262,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -496,7 +496,7 @@
 
 <div class="method">
     <code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>
-  <pre>Sets the IAM access control policy for the specified project. CAUTION: This method will replace the existing policy, and cannot be used to append additional IAM settings. Note: Removing service accounts from policies or changing their roles can render services completely inoperable. It is important to understand how the service account is being used before removing or updating its roles. The following constraints apply when using `setIamPolicy()`: + Project does not support `allUsers` and `allAuthenticatedUsers` as `members` in a `Binding` of a `Policy`. + The owner role can be granted to a `user`, `serviceAccount`, or a group that is part of an organization. For example, group@myownpersonaldomain.com could be added as an owner to a project in the myownpersonaldomain.com organization, but not the examplepetstore.com organization. + Service accounts can be made owners of a project directly without any restrictions. However, to be added as an owner, a user must be invited using the Cloud Platform console and must accept the invitation. + A user cannot be granted the owner role using `setIamPolicy()`. The user must be granted the owner role using the Cloud Platform Console and must explicitly accept the invitation. + Invitations to grant the owner role cannot be sent using `setIamPolicy()`; they must be sent only using the Cloud Platform Console. + Membership changes that leave the project without any owners that have accepted the Terms of Service (ToS) will be rejected. + If the project is not part of an organization, there must be at least one owner who has accepted the Terms of Service (ToS) agreement in the policy. Calling `setIamPolicy()` to remove the last ToS-accepted owner from the policy will fail. This restriction also applies to legacy projects that no longer have owners who have accepted the ToS. Edits to IAM policies will be rejected until the lack of a ToS-accepting owner is rectified. + Calling this method requires enabling the App Engine Admin API.
+  <pre>Sets the IAM access control policy for the specified project, in the format `projects/{ProjectIdOrNumber}` e.g. projects/123. CAUTION: This method will replace the existing policy, and cannot be used to append additional IAM settings. Note: Removing service accounts from policies or changing their roles can render services completely inoperable. It is important to understand how the service account is being used before removing or updating its roles. The following constraints apply when using `setIamPolicy()`: + Project does not support `allUsers` and `allAuthenticatedUsers` as `members` in a `Binding` of a `Policy`. + The owner role can be granted to a `user`, `serviceAccount`, or a group that is part of an organization. For example, group@myownpersonaldomain.com could be added as an owner to a project in the myownpersonaldomain.com organization, but not the examplepetstore.com organization. + Service accounts can be made owners of a project directly without any restrictions. However, to be added as an owner, a user must be invited using the Cloud Platform console and must accept the invitation. + A user cannot be granted the owner role using `setIamPolicy()`. The user must be granted the owner role using the Cloud Platform Console and must explicitly accept the invitation. + Invitations to grant the owner role cannot be sent using `setIamPolicy()`; they must be sent only using the Cloud Platform Console. + Membership changes that leave the project without any owners that have accepted the Terms of Service (ToS) will be rejected. + If the project is not part of an organization, there must be at least one owner who has accepted the Terms of Service (ToS) agreement in the policy. Calling `setIamPolicy()` to remove the last ToS-accepted owner from the policy will fail. This restriction also applies to legacy projects that no longer have owners who have accepted the ToS. Edits to IAM policies will be rejected until the lack of a ToS-accepting owner is rectified. + Calling this method requires enabling the App Engine Admin API.
 
 Args:
   resource: string, REQUIRED: The resource for which the policy is being specified. See the operation documentation for the appropriate value for this field. (required)
@@ -504,7 +504,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -546,7 +546,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -581,7 +581,7 @@
 
 <div class="method">
     <code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>
-  <pre>Returns permissions that a caller has on the specified project.
+  <pre>Returns permissions that a caller has on the specified project, in the format `projects/{ProjectIdOrNumber}` e.g. projects/123..
 
 Args:
   resource: string, REQUIRED: The resource for which the policy detail is being requested. See the operation documentation for the appropriate value for this field. (required)

docs/dyn/cloudresourcemanager_v3.tagKeys.html

diff --git a/docs/dyn/cloudresourcemanager_v3.tagKeys.html b/docs/dyn/cloudresourcemanager_v3.tagKeys.html
index 568e146..b3e2b9d 100644
--- a/docs/dyn/cloudresourcemanager_v3.tagKeys.html
+++ b/docs/dyn/cloudresourcemanager_v3.tagKeys.html
@@ -245,7 +245,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -386,7 +386,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -428,7 +428,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/cloudresourcemanager_v3.tagValues.html

diff --git a/docs/dyn/cloudresourcemanager_v3.tagValues.html b/docs/dyn/cloudresourcemanager_v3.tagValues.html
index 92ce43e..275821c 100644
--- a/docs/dyn/cloudresourcemanager_v3.tagValues.html
+++ b/docs/dyn/cloudresourcemanager_v3.tagValues.html
@@ -245,7 +245,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -386,7 +386,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -428,7 +428,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/compute_alpha.addresses.html

diff --git a/docs/dyn/compute_alpha.addresses.html b/docs/dyn/compute_alpha.addresses.html
index 4656556..8ed4f81 100644
--- a/docs/dyn/compute_alpha.addresses.html
+++ b/docs/dyn/compute_alpha.addresses.html
@@ -130,7 +130,7 @@
   "items": { # A list of AddressesScopedList resources.
     "a_key": { # [Output Only] Name of the scope containing this set of addresses.
       "addresses": [ # [Output Only] A list of addresses contained in this scope.
-        { # Use global external addresses for GFE-based external HTTP(S) load balancers in Premium Tier. Use global internal addresses for reserved peering network range. Use regional external addresses for the following resources: - External IP addresses for VM instances - Regional external forwarding rules - Cloud NAT external IP addresses - GFE based LBs in Standard Tier - Network LBs in Premium or Standard Tier - Cloud VPN gateways (both Classic and HA) Use regional internal IP addresses for subnet IP ranges (primary and secondary). This includes: - Internal IP addresses for VM instances - Alias IP ranges of VM instances (/32 only) - Regional internal forwarding rules - Internal TCP/UDP load balancer addresses - Internal HTTP(S) load balancer addresses - Cloud DNS inbound forwarding IP addresses For more information, see Reserving a static external IP address.
+        { # Represents an IP Address resource. Google Compute Engine has two IP Address resources: * [Global (external and internal)](https://cloud.google.com/compute/docs/reference/rest/alpha/globalAddresses) * [Regional (external and internal)](https://cloud.google.com/compute/docs/reference/rest/alpha/addresses) For more information, see Reserving a static external IP address.
           "address": "A String", # The static IP address represented by this resource.
           "addressType": "A String", # The type of address to reserve, either INTERNAL or EXTERNAL. If unspecified, defaults to EXTERNAL.
           "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
@@ -142,11 +142,11 @@
           "labels": { # Labels for this resource. These can only be added or modified by the setLabels method. Each label key/value pair must comply with RFC1035. Label values may be empty.
             "a_key": "A String",
           },
-          "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+          "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
           "network": "A String", # The URL of the network in which to reserve the address. This field can only be used with INTERNAL type with the VPC_PEERING purpose.
-          "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Global forwarding rules can only be Premium Tier. Regional forwarding rules can be either Premium or Standard Tier. Standard Tier addresses applied to regional forwarding rules can be used with any external load balancer. Regional forwarding rules in Premium Tier can only be used with a network load balancer. If this field is not specified, it is assumed to be PREMIUM.
+          "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Internal IP addresses are always Premium Tier; global external IP addresses are always Premium Tier; regional external IP addresses can be either Standard or Premium Tier. If this field is not specified, it is assumed to be PREMIUM.
           "prefixLength": 42, # The prefix length if the resource represents an IP range.
-          "purpose": "A String", # The purpose of this resource, which can be one of the following values: - `GCE_ENDPOINT` for addresses that are used by VM instances, alias IP ranges, internal load balancers, and similar resources. - `DNS_RESOLVER` for a DNS resolver address in a subnetwork - `VPC_PEERING` for addresses that are reserved for VPC peer networks. - `NAT_AUTO` for addresses that are external IP addresses automatically reserved for Cloud NAT. - `IPSEC_INTERCONNECT` for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
+          "purpose": "A String", # The purpose of this resource, which can be one of the following values: - GCE_ENDPOINT for addresses that are used by VM instances, alias IP ranges, load balancers, and similar resources. - DNS_RESOLVER for a DNS resolver address in a subnetwork for a Cloud DNS inbound forwarder IP addresses (regional internal IP address in a subnet of a VPC network) - VPC_PEERING for global internal IP addresses used for private services access allocated ranges. - NAT_AUTO for the regional external IP addresses used by Cloud NAT when allocating addresses using . - IPSEC_INTERCONNECT for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
           "region": "A String", # [Output Only] The URL of the region where a regional address resides. For regional addresses, you must specify the region as a path parameter in the HTTP request URL. *This field is not applicable to global addresses.*
           "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
           "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
@@ -288,7 +288,7 @@
 Returns:
   An object of the form:
 
-    { # Use global external addresses for GFE-based external HTTP(S) load balancers in Premium Tier. Use global internal addresses for reserved peering network range. Use regional external addresses for the following resources: - External IP addresses for VM instances - Regional external forwarding rules - Cloud NAT external IP addresses - GFE based LBs in Standard Tier - Network LBs in Premium or Standard Tier - Cloud VPN gateways (both Classic and HA) Use regional internal IP addresses for subnet IP ranges (primary and secondary). This includes: - Internal IP addresses for VM instances - Alias IP ranges of VM instances (/32 only) - Regional internal forwarding rules - Internal TCP/UDP load balancer addresses - Internal HTTP(S) load balancer addresses - Cloud DNS inbound forwarding IP addresses For more information, see Reserving a static external IP address.
+    { # Represents an IP Address resource. Google Compute Engine has two IP Address resources: * [Global (external and internal)](https://cloud.google.com/compute/docs/reference/rest/alpha/globalAddresses) * [Regional (external and internal)](https://cloud.google.com/compute/docs/reference/rest/alpha/addresses) For more information, see Reserving a static external IP address.
   "address": "A String", # The static IP address represented by this resource.
   "addressType": "A String", # The type of address to reserve, either INTERNAL or EXTERNAL. If unspecified, defaults to EXTERNAL.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
@@ -300,11 +300,11 @@
   "labels": { # Labels for this resource. These can only be added or modified by the setLabels method. Each label key/value pair must comply with RFC1035. Label values may be empty.
     "a_key": "A String",
   },
-  "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
   "network": "A String", # The URL of the network in which to reserve the address. This field can only be used with INTERNAL type with the VPC_PEERING purpose.
-  "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Global forwarding rules can only be Premium Tier. Regional forwarding rules can be either Premium or Standard Tier. Standard Tier addresses applied to regional forwarding rules can be used with any external load balancer. Regional forwarding rules in Premium Tier can only be used with a network load balancer. If this field is not specified, it is assumed to be PREMIUM.
+  "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Internal IP addresses are always Premium Tier; global external IP addresses are always Premium Tier; regional external IP addresses can be either Standard or Premium Tier. If this field is not specified, it is assumed to be PREMIUM.
   "prefixLength": 42, # The prefix length if the resource represents an IP range.
-  "purpose": "A String", # The purpose of this resource, which can be one of the following values: - `GCE_ENDPOINT` for addresses that are used by VM instances, alias IP ranges, internal load balancers, and similar resources. - `DNS_RESOLVER` for a DNS resolver address in a subnetwork - `VPC_PEERING` for addresses that are reserved for VPC peer networks. - `NAT_AUTO` for addresses that are external IP addresses automatically reserved for Cloud NAT. - `IPSEC_INTERCONNECT` for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
+  "purpose": "A String", # The purpose of this resource, which can be one of the following values: - GCE_ENDPOINT for addresses that are used by VM instances, alias IP ranges, load balancers, and similar resources. - DNS_RESOLVER for a DNS resolver address in a subnetwork for a Cloud DNS inbound forwarder IP addresses (regional internal IP address in a subnet of a VPC network) - VPC_PEERING for global internal IP addresses used for private services access allocated ranges. - NAT_AUTO for the regional external IP addresses used by Cloud NAT when allocating addresses using . - IPSEC_INTERCONNECT for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
   "region": "A String", # [Output Only] The URL of the region where a regional address resides. For regional addresses, you must specify the region as a path parameter in the HTTP request URL. *This field is not applicable to global addresses.*
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
@@ -326,7 +326,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Use global external addresses for GFE-based external HTTP(S) load balancers in Premium Tier. Use global internal addresses for reserved peering network range. Use regional external addresses for the following resources: - External IP addresses for VM instances - Regional external forwarding rules - Cloud NAT external IP addresses - GFE based LBs in Standard Tier - Network LBs in Premium or Standard Tier - Cloud VPN gateways (both Classic and HA) Use regional internal IP addresses for subnet IP ranges (primary and secondary). This includes: - Internal IP addresses for VM instances - Alias IP ranges of VM instances (/32 only) - Regional internal forwarding rules - Internal TCP/UDP load balancer addresses - Internal HTTP(S) load balancer addresses - Cloud DNS inbound forwarding IP addresses For more information, see Reserving a static external IP address.
+{ # Represents an IP Address resource. Google Compute Engine has two IP Address resources: * [Global (external and internal)](https://cloud.google.com/compute/docs/reference/rest/alpha/globalAddresses) * [Regional (external and internal)](https://cloud.google.com/compute/docs/reference/rest/alpha/addresses) For more information, see Reserving a static external IP address.
   "address": "A String", # The static IP address represented by this resource.
   "addressType": "A String", # The type of address to reserve, either INTERNAL or EXTERNAL. If unspecified, defaults to EXTERNAL.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
@@ -338,11 +338,11 @@
   "labels": { # Labels for this resource. These can only be added or modified by the setLabels method. Each label key/value pair must comply with RFC1035. Label values may be empty.
     "a_key": "A String",
   },
-  "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
   "network": "A String", # The URL of the network in which to reserve the address. This field can only be used with INTERNAL type with the VPC_PEERING purpose.
-  "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Global forwarding rules can only be Premium Tier. Regional forwarding rules can be either Premium or Standard Tier. Standard Tier addresses applied to regional forwarding rules can be used with any external load balancer. Regional forwarding rules in Premium Tier can only be used with a network load balancer. If this field is not specified, it is assumed to be PREMIUM.
+  "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Internal IP addresses are always Premium Tier; global external IP addresses are always Premium Tier; regional external IP addresses can be either Standard or Premium Tier. If this field is not specified, it is assumed to be PREMIUM.
   "prefixLength": 42, # The prefix length if the resource represents an IP range.
-  "purpose": "A String", # The purpose of this resource, which can be one of the following values: - `GCE_ENDPOINT` for addresses that are used by VM instances, alias IP ranges, internal load balancers, and similar resources. - `DNS_RESOLVER` for a DNS resolver address in a subnetwork - `VPC_PEERING` for addresses that are reserved for VPC peer networks. - `NAT_AUTO` for addresses that are external IP addresses automatically reserved for Cloud NAT. - `IPSEC_INTERCONNECT` for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
+  "purpose": "A String", # The purpose of this resource, which can be one of the following values: - GCE_ENDPOINT for addresses that are used by VM instances, alias IP ranges, load balancers, and similar resources. - DNS_RESOLVER for a DNS resolver address in a subnetwork for a Cloud DNS inbound forwarder IP addresses (regional internal IP address in a subnet of a VPC network) - VPC_PEERING for global internal IP addresses used for private services access allocated ranges. - NAT_AUTO for the regional external IP addresses used by Cloud NAT when allocating addresses using . - IPSEC_INTERCONNECT for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
   "region": "A String", # [Output Only] The URL of the region where a regional address resides. For regional addresses, you must specify the region as a path parameter in the HTTP request URL. *This field is not applicable to global addresses.*
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
@@ -433,7 +433,7 @@
     { # Contains a list of addresses.
   "id": "A String", # [Output Only] Unique identifier for the resource; defined by the server.
   "items": [ # A list of Address resources.
-    { # Use global external addresses for GFE-based external HTTP(S) load balancers in Premium Tier. Use global internal addresses for reserved peering network range. Use regional external addresses for the following resources: - External IP addresses for VM instances - Regional external forwarding rules - Cloud NAT external IP addresses - GFE based LBs in Standard Tier - Network LBs in Premium or Standard Tier - Cloud VPN gateways (both Classic and HA) Use regional internal IP addresses for subnet IP ranges (primary and secondary). This includes: - Internal IP addresses for VM instances - Alias IP ranges of VM instances (/32 only) - Regional internal forwarding rules - Internal TCP/UDP load balancer addresses - Internal HTTP(S) load balancer addresses - Cloud DNS inbound forwarding IP addresses For more information, see Reserving a static external IP address.
+    { # Represents an IP Address resource. Google Compute Engine has two IP Address resources: * [Global (external and internal)](https://cloud.google.com/compute/docs/reference/rest/alpha/globalAddresses) * [Regional (external and internal)](https://cloud.google.com/compute/docs/reference/rest/alpha/addresses) For more information, see Reserving a static external IP address.
       "address": "A String", # The static IP address represented by this resource.
       "addressType": "A String", # The type of address to reserve, either INTERNAL or EXTERNAL. If unspecified, defaults to EXTERNAL.
       "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
@@ -445,11 +445,11 @@
       "labels": { # Labels for this resource. These can only be added or modified by the setLabels method. Each label key/value pair must comply with RFC1035. Label values may be empty.
         "a_key": "A String",
       },
-      "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+      "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
       "network": "A String", # The URL of the network in which to reserve the address. This field can only be used with INTERNAL type with the VPC_PEERING purpose.
-      "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Global forwarding rules can only be Premium Tier. Regional forwarding rules can be either Premium or Standard Tier. Standard Tier addresses applied to regional forwarding rules can be used with any external load balancer. Regional forwarding rules in Premium Tier can only be used with a network load balancer. If this field is not specified, it is assumed to be PREMIUM.
+      "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Internal IP addresses are always Premium Tier; global external IP addresses are always Premium Tier; regional external IP addresses can be either Standard or Premium Tier. If this field is not specified, it is assumed to be PREMIUM.
       "prefixLength": 42, # The prefix length if the resource represents an IP range.
-      "purpose": "A String", # The purpose of this resource, which can be one of the following values: - `GCE_ENDPOINT` for addresses that are used by VM instances, alias IP ranges, internal load balancers, and similar resources. - `DNS_RESOLVER` for a DNS resolver address in a subnetwork - `VPC_PEERING` for addresses that are reserved for VPC peer networks. - `NAT_AUTO` for addresses that are external IP addresses automatically reserved for Cloud NAT. - `IPSEC_INTERCONNECT` for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
+      "purpose": "A String", # The purpose of this resource, which can be one of the following values: - GCE_ENDPOINT for addresses that are used by VM instances, alias IP ranges, load balancers, and similar resources. - DNS_RESOLVER for a DNS resolver address in a subnetwork for a Cloud DNS inbound forwarder IP addresses (regional internal IP address in a subnet of a VPC network) - VPC_PEERING for global internal IP addresses used for private services access allocated ranges. - NAT_AUTO for the regional external IP addresses used by Cloud NAT when allocating addresses using . - IPSEC_INTERCONNECT for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
       "region": "A String", # [Output Only] The URL of the region where a regional address resides. For regional addresses, you must specify the region as a path parameter in the HTTP request URL. *This field is not applicable to global addresses.*
       "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
       "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.

docs/dyn/compute_alpha.backendServices.html

diff --git a/docs/dyn/compute_alpha.backendServices.html b/docs/dyn/compute_alpha.backendServices.html
index 69eeb53..9b62e91 100644
--- a/docs/dyn/compute_alpha.backendServices.html
+++ b/docs/dyn/compute_alpha.backendServices.html
@@ -230,7 +230,7 @@
           "affinityCookieTtlSec": 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
           "backends": [ # The list of backends that serve this BackendService.
             { # Message containing information of one individual backend.
-              "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+              "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
               "capacityScaler": 3.14, # A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
               "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
               "failover": True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -241,7 +241,7 @@
               "maxRate": 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
               "maxRatePerEndpoint": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
               "maxRatePerInstance": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
-              "maxUtilization": 3.14,
+              "maxUtilization": 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
             },
           ],
           "cdnPolicy": { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -612,7 +612,7 @@
           "sessionAffinity": "A String", # Type of session affinity to use. The default is NONE. For a detailed description of session affinity options, see: [Session affinity](https://cloud.google.com/load-balancing/docs/backend-service#session_affinity). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
           "subsetting": { # Subsetting configuration for this BackendService. Currently this is applicable only for Internal TCP/UDP load balancing, Internal HTTP(S) load balancing and Traffic Director.
             "policy": "A String",
-            "subsetSize": 42, # The number of backends per backend group assigned to each proxy instance or each service mesh client. An input parameter to the `CONSISTENT_HASH_SUBSETTING` algorithm. Can only be set if `policy` is set to `CONSISTENT_HASH_SUBSETTING`. Can only be set if load balancing scheme is `INTERNAL_MANAGED` or 'INTERNAL_SELF_MANAGED'. 'subset_size' is optional for Internal HTTP(S) load balancing and required for Traffic Director. If you do not provide this value, Cloud Load Balancing will calculate it dynamically to optimize the number of proxies/clients visible to each backend and vice versa. Must be greater than 0. If `subset_size` is larger than the number of backends/endpoints, then subsetting is disabled.
+            "subsetSize": 42, # The number of backends per backend group assigned to each proxy instance or each service mesh client. An input parameter to the `CONSISTENT_HASH_SUBSETTING` algorithm. Can only be set if `policy` is set to `CONSISTENT_HASH_SUBSETTING`. Can only be set if load balancing scheme is `INTERNAL_MANAGED` or `INTERNAL_SELF_MANAGED`. `subset_size` is optional for Internal HTTP(S) load balancing and required for Traffic Director. If you do not provide this value, Cloud Load Balancing will calculate it dynamically to optimize the number of proxies/clients visible to each backend and vice versa. Must be greater than 0. If `subset_size` is larger than the number of backends/endpoints, then subsetting is disabled.
           },
           "timeoutSec": 42, # Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true. Instead, use maxStreamDuration.
         },
@@ -815,7 +815,7 @@
   "affinityCookieTtlSec": 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   "backends": [ # The list of backends that serve this BackendService.
     { # Message containing information of one individual backend.
-      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
       "capacityScaler": 3.14, # A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
       "failover": True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -826,7 +826,7 @@
       "maxRate": 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerEndpoint": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerInstance": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
-      "maxUtilization": 3.14,
+      "maxUtilization": 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
     },
   ],
   "cdnPolicy": { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -1197,7 +1197,7 @@
   "sessionAffinity": "A String", # Type of session affinity to use. The default is NONE. For a detailed description of session affinity options, see: [Session affinity](https://cloud.google.com/load-balancing/docs/backend-service#session_affinity). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   "subsetting": { # Subsetting configuration for this BackendService. Currently this is applicable only for Internal TCP/UDP load balancing, Internal HTTP(S) load balancing and Traffic Director.
     "policy": "A String",
-    "subsetSize": 42, # The number of backends per backend group assigned to each proxy instance or each service mesh client. An input parameter to the `CONSISTENT_HASH_SUBSETTING` algorithm. Can only be set if `policy` is set to `CONSISTENT_HASH_SUBSETTING`. Can only be set if load balancing scheme is `INTERNAL_MANAGED` or 'INTERNAL_SELF_MANAGED'. 'subset_size' is optional for Internal HTTP(S) load balancing and required for Traffic Director. If you do not provide this value, Cloud Load Balancing will calculate it dynamically to optimize the number of proxies/clients visible to each backend and vice versa. Must be greater than 0. If `subset_size` is larger than the number of backends/endpoints, then subsetting is disabled.
+    "subsetSize": 42, # The number of backends per backend group assigned to each proxy instance or each service mesh client. An input parameter to the `CONSISTENT_HASH_SUBSETTING` algorithm. Can only be set if `policy` is set to `CONSISTENT_HASH_SUBSETTING`. Can only be set if load balancing scheme is `INTERNAL_MANAGED` or `INTERNAL_SELF_MANAGED`. `subset_size` is optional for Internal HTTP(S) load balancing and required for Traffic Director. If you do not provide this value, Cloud Load Balancing will calculate it dynamically to optimize the number of proxies/clients visible to each backend and vice versa. Must be greater than 0. If `subset_size` is larger than the number of backends/endpoints, then subsetting is disabled.
   },
   "timeoutSec": 42, # Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true. Instead, use maxStreamDuration.
 }</pre>
@@ -1365,7 +1365,7 @@
   &quot;affinityCookieTtlSec&quot;: 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   &quot;backends&quot;: [ # The list of backends that serve this BackendService.
     { # Message containing information of one individual backend.
-      &quot;balancingMode&quot;: &quot;A String&quot;, # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+      &quot;balancingMode&quot;: &quot;A String&quot;, # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
       &quot;capacityScaler&quot;: 3.14, # A multiplier applied to the backend&#x27;s target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
       &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
       &quot;failover&quot;: True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -1376,7 +1376,7 @@
       &quot;maxRate&quot;: 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend&#x27;s balancingMode is CONNECTION.
       &quot;maxRatePerEndpoint&quot;: 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend&#x27;s balancingMode is CONNECTION.
       &quot;maxRatePerInstance&quot;: 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend&#x27;s balancingMode is CONNECTION.
-      &quot;maxUtilization&quot;: 3.14,
+      &quot;maxUtilization&quot;: 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
     },
   ],
   &quot;cdnPolicy&quot;: { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -1747,7 +1747,7 @@
   &quot;sessionAffinity&quot;: &quot;A String&quot;, # Type of session affinity to use. The default is NONE. For a detailed description of session affinity options, see: [Session affinity](https://cloud.google.com/load-balancing/docs/backend-service#session_affinity). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   &quot;subsetting&quot;: { # Subsetting configuration for this BackendService. Currently this is applicable only for Internal TCP/UDP load balancing, Internal HTTP(S) load balancing and Traffic Director.
     &quot;policy&quot;: &quot;A String&quot;,
-    &quot;subsetSize&quot;: 42, # The number of backends per backend group assigned to each proxy instance or each service mesh client. An input parameter to the `CONSISTENT_HASH_SUBSETTING` algorithm. Can only be set if `policy` is set to `CONSISTENT_HASH_SUBSETTING`. Can only be set if load balancing scheme is `INTERNAL_MANAGED` or &#x27;INTERNAL_SELF_MANAGED&#x27;. &#x27;subset_size&#x27; is optional for Internal HTTP(S) load balancing and required for Traffic Director. If you do not provide this value, Cloud Load Balancing will calculate it dynamically to optimize the number of proxies/clients visible to each backend and vice versa. Must be greater than 0. If `subset_size` is larger than the number of backends/endpoints, then subsetting is disabled.
+    &quot;subsetSize&quot;: 42, # The number of backends per backend group assigned to each proxy instance or each service mesh client. An input parameter to the `CONSISTENT_HASH_SUBSETTING` algorithm. Can only be set if `policy` is set to `CONSISTENT_HASH_SUBSETTING`. Can only be set if load balancing scheme is `INTERNAL_MANAGED` or `INTERNAL_SELF_MANAGED`. `subset_size` is optional for Internal HTTP(S) load balancing and required for Traffic Director. If you do not provide this value, Cloud Load Balancing will calculate it dynamically to optimize the number of proxies/clients visible to each backend and vice versa. Must be greater than 0. If `subset_size` is larger than the number of backends/endpoints, then subsetting is disabled.
   },
   &quot;timeoutSec&quot;: 42, # Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true. Instead, use maxStreamDuration.
 }
@@ -1835,7 +1835,7 @@
       &quot;affinityCookieTtlSec&quot;: 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
       &quot;backends&quot;: [ # The list of backends that serve this BackendService.
         { # Message containing information of one individual backend.
-          &quot;balancingMode&quot;: &quot;A String&quot;, # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+          &quot;balancingMode&quot;: &quot;A String&quot;, # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
           &quot;capacityScaler&quot;: 3.14, # A multiplier applied to the backend&#x27;s target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
           &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
           &quot;failover&quot;: True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -1846,7 +1846,7 @@
           &quot;maxRate&quot;: 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend&#x27;s balancingMode is CONNECTION.
           &quot;maxRatePerEndpoint&quot;: 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend&#x27;s balancingMode is CONNECTION.
           &quot;maxRatePerInstance&quot;: 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend&#x27;s balancingMode is CONNECTION.
-          &quot;maxUtilization&quot;: 3.14,
+          &quot;maxUtilization&quot;: 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
         },
       ],
       &quot;cdnPolicy&quot;: { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -2217,7 +2217,7 @@
       &quot;sessionAffinity&quot;: &quot;A String&quot;, # Type of session affinity to use. The default is NONE. For a detailed description of session affinity options, see: [Session affinity](https://cloud.google.com/load-balancing/docs/backend-service#session_affinity). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
       &quot;subsetting&quot;: { # Subsetting configuration for this BackendService. Currently this is applicable only for Internal TCP/UDP load balancing, Internal HTTP(S) load balancing and Traffic Director.
         &quot;policy&quot;: &quot;A String&quot;,
-        &quot;subsetSize&quot;: 42, # The number of backends per backend group assigned to each proxy instance or each service mesh client. An input parameter to the `CONSISTENT_HASH_SUBSETTING` algorithm. Can only be set if `policy` is set to `CONSISTENT_HASH_SUBSETTING`. Can only be set if load balancing scheme is `INTERNAL_MANAGED` or &#x27;INTERNAL_SELF_MANAGED&#x27;. &#x27;subset_size&#x27; is optional for Internal HTTP(S) load balancing and required for Traffic Director. If you do not provide this value, Cloud Load Balancing will calculate it dynamically to optimize the number of proxies/clients visible to each backend and vice versa. Must be greater than 0. If `subset_size` is larger than the number of backends/endpoints, then subsetting is disabled.
+        &quot;subsetSize&quot;: 42, # The number of backends per backend group assigned to each proxy instance or each service mesh client. An input parameter to the `CONSISTENT_HASH_SUBSETTING` algorithm. Can only be set if `policy` is set to `CONSISTENT_HASH_SUBSETTING`. Can only be set if load balancing scheme is `INTERNAL_MANAGED` or `INTERNAL_SELF_MANAGED`. `subset_size` is optional for Internal HTTP(S) load balancing and required for Traffic Director. If you do not provide this value, Cloud Load Balancing will calculate it dynamically to optimize the number of proxies/clients visible to each backend and vice versa. Must be greater than 0. If `subset_size` is larger than the number of backends/endpoints, then subsetting is disabled.
       },
       &quot;timeoutSec&quot;: 42, # Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true. Instead, use maxStreamDuration.
     },
@@ -2266,7 +2266,7 @@
   &quot;affinityCookieTtlSec&quot;: 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   &quot;backends&quot;: [ # The list of backends that serve this BackendService.
     { # Message containing information of one individual backend.
-      &quot;balancingMode&quot;: &quot;A String&quot;, # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+      &quot;balancingMode&quot;: &quot;A String&quot;, # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
       &quot;capacityScaler&quot;: 3.14, # A multiplier applied to the backend&#x27;s target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
       &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
       &quot;failover&quot;: True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -2277,7 +2277,7 @@
       &quot;maxRate&quot;: 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend&#x27;s balancingMode is CONNECTION.
       &quot;maxRatePerEndpoint&quot;: 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend&#x27;s balancingMode is CONNECTION.
       &quot;maxRatePerInstance&quot;: 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend&#x27;s balancingMode is CONNECTION.
-      &quot;maxUtilization&quot;: 3.14,
+      &quot;maxUtilization&quot;: 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
     },
   ],
   &quot;cdnPolicy&quot;: { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -2648,7 +2648,7 @@
   &quot;sessionAffinity&quot;: &quot;A String&quot;, # Type of session affinity to use. The default is NONE. For a detailed description of session affinity options, see: [Session affinity](https://cloud.google.com/load-balancing/docs/backend-service#session_affinity). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   &quot;subsetting&quot;: { # Subsetting configuration for this BackendService. Currently this is applicable only for Internal TCP/UDP load balancing, Internal HTTP(S) load balancing and Traffic Director.
     &quot;policy&quot;: &quot;A String&quot;,
-    &quot;subsetSize&quot;: 42, # The number of backends per backend group assigned to each proxy instance or each service mesh client. An input parameter to the `CONSISTENT_HASH_SUBSETTING` algorithm. Can only be set if `policy` is set to `CONSISTENT_HASH_SUBSETTING`. Can only be set if load balancing scheme is `INTERNAL_MANAGED` or &#x27;INTERNAL_SELF_MANAGED&#x27;. &#x27;subset_size&#x27; is optional for Internal HTTP(S) load balancing and required for Traffic Director. If you do not provide this value, Cloud Load Balancing will calculate it dynamically to optimize the number of proxies/clients visible to each backend and vice versa. Must be greater than 0. If `subset_size` is larger than the number of backends/endpoints, then subsetting is disabled.
+    &quot;subsetSize&quot;: 42, # The number of backends per backend group assigned to each proxy instance or each service mesh client. An input parameter to the `CONSISTENT_HASH_SUBSETTING` algorithm. Can only be set if `policy` is set to `CONSISTENT_HASH_SUBSETTING`. Can only be set if load balancing scheme is `INTERNAL_MANAGED` or `INTERNAL_SELF_MANAGED`. `subset_size` is optional for Internal HTTP(S) load balancing and required for Traffic Director. If you do not provide this value, Cloud Load Balancing will calculate it dynamically to optimize the number of proxies/clients visible to each backend and vice versa. Must be greater than 0. If `subset_size` is larger than the number of backends/endpoints, then subsetting is disabled.
   },
   &quot;timeoutSec&quot;: 42, # Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true. Instead, use maxStreamDuration.
 }
@@ -3108,7 +3108,7 @@
   &quot;affinityCookieTtlSec&quot;: 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   &quot;backends&quot;: [ # The list of backends that serve this BackendService.
     { # Message containing information of one individual backend.
-      &quot;balancingMode&quot;: &quot;A String&quot;, # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+      &quot;balancingMode&quot;: &quot;A String&quot;, # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
       &quot;capacityScaler&quot;: 3.14, # A multiplier applied to the backend&#x27;s target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
       &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
       &quot;failover&quot;: True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -3119,7 +3119,7 @@
       &quot;maxRate&quot;: 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend&#x27;s balancingMode is CONNECTION.
       &quot;maxRatePerEndpoint&quot;: 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend&#x27;s balancingMode is CONNECTION.
       &quot;maxRatePerInstance&quot;: 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend&#x27;s balancingMode is CONNECTION.
-      &quot;maxUtilization&quot;: 3.14,
+      &quot;maxUtilization&quot;: 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
     },
   ],
   &quot;cdnPolicy&quot;: { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -3490,7 +3490,7 @@
   &quot;sessionAffinity&quot;: &quot;A String&quot;, # Type of session affinity to use. The default is NONE. For a detailed description of session affinity options, see: [Session affinity](https://cloud.google.com/load-balancing/docs/backend-service#session_affinity). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   &quot;subsetting&quot;: { # Subsetting configuration for this BackendService. Currently this is applicable only for Internal TCP/UDP load balancing, Internal HTTP(S) load balancing and Traffic Director.
     &quot;policy&quot;: &quot;A String&quot;,
-    &quot;subsetSize&quot;: 42, # The number of backends per backend group assigned to each proxy instance or each service mesh client. An input parameter to the `CONSISTENT_HASH_SUBSETTING` algorithm. Can only be set if `policy` is set to `CONSISTENT_HASH_SUBSETTING`. Can only be set if load balancing scheme is `INTERNAL_MANAGED` or &#x27;INTERNAL_SELF_MANAGED&#x27;. &#x27;subset_size&#x27; is optional for Internal HTTP(S) load balancing and required for Traffic Director. If you do not provide this value, Cloud Load Balancing will calculate it dynamically to optimize the number of proxies/clients visible to each backend and vice versa. Must be greater than 0. If `subset_size` is larger than the number of backends/endpoints, then subsetting is disabled.
+    &quot;subsetSize&quot;: 42, # The number of backends per backend group assigned to each proxy instance or each service mesh client. An input parameter to the `CONSISTENT_HASH_SUBSETTING` algorithm. Can only be set if `policy` is set to `CONSISTENT_HASH_SUBSETTING`. Can only be set if load balancing scheme is `INTERNAL_MANAGED` or `INTERNAL_SELF_MANAGED`. `subset_size` is optional for Internal HTTP(S) load balancing and required for Traffic Director. If you do not provide this value, Cloud Load Balancing will calculate it dynamically to optimize the number of proxies/clients visible to each backend and vice versa. Must be greater than 0. If `subset_size` is larger than the number of backends/endpoints, then subsetting is disabled.
   },
   &quot;timeoutSec&quot;: 42, # Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true. Instead, use maxStreamDuration.
 }

docs/dyn/compute_alpha.firewallPolicies.html

diff --git a/docs/dyn/compute_alpha.firewallPolicies.html b/docs/dyn/compute_alpha.firewallPolicies.html
index ea92800..5a54c22 100644
--- a/docs/dyn/compute_alpha.firewallPolicies.html
+++ b/docs/dyn/compute_alpha.firewallPolicies.html
@@ -227,7 +227,7 @@
   "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
   "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
   "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
       "A String",
     ],
     "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -238,7 +238,7 @@
         ],
       },
     ],
-    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
       "A String",
     ],
     "srcSecureTags": [ # List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256.
@@ -496,7 +496,7 @@
       "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
       "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
       "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
           "A String",
         ],
         "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -507,7 +507,7 @@
             ],
           },
         ],
-        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
           "A String",
         ],
         "srcSecureTags": [ # List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256.
@@ -689,7 +689,7 @@
   "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
   "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
   "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
       "A String",
     ],
     "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -700,7 +700,7 @@
         ],
       },
     ],
-    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
       "A String",
     ],
     "srcSecureTags": [ # List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256.
@@ -764,7 +764,7 @@
       "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
       "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
       "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
           "A String",
         ],
         "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -775,7 +775,7 @@
             ],
           },
         ],
-        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
           "A String",
         ],
         "srcSecureTags": [ # List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256.
@@ -915,7 +915,7 @@
           "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
           "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
           "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-            "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+            "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
               "A String",
             ],
             "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -926,7 +926,7 @@
                 ],
               },
             ],
-            "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+            "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
               "A String",
             ],
             "srcSecureTags": [ # List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256.
@@ -1116,7 +1116,7 @@
       "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
       "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
       "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
           "A String",
         ],
         "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -1127,7 +1127,7 @@
             ],
           },
         ],
-        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
           "A String",
         ],
         "srcSecureTags": [ # List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256.
@@ -1232,7 +1232,7 @@
   "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
   "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
   "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
       "A String",
     ],
     "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -1243,7 +1243,7 @@
         ],
       },
     ],
-    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
       "A String",
     ],
     "srcSecureTags": [ # List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256.

docs/dyn/compute_alpha.firewalls.html

diff --git a/docs/dyn/compute_alpha.firewalls.html b/docs/dyn/compute_alpha.firewalls.html
index ebdf0f5..ffeb8d9 100644
--- a/docs/dyn/compute_alpha.firewalls.html
+++ b/docs/dyn/compute_alpha.firewalls.html
@@ -205,7 +205,7 @@
     },
   ],
   "description": "A String", # An optional description of this resource. Provide this field when you create the resource.
-  "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Only IPv4 is supported.
+  "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Both IPv4 and IPv6 are supported.
     "A String",
   ],
   "direction": "A String", # Direction of traffic to which this firewall applies, either `INGRESS` or `EGRESS`. The default is `INGRESS`. For `INGRESS` traffic, you cannot specify the destinationRanges field, and for `EGRESS` traffic, you cannot specify the sourceRanges or sourceTags fields.
@@ -222,7 +222,7 @@
   "priority": 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
-  "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Only IPv4 is supported.
+  "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Both IPv4 and IPv6 are supported.
     "A String",
   ],
   "sourceServiceAccounts": [ # If source service accounts are specified, the firewall rules apply only to traffic originating from an instance with a service account in this list. Source service accounts cannot be used to control traffic to an instance's external IP address because service accounts are associated with an instance, not an IP address. sourceRanges can be set at the same time as sourceServiceAccounts. If both are set, the firewall applies to traffic that has a source IP address within the sourceRanges OR a source IP that belongs to an instance with service account listed in sourceServiceAccount. The connection does not need to match both fields for the firewall to apply. sourceServiceAccounts cannot be used at the same time as sourceTags or targetTags.
@@ -268,7 +268,7 @@
     },
   ],
   "description": "A String", # An optional description of this resource. Provide this field when you create the resource.
-  "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Only IPv4 is supported.
+  "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Both IPv4 and IPv6 are supported.
     "A String",
   ],
   "direction": "A String", # Direction of traffic to which this firewall applies, either `INGRESS` or `EGRESS`. The default is `INGRESS`. For `INGRESS` traffic, you cannot specify the destinationRanges field, and for `EGRESS` traffic, you cannot specify the sourceRanges or sourceTags fields.
@@ -285,7 +285,7 @@
   "priority": 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
-  "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Only IPv4 is supported.
+  "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Both IPv4 and IPv6 are supported.
     "A String",
   ],
   "sourceServiceAccounts": [ # If source service accounts are specified, the firewall rules apply only to traffic originating from an instance with a service account in this list. Source service accounts cannot be used to control traffic to an instance's external IP address because service accounts are associated with an instance, not an IP address. sourceRanges can be set at the same time as sourceServiceAccounts. If both are set, the firewall applies to traffic that has a source IP address within the sourceRanges OR a source IP that belongs to an instance with service account listed in sourceServiceAccount. The connection does not need to match both fields for the firewall to apply. sourceServiceAccounts cannot be used at the same time as sourceTags or targetTags.
@@ -400,7 +400,7 @@
         },
       ],
       "description": "A String", # An optional description of this resource. Provide this field when you create the resource.
-      "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Only IPv4 is supported.
+      "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Both IPv4 and IPv6 are supported.
         "A String",
       ],
       "direction": "A String", # Direction of traffic to which this firewall applies, either `INGRESS` or `EGRESS`. The default is `INGRESS`. For `INGRESS` traffic, you cannot specify the destinationRanges field, and for `EGRESS` traffic, you cannot specify the sourceRanges or sourceTags fields.
@@ -417,7 +417,7 @@
       "priority": 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
       "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
       "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
-      "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Only IPv4 is supported.
+      "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Both IPv4 and IPv6 are supported.
         "A String",
       ],
       "sourceServiceAccounts": [ # If source service accounts are specified, the firewall rules apply only to traffic originating from an instance with a service account in this list. Source service accounts cannot be used to control traffic to an instance's external IP address because service accounts are associated with an instance, not an IP address. sourceRanges can be set at the same time as sourceServiceAccounts. If both are set, the firewall applies to traffic that has a source IP address within the sourceRanges OR a source IP that belongs to an instance with service account listed in sourceServiceAccount. The connection does not need to match both fields for the firewall to apply. sourceServiceAccounts cannot be used at the same time as sourceTags or targetTags.
@@ -493,7 +493,7 @@
     },
   ],
   "description": "A String", # An optional description of this resource. Provide this field when you create the resource.
-  "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Only IPv4 is supported.
+  "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Both IPv4 and IPv6 are supported.
     "A String",
   ],
   "direction": "A String", # Direction of traffic to which this firewall applies, either `INGRESS` or `EGRESS`. The default is `INGRESS`. For `INGRESS` traffic, you cannot specify the destinationRanges field, and for `EGRESS` traffic, you cannot specify the sourceRanges or sourceTags fields.
@@ -510,7 +510,7 @@
   "priority": 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
-  "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Only IPv4 is supported.
+  "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Both IPv4 and IPv6 are supported.
     "A String",
   ],
   "sourceServiceAccounts": [ # If source service accounts are specified, the firewall rules apply only to traffic originating from an instance with a service account in this list. Source service accounts cannot be used to control traffic to an instance's external IP address because service accounts are associated with an instance, not an IP address. sourceRanges can be set at the same time as sourceServiceAccounts. If both are set, the firewall applies to traffic that has a source IP address within the sourceRanges OR a source IP that belongs to an instance with service account listed in sourceServiceAccount. The connection does not need to match both fields for the firewall to apply. sourceServiceAccounts cannot be used at the same time as sourceTags or targetTags.
@@ -644,7 +644,7 @@
     },
   ],
   "description": "A String", # An optional description of this resource. Provide this field when you create the resource.
-  "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Only IPv4 is supported.
+  "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Both IPv4 and IPv6 are supported.
     "A String",
   ],
   "direction": "A String", # Direction of traffic to which this firewall applies, either `INGRESS` or `EGRESS`. The default is `INGRESS`. For `INGRESS` traffic, you cannot specify the destinationRanges field, and for `EGRESS` traffic, you cannot specify the sourceRanges or sourceTags fields.
@@ -661,7 +661,7 @@
   "priority": 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
-  "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Only IPv4 is supported.
+  "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Both IPv4 and IPv6 are supported.
     "A String",
   ],
   "sourceServiceAccounts": [ # If source service accounts are specified, the firewall rules apply only to traffic originating from an instance with a service account in this list. Source service accounts cannot be used to control traffic to an instance's external IP address because service accounts are associated with an instance, not an IP address. sourceRanges can be set at the same time as sourceServiceAccounts. If both are set, the firewall applies to traffic that has a source IP address within the sourceRanges OR a source IP that belongs to an instance with service account listed in sourceServiceAccount. The connection does not need to match both fields for the firewall to apply. sourceServiceAccounts cannot be used at the same time as sourceTags or targetTags.

docs/dyn/compute_alpha.futureReservations.html

diff --git a/docs/dyn/compute_alpha.futureReservations.html b/docs/dyn/compute_alpha.futureReservations.html
index 5aea608..b373d06 100644
--- a/docs/dyn/compute_alpha.futureReservations.html
+++ b/docs/dyn/compute_alpha.futureReservations.html
@@ -130,7 +130,7 @@
   "id": "A String", # [Output Only] Unique identifier for the resource; defined by the server.
   "items": { # A list of Future reservation resources.
     "a_key": { # Name of the scope containing this set of future reservations.
-      "resources": [ # A list of future reservations contained in this scope.
+      "futureReservations": [ # A list of future reservations contained in this scope.
         {
           "creationTimestamp": "A String", # [Output Only] The creation timestamp for this future reservation in RFC3339 text format.
           "description": "A String", # An optional description of this resource. Provide this property when you create the future reservation.
@@ -141,6 +141,11 @@
           "selfLink": "A String", # [Output Only] Server-defined fully-qualified URL for this resource.
           "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
           "shareSettings": { # The share setting for reservations and sole tenancy node groups. # List of Projects/Folders to share with.
+            "folderMap": { # A map of folder id and folder config to specify consumer projects for this shared-reservation. This is only valid when share_type's value is DIRECT_PROJECTS_UNDER_SPECIFIC_FOLDERS.
+              "a_key": { # Config for each folder in the share settings.
+                "folderId": "A String", # The folder ID, should be same as the key of this folder config in the parent map.
+              },
+            },
             "projects": [ # A List of Project names to specify consumer projects for this shared-reservation. This is only valid when share_type's value is SPECIFIC_PROJECTS.
               "A String",
             ],
@@ -393,6 +398,11 @@
   "selfLink": "A String", # [Output Only] Server-defined fully-qualified URL for this resource.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
   "shareSettings": { # The share setting for reservations and sole tenancy node groups. # List of Projects/Folders to share with.
+    "folderMap": { # A map of folder id and folder config to specify consumer projects for this shared-reservation. This is only valid when share_type's value is DIRECT_PROJECTS_UNDER_SPECIFIC_FOLDERS.
+      "a_key": { # Config for each folder in the share settings.
+        "folderId": "A String", # The folder ID, should be same as the key of this folder config in the parent map.
+      },
+    },
     "projects": [ # A List of Project names to specify consumer projects for this shared-reservation. This is only valid when share_type's value is SPECIFIC_PROJECTS.
       "A String",
     ],
@@ -460,6 +470,11 @@
   "selfLink": "A String", # [Output Only] Server-defined fully-qualified URL for this resource.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
   "shareSettings": { # The share setting for reservations and sole tenancy node groups. # List of Projects/Folders to share with.
+    "folderMap": { # A map of folder id and folder config to specify consumer projects for this shared-reservation. This is only valid when share_type's value is DIRECT_PROJECTS_UNDER_SPECIFIC_FOLDERS.
+      "a_key": { # Config for each folder in the share settings.
+        "folderId": "A String", # The folder ID, should be same as the key of this folder config in the parent map.
+      },
+    },
     "projects": [ # A List of Project names to specify consumer projects for this shared-reservation. This is only valid when share_type's value is SPECIFIC_PROJECTS.
       "A String",
     ],
@@ -597,6 +612,11 @@
       "selfLink": "A String", # [Output Only] Server-defined fully-qualified URL for this resource.
       "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
       "shareSettings": { # The share setting for reservations and sole tenancy node groups. # List of Projects/Folders to share with.
+        "folderMap": { # A map of folder id and folder config to specify consumer projects for this shared-reservation. This is only valid when share_type's value is DIRECT_PROJECTS_UNDER_SPECIFIC_FOLDERS.
+          "a_key": { # Config for each folder in the share settings.
+            "folderId": "A String", # The folder ID, should be same as the key of this folder config in the parent map.
+          },
+        },
         "projects": [ # A List of Project names to specify consumer projects for this shared-reservation. This is only valid when share_type's value is SPECIFIC_PROJECTS.
           "A String",
         ],
@@ -697,6 +717,11 @@
   "selfLink": "A String", # [Output Only] Server-defined fully-qualified URL for this resource.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
   "shareSettings": { # The share setting for reservations and sole tenancy node groups. # List of Projects/Folders to share with.
+    "folderMap": { # A map of folder id and folder config to specify consumer projects for this shared-reservation. This is only valid when share_type's value is DIRECT_PROJECTS_UNDER_SPECIFIC_FOLDERS.
+      "a_key": { # Config for each folder in the share settings.
+        "folderId": "A String", # The folder ID, should be same as the key of this folder config in the parent map.
+      },
+    },
     "projects": [ # A List of Project names to specify consumer projects for this shared-reservation. This is only valid when share_type's value is SPECIFIC_PROJECTS.
       "A String",
     ],

docs/dyn/compute_alpha.globalAddresses.html

diff --git a/docs/dyn/compute_alpha.globalAddresses.html b/docs/dyn/compute_alpha.globalAddresses.html
index af15a93..4bea134 100644
--- a/docs/dyn/compute_alpha.globalAddresses.html
+++ b/docs/dyn/compute_alpha.globalAddresses.html
@@ -186,7 +186,7 @@
 Returns:
   An object of the form:
 
-    { # Use global external addresses for GFE-based external HTTP(S) load balancers in Premium Tier. Use global internal addresses for reserved peering network range. Use regional external addresses for the following resources: - External IP addresses for VM instances - Regional external forwarding rules - Cloud NAT external IP addresses - GFE based LBs in Standard Tier - Network LBs in Premium or Standard Tier - Cloud VPN gateways (both Classic and HA) Use regional internal IP addresses for subnet IP ranges (primary and secondary). This includes: - Internal IP addresses for VM instances - Alias IP ranges of VM instances (/32 only) - Regional internal forwarding rules - Internal TCP/UDP load balancer addresses - Internal HTTP(S) load balancer addresses - Cloud DNS inbound forwarding IP addresses For more information, see Reserving a static external IP address.
+    { # Represents an IP Address resource. Google Compute Engine has two IP Address resources: * [Global (external and internal)](https://cloud.google.com/compute/docs/reference/rest/alpha/globalAddresses) * [Regional (external and internal)](https://cloud.google.com/compute/docs/reference/rest/alpha/addresses) For more information, see Reserving a static external IP address.
   "address": "A String", # The static IP address represented by this resource.
   "addressType": "A String", # The type of address to reserve, either INTERNAL or EXTERNAL. If unspecified, defaults to EXTERNAL.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
@@ -198,11 +198,11 @@
   "labels": { # Labels for this resource. These can only be added or modified by the setLabels method. Each label key/value pair must comply with RFC1035. Label values may be empty.
     "a_key": "A String",
   },
-  "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
   "network": "A String", # The URL of the network in which to reserve the address. This field can only be used with INTERNAL type with the VPC_PEERING purpose.
-  "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Global forwarding rules can only be Premium Tier. Regional forwarding rules can be either Premium or Standard Tier. Standard Tier addresses applied to regional forwarding rules can be used with any external load balancer. Regional forwarding rules in Premium Tier can only be used with a network load balancer. If this field is not specified, it is assumed to be PREMIUM.
+  "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Internal IP addresses are always Premium Tier; global external IP addresses are always Premium Tier; regional external IP addresses can be either Standard or Premium Tier. If this field is not specified, it is assumed to be PREMIUM.
   "prefixLength": 42, # The prefix length if the resource represents an IP range.
-  "purpose": "A String", # The purpose of this resource, which can be one of the following values: - `GCE_ENDPOINT` for addresses that are used by VM instances, alias IP ranges, internal load balancers, and similar resources. - `DNS_RESOLVER` for a DNS resolver address in a subnetwork - `VPC_PEERING` for addresses that are reserved for VPC peer networks. - `NAT_AUTO` for addresses that are external IP addresses automatically reserved for Cloud NAT. - `IPSEC_INTERCONNECT` for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
+  "purpose": "A String", # The purpose of this resource, which can be one of the following values: - GCE_ENDPOINT for addresses that are used by VM instances, alias IP ranges, load balancers, and similar resources. - DNS_RESOLVER for a DNS resolver address in a subnetwork for a Cloud DNS inbound forwarder IP addresses (regional internal IP address in a subnet of a VPC network) - VPC_PEERING for global internal IP addresses used for private services access allocated ranges. - NAT_AUTO for the regional external IP addresses used by Cloud NAT when allocating addresses using . - IPSEC_INTERCONNECT for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
   "region": "A String", # [Output Only] The URL of the region where a regional address resides. For regional addresses, you must specify the region as a path parameter in the HTTP request URL. *This field is not applicable to global addresses.*
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
@@ -243,7 +243,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Use global external addresses for GFE-based external HTTP(S) load balancers in Premium Tier. Use global internal addresses for reserved peering network range. Use regional external addresses for the following resources: - External IP addresses for VM instances - Regional external forwarding rules - Cloud NAT external IP addresses - GFE based LBs in Standard Tier - Network LBs in Premium or Standard Tier - Cloud VPN gateways (both Classic and HA) Use regional internal IP addresses for subnet IP ranges (primary and secondary). This includes: - Internal IP addresses for VM instances - Alias IP ranges of VM instances (/32 only) - Regional internal forwarding rules - Internal TCP/UDP load balancer addresses - Internal HTTP(S) load balancer addresses - Cloud DNS inbound forwarding IP addresses For more information, see Reserving a static external IP address.
+{ # Represents an IP Address resource. Google Compute Engine has two IP Address resources: * [Global (external and internal)](https://cloud.google.com/compute/docs/reference/rest/alpha/globalAddresses) * [Regional (external and internal)](https://cloud.google.com/compute/docs/reference/rest/alpha/addresses) For more information, see Reserving a static external IP address.
   "address": "A String", # The static IP address represented by this resource.
   "addressType": "A String", # The type of address to reserve, either INTERNAL or EXTERNAL. If unspecified, defaults to EXTERNAL.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
@@ -255,11 +255,11 @@
   "labels": { # Labels for this resource. These can only be added or modified by the setLabels method. Each label key/value pair must comply with RFC1035. Label values may be empty.
     "a_key": "A String",
   },
-  "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
   "network": "A String", # The URL of the network in which to reserve the address. This field can only be used with INTERNAL type with the VPC_PEERING purpose.
-  "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Global forwarding rules can only be Premium Tier. Regional forwarding rules can be either Premium or Standard Tier. Standard Tier addresses applied to regional forwarding rules can be used with any external load balancer. Regional forwarding rules in Premium Tier can only be used with a network load balancer. If this field is not specified, it is assumed to be PREMIUM.
+  "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Internal IP addresses are always Premium Tier; global external IP addresses are always Premium Tier; regional external IP addresses can be either Standard or Premium Tier. If this field is not specified, it is assumed to be PREMIUM.
   "prefixLength": 42, # The prefix length if the resource represents an IP range.
-  "purpose": "A String", # The purpose of this resource, which can be one of the following values: - `GCE_ENDPOINT` for addresses that are used by VM instances, alias IP ranges, internal load balancers, and similar resources. - `DNS_RESOLVER` for a DNS resolver address in a subnetwork - `VPC_PEERING` for addresses that are reserved for VPC peer networks. - `NAT_AUTO` for addresses that are external IP addresses automatically reserved for Cloud NAT. - `IPSEC_INTERCONNECT` for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
+  "purpose": "A String", # The purpose of this resource, which can be one of the following values: - GCE_ENDPOINT for addresses that are used by VM instances, alias IP ranges, load balancers, and similar resources. - DNS_RESOLVER for a DNS resolver address in a subnetwork for a Cloud DNS inbound forwarder IP addresses (regional internal IP address in a subnet of a VPC network) - VPC_PEERING for global internal IP addresses used for private services access allocated ranges. - NAT_AUTO for the regional external IP addresses used by Cloud NAT when allocating addresses using . - IPSEC_INTERCONNECT for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
   "region": "A String", # [Output Only] The URL of the region where a regional address resides. For regional addresses, you must specify the region as a path parameter in the HTTP request URL. *This field is not applicable to global addresses.*
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
@@ -349,7 +349,7 @@
     { # Contains a list of addresses.
   "id": "A String", # [Output Only] Unique identifier for the resource; defined by the server.
   "items": [ # A list of Address resources.
-    { # Use global external addresses for GFE-based external HTTP(S) load balancers in Premium Tier. Use global internal addresses for reserved peering network range. Use regional external addresses for the following resources: - External IP addresses for VM instances - Regional external forwarding rules - Cloud NAT external IP addresses - GFE based LBs in Standard Tier - Network LBs in Premium or Standard Tier - Cloud VPN gateways (both Classic and HA) Use regional internal IP addresses for subnet IP ranges (primary and secondary). This includes: - Internal IP addresses for VM instances - Alias IP ranges of VM instances (/32 only) - Regional internal forwarding rules - Internal TCP/UDP load balancer addresses - Internal HTTP(S) load balancer addresses - Cloud DNS inbound forwarding IP addresses For more information, see Reserving a static external IP address.
+    { # Represents an IP Address resource. Google Compute Engine has two IP Address resources: * [Global (external and internal)](https://cloud.google.com/compute/docs/reference/rest/alpha/globalAddresses) * [Regional (external and internal)](https://cloud.google.com/compute/docs/reference/rest/alpha/addresses) For more information, see Reserving a static external IP address.
       "address": "A String", # The static IP address represented by this resource.
       "addressType": "A String", # The type of address to reserve, either INTERNAL or EXTERNAL. If unspecified, defaults to EXTERNAL.
       "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
@@ -361,11 +361,11 @@
       "labels": { # Labels for this resource. These can only be added or modified by the setLabels method. Each label key/value pair must comply with RFC1035. Label values may be empty.
         "a_key": "A String",
       },
-      "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+      "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
       "network": "A String", # The URL of the network in which to reserve the address. This field can only be used with INTERNAL type with the VPC_PEERING purpose.
-      "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Global forwarding rules can only be Premium Tier. Regional forwarding rules can be either Premium or Standard Tier. Standard Tier addresses applied to regional forwarding rules can be used with any external load balancer. Regional forwarding rules in Premium Tier can only be used with a network load balancer. If this field is not specified, it is assumed to be PREMIUM.
+      "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Internal IP addresses are always Premium Tier; global external IP addresses are always Premium Tier; regional external IP addresses can be either Standard or Premium Tier. If this field is not specified, it is assumed to be PREMIUM.
       "prefixLength": 42, # The prefix length if the resource represents an IP range.
-      "purpose": "A String", # The purpose of this resource, which can be one of the following values: - `GCE_ENDPOINT` for addresses that are used by VM instances, alias IP ranges, internal load balancers, and similar resources. - `DNS_RESOLVER` for a DNS resolver address in a subnetwork - `VPC_PEERING` for addresses that are reserved for VPC peer networks. - `NAT_AUTO` for addresses that are external IP addresses automatically reserved for Cloud NAT. - `IPSEC_INTERCONNECT` for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
+      "purpose": "A String", # The purpose of this resource, which can be one of the following values: - GCE_ENDPOINT for addresses that are used by VM instances, alias IP ranges, load balancers, and similar resources. - DNS_RESOLVER for a DNS resolver address in a subnetwork for a Cloud DNS inbound forwarder IP addresses (regional internal IP address in a subnet of a VPC network) - VPC_PEERING for global internal IP addresses used for private services access allocated ranges. - NAT_AUTO for the regional external IP addresses used by Cloud NAT when allocating addresses using . - IPSEC_INTERCONNECT for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
       "region": "A String", # [Output Only] The URL of the region where a regional address resides. For regional addresses, you must specify the region as a path parameter in the HTTP request URL. *This field is not applicable to global addresses.*
       "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
       "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.

docs/dyn/compute_alpha.healthChecks.html

diff --git a/docs/dyn/compute_alpha.healthChecks.html b/docs/dyn/compute_alpha.healthChecks.html
index 8c8bc02..b982485 100644
--- a/docs/dyn/compute_alpha.healthChecks.html
+++ b/docs/dyn/compute_alpha.healthChecks.html
@@ -133,7 +133,7 @@
   "items": { # A list of HealthChecksScopedList resources.
     "a_key": { # Name of the scope containing this set of HealthChecks.
       "healthChecks": [ # A list of HealthChecks contained in this scope.
-        { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/alpha/healthChecks) * [Regional](/compute/docs/reference/rest/alpha/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+        { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/alpha/healthChecks) * [Regional](/compute/docs/reference/rest/alpha/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
           "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
           "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
           "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -339,7 +339,7 @@
 Returns:
   An object of the form:
 
-    { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/alpha/healthChecks) * [Regional](/compute/docs/reference/rest/alpha/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+    { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/alpha/healthChecks) * [Regional](/compute/docs/reference/rest/alpha/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -426,7 +426,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/alpha/healthChecks) * [Regional](/compute/docs/reference/rest/alpha/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/alpha/healthChecks) * [Regional](/compute/docs/reference/rest/alpha/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -582,7 +582,7 @@
     { # Contains a list of HealthCheck resources.
   "id": "A String", # [Output Only] Unique identifier for the resource; defined by the server.
   "items": [ # A list of HealthCheck resources.
-    { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/alpha/healthChecks) * [Regional](/compute/docs/reference/rest/alpha/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+    { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/alpha/healthChecks) * [Regional](/compute/docs/reference/rest/alpha/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
       "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
       "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -699,7 +699,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/alpha/healthChecks) * [Regional](/compute/docs/reference/rest/alpha/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/alpha/healthChecks) * [Regional](/compute/docs/reference/rest/alpha/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -874,7 +874,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/alpha/healthChecks) * [Regional](/compute/docs/reference/rest/alpha/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/alpha/healthChecks) * [Regional](/compute/docs/reference/rest/alpha/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.

docs/dyn/compute_alpha.httpHealthChecks.html

diff --git a/docs/dyn/compute_alpha.httpHealthChecks.html b/docs/dyn/compute_alpha.httpHealthChecks.html
index bee7d3d..885d13c 100644
--- a/docs/dyn/compute_alpha.httpHealthChecks.html
+++ b/docs/dyn/compute_alpha.httpHealthChecks.html
@@ -186,7 +186,7 @@
 Returns:
   An object of the form:
 
-    { # Represents a legacy HTTP Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+    { # Represents a legacy HTTP Health Check resource. Legacy HTTP health checks are now only required by target pool-based network load balancers. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -213,7 +213,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a legacy HTTP Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+{ # Represents a legacy HTTP Health Check resource. Legacy HTTP health checks are now only required by target pool-based network load balancers. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -309,7 +309,7 @@
     { # Contains a list of HttpHealthCheck resources.
   "id": "A String", # [Output Only] Unique identifier for the resource; defined by the server.
   "items": [ # A list of HttpHealthCheck resources.
-    { # Represents a legacy HTTP Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+    { # Represents a legacy HTTP Health Check resource. Legacy HTTP health checks are now only required by target pool-based network load balancers. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
       "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
       "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -366,7 +366,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a legacy HTTP Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+{ # Represents a legacy HTTP Health Check resource. Legacy HTTP health checks are now only required by target pool-based network load balancers. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -481,7 +481,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a legacy HTTP Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+{ # Represents a legacy HTTP Health Check resource. Legacy HTTP health checks are now only required by target pool-based network load balancers. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.

docs/dyn/compute_alpha.httpsHealthChecks.html

diff --git a/docs/dyn/compute_alpha.httpsHealthChecks.html b/docs/dyn/compute_alpha.httpsHealthChecks.html
index f439641..9dca213 100644
--- a/docs/dyn/compute_alpha.httpsHealthChecks.html
+++ b/docs/dyn/compute_alpha.httpsHealthChecks.html
@@ -186,7 +186,7 @@
 Returns:
   An object of the form:
 
-    { # Represents a legacy HTTPS Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+    { # Represents a legacy HTTPS Health Check resource. Legacy HTTPS health checks have been deprecated. If you are using a target pool-based network load balancer, you must use a legacy HTTP (not HTTPS) health check. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -213,7 +213,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a legacy HTTPS Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+{ # Represents a legacy HTTPS Health Check resource. Legacy HTTPS health checks have been deprecated. If you are using a target pool-based network load balancer, you must use a legacy HTTP (not HTTPS) health check. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -309,7 +309,7 @@
     { # Contains a list of HttpsHealthCheck resources.
   "id": "A String", # [Output Only] Unique identifier for the resource; defined by the server.
   "items": [ # A list of HttpsHealthCheck resources.
-    { # Represents a legacy HTTPS Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+    { # Represents a legacy HTTPS Health Check resource. Legacy HTTPS health checks have been deprecated. If you are using a target pool-based network load balancer, you must use a legacy HTTP (not HTTPS) health check. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
       "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
       "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -366,7 +366,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a legacy HTTPS Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+{ # Represents a legacy HTTPS Health Check resource. Legacy HTTPS health checks have been deprecated. If you are using a target pool-based network load balancer, you must use a legacy HTTP (not HTTPS) health check. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -481,7 +481,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a legacy HTTPS Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+{ # Represents a legacy HTTPS Health Check resource. Legacy HTTPS health checks have been deprecated. If you are using a target pool-based network load balancer, you must use a legacy HTTP (not HTTPS) health check. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.

docs/dyn/compute_alpha.imageFamilyViews.html

diff --git a/docs/dyn/compute_alpha.imageFamilyViews.html b/docs/dyn/compute_alpha.imageFamilyViews.html
index 2074e1b..ea2ad72 100644
--- a/docs/dyn/compute_alpha.imageFamilyViews.html
+++ b/docs/dyn/compute_alpha.imageFamilyViews.html
@@ -146,11 +146,12 @@
     "licenses": [ # Any applicable license URI.
       "A String",
     ],
+    "locked": True or False, # A flag for marketplace VM disk created from the image, which is designed for marketplace VM disk to prevent the proprietary data on the disk from being accessed unwantedly. The flag will be inherited by the disk created from the image. The disk with locked flag set to true will be prohibited from performing the operations below: - R/W or R/O disk attach - Disk detach, if disk is created via create-on-create - Create images - Create snapshots - Create disk clone (create disk from the current disk) The image with the locked field set to true will be prohibited from performing the operations below: - Create images from the current image - Update the locked field for the current image The instance with at least one disk with locked flag set to true will be prohibited from performing the operations below: - Secondary disk attach - Create instant snapshot - Create machine images - Create instance template - Delete the instance with --keep-disk parameter set to true
     "name": "A String", # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
     "rawDisk": { # The parameters of the raw disk image.
       "containerType": "A String", # The format used to encode and transmit the block device, which should be TAR. This is just a container and transmission format and not a runtime format. Provided by the client when the disk image is created.
       "sha1Checksum": "A String", # [Deprecated] This field is deprecated. An optional SHA1 checksum of the disk image before unpackaging provided by the client when the disk image is created.
-      "source": "A String", # The full Google Cloud Storage URL where the disk image is stored. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+      "source": "A String", # The full Google Cloud Storage URL where the raw disk image archive is stored. The following are valid formats for the URL: - https://storage.googleapis.com/bucket_name/image_archive_name - https://storage.googleapis.com/bucket_name/folder_name/ image_archive_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
     },
     "rolloutOverride": { # A rollout policy configuration. # A rollout policy to apply to this image. When specified, the rollout policy overrides per-zone references to the image via the associated image family. The rollout policy restricts the zones where this image is accessible when using a zonal image family reference. When the rollout policy does not include the user specified zone, or if the zone is rolled out, this image is accessible. The rollout policy for this image is read-only, except for allowlisted users. This field might not be configured. To view the latest non-deprecated image in a specific zone, use the imageFamilyViews.get method.
       "defaultRolloutTime": "A String", # An optional RFC3339 timestamp on or after which the update is considered rolled out to any zone that is not explicitly stated.
@@ -194,7 +195,7 @@
       "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     "sourceDiskId": "A String", # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
-    "sourceImage": "A String", # URL of the source image used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+    "sourceImage": "A String", # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
     "sourceImageEncryptionKey": { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
       "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
       "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
@@ -203,7 +204,7 @@
       "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     "sourceImageId": "A String", # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
-    "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+    "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
     "sourceSnapshotEncryptionKey": { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
       "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
       "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.

docs/dyn/compute_alpha.images.html

diff --git a/docs/dyn/compute_alpha.images.html b/docs/dyn/compute_alpha.images.html
index 4289a02..959698a 100644
--- a/docs/dyn/compute_alpha.images.html
+++ b/docs/dyn/compute_alpha.images.html
@@ -322,11 +322,12 @@
   "licenses": [ # Any applicable license URI.
     "A String",
   ],
+  "locked": True or False, # A flag for marketplace VM disk created from the image, which is designed for marketplace VM disk to prevent the proprietary data on the disk from being accessed unwantedly. The flag will be inherited by the disk created from the image. The disk with locked flag set to true will be prohibited from performing the operations below: - R/W or R/O disk attach - Disk detach, if disk is created via create-on-create - Create images - Create snapshots - Create disk clone (create disk from the current disk) The image with the locked field set to true will be prohibited from performing the operations below: - Create images from the current image - Update the locked field for the current image The instance with at least one disk with locked flag set to true will be prohibited from performing the operations below: - Secondary disk attach - Create instant snapshot - Create machine images - Create instance template - Delete the instance with --keep-disk parameter set to true
   "name": "A String", # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
   "rawDisk": { # The parameters of the raw disk image.
     "containerType": "A String", # The format used to encode and transmit the block device, which should be TAR. This is just a container and transmission format and not a runtime format. Provided by the client when the disk image is created.
     "sha1Checksum": "A String", # [Deprecated] This field is deprecated. An optional SHA1 checksum of the disk image before unpackaging provided by the client when the disk image is created.
-    "source": "A String", # The full Google Cloud Storage URL where the disk image is stored. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+    "source": "A String", # The full Google Cloud Storage URL where the raw disk image archive is stored. The following are valid formats for the URL: - https://storage.googleapis.com/bucket_name/image_archive_name - https://storage.googleapis.com/bucket_name/folder_name/ image_archive_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   },
   "rolloutOverride": { # A rollout policy configuration. # A rollout policy to apply to this image. When specified, the rollout policy overrides per-zone references to the image via the associated image family. The rollout policy restricts the zones where this image is accessible when using a zonal image family reference. When the rollout policy does not include the user specified zone, or if the zone is rolled out, this image is accessible. The rollout policy for this image is read-only, except for allowlisted users. This field might not be configured. To view the latest non-deprecated image in a specific zone, use the imageFamilyViews.get method.
     "defaultRolloutTime": "A String", # An optional RFC3339 timestamp on or after which the update is considered rolled out to any zone that is not explicitly stated.
@@ -370,7 +371,7 @@
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceDiskId": "A String", # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
-  "sourceImage": "A String", # URL of the source image used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+  "sourceImage": "A String", # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   "sourceImageEncryptionKey": { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
@@ -379,7 +380,7 @@
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceImageId": "A String", # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
-  "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+  "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   "sourceSnapshotEncryptionKey": { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
@@ -457,11 +458,12 @@
   "licenses": [ # Any applicable license URI.
     "A String",
   ],
+  "locked": True or False, # A flag for marketplace VM disk created from the image, which is designed for marketplace VM disk to prevent the proprietary data on the disk from being accessed unwantedly. The flag will be inherited by the disk created from the image. The disk with locked flag set to true will be prohibited from performing the operations below: - R/W or R/O disk attach - Disk detach, if disk is created via create-on-create - Create images - Create snapshots - Create disk clone (create disk from the current disk) The image with the locked field set to true will be prohibited from performing the operations below: - Create images from the current image - Update the locked field for the current image The instance with at least one disk with locked flag set to true will be prohibited from performing the operations below: - Secondary disk attach - Create instant snapshot - Create machine images - Create instance template - Delete the instance with --keep-disk parameter set to true
   "name": "A String", # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
   "rawDisk": { # The parameters of the raw disk image.
     "containerType": "A String", # The format used to encode and transmit the block device, which should be TAR. This is just a container and transmission format and not a runtime format. Provided by the client when the disk image is created.
     "sha1Checksum": "A String", # [Deprecated] This field is deprecated. An optional SHA1 checksum of the disk image before unpackaging provided by the client when the disk image is created.
-    "source": "A String", # The full Google Cloud Storage URL where the disk image is stored. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+    "source": "A String", # The full Google Cloud Storage URL where the raw disk image archive is stored. The following are valid formats for the URL: - https://storage.googleapis.com/bucket_name/image_archive_name - https://storage.googleapis.com/bucket_name/folder_name/ image_archive_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   },
   "rolloutOverride": { # A rollout policy configuration. # A rollout policy to apply to this image. When specified, the rollout policy overrides per-zone references to the image via the associated image family. The rollout policy restricts the zones where this image is accessible when using a zonal image family reference. When the rollout policy does not include the user specified zone, or if the zone is rolled out, this image is accessible. The rollout policy for this image is read-only, except for allowlisted users. This field might not be configured. To view the latest non-deprecated image in a specific zone, use the imageFamilyViews.get method.
     "defaultRolloutTime": "A String", # An optional RFC3339 timestamp on or after which the update is considered rolled out to any zone that is not explicitly stated.
@@ -505,7 +507,7 @@
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceDiskId": "A String", # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
-  "sourceImage": "A String", # URL of the source image used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+  "sourceImage": "A String", # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   "sourceImageEncryptionKey": { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
@@ -514,7 +516,7 @@
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceImageId": "A String", # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
-  "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+  "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   "sourceSnapshotEncryptionKey": { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
@@ -690,11 +692,12 @@
   "licenses": [ # Any applicable license URI.
     "A String",
   ],
+  "locked": True or False, # A flag for marketplace VM disk created from the image, which is designed for marketplace VM disk to prevent the proprietary data on the disk from being accessed unwantedly. The flag will be inherited by the disk created from the image. The disk with locked flag set to true will be prohibited from performing the operations below: - R/W or R/O disk attach - Disk detach, if disk is created via create-on-create - Create images - Create snapshots - Create disk clone (create disk from the current disk) The image with the locked field set to true will be prohibited from performing the operations below: - Create images from the current image - Update the locked field for the current image The instance with at least one disk with locked flag set to true will be prohibited from performing the operations below: - Secondary disk attach - Create instant snapshot - Create machine images - Create instance template - Delete the instance with --keep-disk parameter set to true
   "name": "A String", # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
   "rawDisk": { # The parameters of the raw disk image.
     "containerType": "A String", # The format used to encode and transmit the block device, which should be TAR. This is just a container and transmission format and not a runtime format. Provided by the client when the disk image is created.
     "sha1Checksum": "A String", # [Deprecated] This field is deprecated. An optional SHA1 checksum of the disk image before unpackaging provided by the client when the disk image is created.
-    "source": "A String", # The full Google Cloud Storage URL where the disk image is stored. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+    "source": "A String", # The full Google Cloud Storage URL where the raw disk image archive is stored. The following are valid formats for the URL: - https://storage.googleapis.com/bucket_name/image_archive_name - https://storage.googleapis.com/bucket_name/folder_name/ image_archive_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   },
   "rolloutOverride": { # A rollout policy configuration. # A rollout policy to apply to this image. When specified, the rollout policy overrides per-zone references to the image via the associated image family. The rollout policy restricts the zones where this image is accessible when using a zonal image family reference. When the rollout policy does not include the user specified zone, or if the zone is rolled out, this image is accessible. The rollout policy for this image is read-only, except for allowlisted users. This field might not be configured. To view the latest non-deprecated image in a specific zone, use the imageFamilyViews.get method.
     "defaultRolloutTime": "A String", # An optional RFC3339 timestamp on or after which the update is considered rolled out to any zone that is not explicitly stated.
@@ -738,7 +741,7 @@
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceDiskId": "A String", # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
-  "sourceImage": "A String", # URL of the source image used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+  "sourceImage": "A String", # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   "sourceImageEncryptionKey": { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
@@ -747,7 +750,7 @@
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceImageId": "A String", # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
-  "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+  "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   "sourceSnapshotEncryptionKey": { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
@@ -890,11 +893,12 @@
       "licenses": [ # Any applicable license URI.
         "A String",
       ],
+      "locked": True or False, # A flag for marketplace VM disk created from the image, which is designed for marketplace VM disk to prevent the proprietary data on the disk from being accessed unwantedly. The flag will be inherited by the disk created from the image. The disk with locked flag set to true will be prohibited from performing the operations below: - R/W or R/O disk attach - Disk detach, if disk is created via create-on-create - Create images - Create snapshots - Create disk clone (create disk from the current disk) The image with the locked field set to true will be prohibited from performing the operations below: - Create images from the current image - Update the locked field for the current image The instance with at least one disk with locked flag set to true will be prohibited from performing the operations below: - Secondary disk attach - Create instant snapshot - Create machine images - Create instance template - Delete the instance with --keep-disk parameter set to true
       "name": "A String", # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
       "rawDisk": { # The parameters of the raw disk image.
         "containerType": "A String", # The format used to encode and transmit the block device, which should be TAR. This is just a container and transmission format and not a runtime format. Provided by the client when the disk image is created.
         "sha1Checksum": "A String", # [Deprecated] This field is deprecated. An optional SHA1 checksum of the disk image before unpackaging provided by the client when the disk image is created.
-        "source": "A String", # The full Google Cloud Storage URL where the disk image is stored. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+        "source": "A String", # The full Google Cloud Storage URL where the raw disk image archive is stored. The following are valid formats for the URL: - https://storage.googleapis.com/bucket_name/image_archive_name - https://storage.googleapis.com/bucket_name/folder_name/ image_archive_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
       },
       "rolloutOverride": { # A rollout policy configuration. # A rollout policy to apply to this image. When specified, the rollout policy overrides per-zone references to the image via the associated image family. The rollout policy restricts the zones where this image is accessible when using a zonal image family reference. When the rollout policy does not include the user specified zone, or if the zone is rolled out, this image is accessible. The rollout policy for this image is read-only, except for allowlisted users. This field might not be configured. To view the latest non-deprecated image in a specific zone, use the imageFamilyViews.get method.
         "defaultRolloutTime": "A String", # An optional RFC3339 timestamp on or after which the update is considered rolled out to any zone that is not explicitly stated.
@@ -938,7 +942,7 @@
         "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       "sourceDiskId": "A String", # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
-      "sourceImage": "A String", # URL of the source image used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+      "sourceImage": "A String", # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
       "sourceImageEncryptionKey": { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
         "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
         "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
@@ -947,7 +951,7 @@
         "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       "sourceImageId": "A String", # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
-      "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+      "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
       "sourceSnapshotEncryptionKey": { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
         "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
         "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
@@ -1049,11 +1053,12 @@
   "licenses": [ # Any applicable license URI.
     "A String",
   ],
+  "locked": True or False, # A flag for marketplace VM disk created from the image, which is designed for marketplace VM disk to prevent the proprietary data on the disk from being accessed unwantedly. The flag will be inherited by the disk created from the image. The disk with locked flag set to true will be prohibited from performing the operations below: - R/W or R/O disk attach - Disk detach, if disk is created via create-on-create - Create images - Create snapshots - Create disk clone (create disk from the current disk) The image with the locked field set to true will be prohibited from performing the operations below: - Create images from the current image - Update the locked field for the current image The instance with at least one disk with locked flag set to true will be prohibited from performing the operations below: - Secondary disk attach - Create instant snapshot - Create machine images - Create instance template - Delete the instance with --keep-disk parameter set to true
   "name": "A String", # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
   "rawDisk": { # The parameters of the raw disk image.
     "containerType": "A String", # The format used to encode and transmit the block device, which should be TAR. This is just a container and transmission format and not a runtime format. Provided by the client when the disk image is created.
     "sha1Checksum": "A String", # [Deprecated] This field is deprecated. An optional SHA1 checksum of the disk image before unpackaging provided by the client when the disk image is created.
-    "source": "A String", # The full Google Cloud Storage URL where the disk image is stored. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+    "source": "A String", # The full Google Cloud Storage URL where the raw disk image archive is stored. The following are valid formats for the URL: - https://storage.googleapis.com/bucket_name/image_archive_name - https://storage.googleapis.com/bucket_name/folder_name/ image_archive_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   },
   "rolloutOverride": { # A rollout policy configuration. # A rollout policy to apply to this image. When specified, the rollout policy overrides per-zone references to the image via the associated image family. The rollout policy restricts the zones where this image is accessible when using a zonal image family reference. When the rollout policy does not include the user specified zone, or if the zone is rolled out, this image is accessible. The rollout policy for this image is read-only, except for allowlisted users. This field might not be configured. To view the latest non-deprecated image in a specific zone, use the imageFamilyViews.get method.
     "defaultRolloutTime": "A String", # An optional RFC3339 timestamp on or after which the update is considered rolled out to any zone that is not explicitly stated.
@@ -1097,7 +1102,7 @@
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceDiskId": "A String", # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
-  "sourceImage": "A String", # URL of the source image used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+  "sourceImage": "A String", # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   "sourceImageEncryptionKey": { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
@@ -1106,7 +1111,7 @@
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceImageId": "A String", # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
-  "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+  "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   "sourceSnapshotEncryptionKey": { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.

docs/dyn/compute_alpha.instanceGroupManagers.html

diff --git a/docs/dyn/compute_alpha.instanceGroupManagers.html b/docs/dyn/compute_alpha.instanceGroupManagers.html
index e898b39..c82db92 100644
--- a/docs/dyn/compute_alpha.instanceGroupManagers.html
+++ b/docs/dyn/compute_alpha.instanceGroupManagers.html
@@ -305,7 +305,7 @@
             "suspending": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be suspended or are currently being suspended.
             "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
           },
-          "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+          "description": "A String", # An optional description of this resource.
           "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
             "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
             "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -336,6 +336,9 @@
           "selfLink": "A String", # [Output Only] The URL for this managed instance group. The server defines this URL.
           "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
           "serviceAccount": "A String", # The service account to be used as credentials for all operations performed by the managed instance group on instances. The service accounts needs all permissions required to create and delete instances. By default, the service account {projectNumber}@cloudservices.gserviceaccount.com is used.
+          "standbyPolicy": { # Stanby policy for stopped and suspended instances.
+            "initialDelaySec": 42,
+          },
           "statefulPolicy": { # Stateful configuration for this Instanced Group Manager
             "preservedState": { # Configuration of preserved resources.
               "disks": { # Disks created on the instances that will be preserved on instance delete, update, etc. This map is keyed with the device names of the disks.
@@ -901,7 +904,7 @@
     "suspending": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be suspended or are currently being suspended.
     "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
   },
-  "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+  "description": "A String", # An optional description of this resource.
   "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
     "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
     "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -932,6 +935,9 @@
   "selfLink": "A String", # [Output Only] The URL for this managed instance group. The server defines this URL.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
   "serviceAccount": "A String", # The service account to be used as credentials for all operations performed by the managed instance group on instances. The service accounts needs all permissions required to create and delete instances. By default, the service account {projectNumber}@cloudservices.gserviceaccount.com is used.
+  "standbyPolicy": { # Stanby policy for stopped and suspended instances.
+    "initialDelaySec": 42,
+  },
   "statefulPolicy": { # Stateful configuration for this Instanced Group Manager
     "preservedState": { # Configuration of preserved resources.
       "disks": { # Disks created on the instances that will be preserved on instance delete, update, etc. This map is keyed with the device names of the disks.
@@ -1044,7 +1050,7 @@
     "suspending": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be suspended or are currently being suspended.
     "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
   },
-  "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+  "description": "A String", # An optional description of this resource.
   "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
     "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
     "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -1075,6 +1081,9 @@
   "selfLink": "A String", # [Output Only] The URL for this managed instance group. The server defines this URL.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
   "serviceAccount": "A String", # The service account to be used as credentials for all operations performed by the managed instance group on instances. The service accounts needs all permissions required to create and delete instances. By default, the service account {projectNumber}@cloudservices.gserviceaccount.com is used.
+  "standbyPolicy": { # Stanby policy for stopped and suspended instances.
+    "initialDelaySec": 42,
+  },
   "statefulPolicy": { # Stateful configuration for this Instanced Group Manager
     "preservedState": { # Configuration of preserved resources.
       "disks": { # Disks created on the instances that will be preserved on instance delete, update, etc. This map is keyed with the device names of the disks.
@@ -1256,7 +1265,7 @@
         "suspending": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be suspended or are currently being suspended.
         "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
       },
-      "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+      "description": "A String", # An optional description of this resource.
       "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
         "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
         "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -1287,6 +1296,9 @@
       "selfLink": "A String", # [Output Only] The URL for this managed instance group. The server defines this URL.
       "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
       "serviceAccount": "A String", # The service account to be used as credentials for all operations performed by the managed instance group on instances. The service accounts needs all permissions required to create and delete instances. By default, the service account {projectNumber}@cloudservices.gserviceaccount.com is used.
+      "standbyPolicy": { # Stanby policy for stopped and suspended instances.
+        "initialDelaySec": 42,
+      },
       "statefulPolicy": { # Stateful configuration for this Instanced Group Manager
         "preservedState": { # Configuration of preserved resources.
           "disks": { # Disks created on the instances that will be preserved on instance delete, update, etc. This map is keyed with the device names of the disks.
@@ -1706,7 +1718,7 @@
     "suspending": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be suspended or are currently being suspended.
     "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
   },
-  "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+  "description": "A String", # An optional description of this resource.
   "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
     "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
     "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -1737,6 +1749,9 @@
   "selfLink": "A String", # [Output Only] The URL for this managed instance group. The server defines this URL.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
   "serviceAccount": "A String", # The service account to be used as credentials for all operations performed by the managed instance group on instances. The service accounts needs all permissions required to create and delete instances. By default, the service account {projectNumber}@cloudservices.gserviceaccount.com is used.
+  "standbyPolicy": { # Stanby policy for stopped and suspended instances.
+    "initialDelaySec": 42,
+  },
   "statefulPolicy": { # Stateful configuration for this Instanced Group Manager
     "preservedState": { # Configuration of preserved resources.
       "disks": { # Disks created on the instances that will be preserved on instance delete, update, etc. This map is keyed with the device names of the disks.
@@ -2786,7 +2801,7 @@
     "suspending": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be suspended or are currently being suspended.
     "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
   },
-  "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+  "description": "A String", # An optional description of this resource.
   "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
     "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
     "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -2817,6 +2832,9 @@
   "selfLink": "A String", # [Output Only] The URL for this managed instance group. The server defines this URL.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
   "serviceAccount": "A String", # The service account to be used as credentials for all operations performed by the managed instance group on instances. The service accounts needs all permissions required to create and delete instances. By default, the service account {projectNumber}@cloudservices.gserviceaccount.com is used.
+  "standbyPolicy": { # Stanby policy for stopped and suspended instances.
+    "initialDelaySec": 42,
+  },
   "statefulPolicy": { # Stateful configuration for this Instanced Group Manager
     "preservedState": { # Configuration of preserved resources.
       "disks": { # Disks created on the instances that will be preserved on instance delete, update, etc. This map is keyed with the device names of the disks.

docs/dyn/compute_alpha.instanceTemplates.html

diff --git a/docs/dyn/compute_alpha.instanceTemplates.html b/docs/dyn/compute_alpha.instanceTemplates.html
index ef2d16f..0a02512 100644
--- a/docs/dyn/compute_alpha.instanceTemplates.html
+++ b/docs/dyn/compute_alpha.instanceTemplates.html
@@ -238,6 +238,12 @@
           "labels": { # Labels to apply to this disk. These can be later modified by the disks.setLabels method. This field is only applicable for persistent disks.
             "a_key": "A String",
           },
+          "licenseCodes": [ # Integer license codes indicating which licenses are attached to this disk.
+            "A String",
+          ],
+          "licenses": [ # A list of publicly visible licenses. Reserved for Google's use.
+            "A String",
+          ],
           "multiWriter": True or False, # Indicates whether or not the disk can be read/write attached to more than one instance.
           "onUpdateAction": "A String", # Specifies which action to take on instance update with this disk. Default is to use the existing disk.
           "provisionedIops": "A String", # Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be between 10,000 and 120,000. For more details, see the Extreme persistent disk documentation.
@@ -635,6 +641,12 @@
           "labels": { # Labels to apply to this disk. These can be later modified by the disks.setLabels method. This field is only applicable for persistent disks.
             "a_key": "A String",
           },
+          "licenseCodes": [ # Integer license codes indicating which licenses are attached to this disk.
+            "A String",
+          ],
+          "licenses": [ # A list of publicly visible licenses. Reserved for Google's use.
+            "A String",
+          ],
           "multiWriter": True or False, # Indicates whether or not the disk can be read/write attached to more than one instance.
           "onUpdateAction": "A String", # Specifies which action to take on instance update with this disk. Default is to use the existing disk.
           "provisionedIops": "A String", # Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be between 10,000 and 120,000. For more details, see the Extreme persistent disk documentation.
@@ -997,6 +1009,12 @@
               "labels": { # Labels to apply to this disk. These can be later modified by the disks.setLabels method. This field is only applicable for persistent disks.
                 "a_key": "A String",
               },
+              "licenseCodes": [ # Integer license codes indicating which licenses are attached to this disk.
+                "A String",
+              ],
+              "licenses": [ # A list of publicly visible licenses. Reserved for Google's use.
+                "A String",
+              ],
               "multiWriter": True or False, # Indicates whether or not the disk can be read/write attached to more than one instance.
               "onUpdateAction": "A String", # Specifies which action to take on instance update with this disk. Default is to use the existing disk.
               "provisionedIops": "A String", # Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be between 10,000 and 120,000. For more details, see the Extreme persistent disk documentation.

docs/dyn/compute_alpha.instances.html

diff --git a/docs/dyn/compute_alpha.instances.html b/docs/dyn/compute_alpha.instances.html
index 5298140..8588b3b 100644
--- a/docs/dyn/compute_alpha.instances.html
+++ b/docs/dyn/compute_alpha.instances.html
@@ -129,7 +129,7 @@
   <code><a href="#getShieldedVmIdentity">getShieldedVmIdentity(project, zone, instance, x__xgafv=None)</a></code></p>
 <p class="firstline">Returns the Shielded VM Identity of an instance</p>
 <p class="toc_element">
-  <code><a href="#insert">insert(project, zone, body=None, requestId=None, secureTags=None, sourceInstanceTemplate=None, sourceMachineImage=None, x__xgafv=None)</a></code></p>
+  <code><a href="#insert">insert(project, zone, body=None, requestId=None, sourceInstanceTemplate=None, sourceMachineImage=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Creates an instance resource in the specified project using the data included in the request.</p>
 <p class="toc_element">
   <code><a href="#list">list(project, zone, filter=None, maxResults=None, orderBy=None, pageToken=None, returnPartialSuccess=None, x__xgafv=None)</a></code></p>
@@ -219,7 +219,7 @@
   <code><a href="#testIamPermissions">testIamPermissions(project, zone, resource, body=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Returns permissions that a caller has on the specified resource.</p>
 <p class="toc_element">
-  <code><a href="#update">update(project, zone, instance, body=None, clearSecureTag=None, minimalAction=None, mostDisruptiveAllowedAction=None, requestId=None, secureTags=None, x__xgafv=None)</a></code></p>
+  <code><a href="#update">update(project, zone, instance, body=None, clearSecureTag=None, minimalAction=None, mostDisruptiveAllowedAction=None, requestId=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Updates an instance only if the necessary resources are available. This method can update only a specific set of instance properties. See Updating a running instance for a list of updatable instance properties.</p>
 <p class="toc_element">
   <code><a href="#updateAccessConfig">updateAccessConfig(project, zone, instance, networkInterface, body=None, requestId=None, x__xgafv=None)</a></code></p>
@@ -468,6 +468,12 @@
                 &quot;labels&quot;: { # Labels to apply to this disk. These can be later modified by the disks.setLabels method. This field is only applicable for persistent disks.
                   &quot;a_key&quot;: &quot;A String&quot;,
                 },
+                &quot;licenseCodes&quot;: [ # Integer license codes indicating which licenses are attached to this disk.
+                  &quot;A String&quot;,
+                ],
+                &quot;licenses&quot;: [ # A list of publicly visible licenses. Reserved for Google&#x27;s use.
+                  &quot;A String&quot;,
+                ],
                 &quot;multiWriter&quot;: True or False, # Indicates whether or not the disk can be read/write attached to more than one instance.
                 &quot;onUpdateAction&quot;: &quot;A String&quot;, # Specifies which action to take on instance update with this disk. Default is to use the existing disk.
                 &quot;provisionedIops&quot;: &quot;A String&quot;, # Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be between 10,000 and 120,000. For more details, see the Extreme persistent disk documentation.
@@ -830,6 +836,12 @@
     &quot;labels&quot;: { # Labels to apply to this disk. These can be later modified by the disks.setLabels method. This field is only applicable for persistent disks.
       &quot;a_key&quot;: &quot;A String&quot;,
     },
+    &quot;licenseCodes&quot;: [ # Integer license codes indicating which licenses are attached to this disk.
+      &quot;A String&quot;,
+    ],
+    &quot;licenses&quot;: [ # A list of publicly visible licenses. Reserved for Google&#x27;s use.
+      &quot;A String&quot;,
+    ],
     &quot;multiWriter&quot;: True or False, # Indicates whether or not the disk can be read/write attached to more than one instance.
     &quot;onUpdateAction&quot;: &quot;A String&quot;, # Specifies which action to take on instance update with this disk. Default is to use the existing disk.
     &quot;provisionedIops&quot;: &quot;A String&quot;, # Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be between 10,000 and 120,000. For more details, see the Extreme persistent disk documentation.
@@ -1013,6 +1025,12 @@
           &quot;labels&quot;: { # Labels to apply to this disk. These can be later modified by the disks.setLabels method. This field is only applicable for persistent disks.
             &quot;a_key&quot;: &quot;A String&quot;,
           },
+          &quot;licenseCodes&quot;: [ # Integer license codes indicating which licenses are attached to this disk.
+            &quot;A String&quot;,
+          ],
+          &quot;licenses&quot;: [ # A list of publicly visible licenses. Reserved for Google&#x27;s use.
+            &quot;A String&quot;,
+          ],
           &quot;multiWriter&quot;: True or False, # Indicates whether or not the disk can be read/write attached to more than one instance.
           &quot;onUpdateAction&quot;: &quot;A String&quot;, # Specifies which action to take on instance update with this disk. Default is to use the existing disk.
           &quot;provisionedIops&quot;: &quot;A String&quot;, # Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be between 10,000 and 120,000. For more details, see the Extreme persistent disk documentation.
@@ -1331,6 +1349,12 @@
           &quot;labels&quot;: { # Labels to apply to this disk. These can be later modified by the disks.setLabels method. This field is only applicable for persistent disks.
             &quot;a_key&quot;: &quot;A String&quot;,
           },
+          &quot;licenseCodes&quot;: [ # Integer license codes indicating which licenses are attached to this disk.
+            &quot;A String&quot;,
+          ],
+          &quot;licenses&quot;: [ # A list of publicly visible licenses. Reserved for Google&#x27;s use.
+            &quot;A String&quot;,
+          ],
           &quot;multiWriter&quot;: True or False, # Indicates whether or not the disk can be read/write attached to more than one instance.
           &quot;onUpdateAction&quot;: &quot;A String&quot;, # Specifies which action to take on instance update with this disk. Default is to use the existing disk.
           &quot;provisionedIops&quot;: &quot;A String&quot;, # Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be between 10,000 and 120,000. For more details, see the Extreme persistent disk documentation.
@@ -1562,12 +1586,6 @@
       &quot;name&quot;: &quot;A String&quot;, # This field is only temporary. It will be removed. Do not use it.
     },
   },
-  &quot;predefinedNames&quot;: [ # DEPRECATED: Please use per_instance_properties instead.
-    &quot;A String&quot;,
-  ],
-  &quot;secureTags&quot;: [ # DEPRECATED: Please use instance_properties.secure_tag instead. Secure tags to apply to this instance. These can be later modified by the update method. Maximum number of secure tags allowed is 50.
-    &quot;A String&quot;,
-  ],
   &quot;sourceInstanceTemplate&quot;: &quot;A String&quot;, # Specifies the instance template from which to create instances. You may combine sourceInstanceTemplate with instanceProperties to override specific values from an existing instance template. Bulk API follows the semantics of JSON Merge Patch described by RFC 7396. It can be a full or partial URL. For example, the following are all valid URLs to an instance template: - https://www.googleapis.com/compute/v1/projects/project /global/instanceTemplates/instanceTemplate - projects/project/global/instanceTemplates/instanceTemplate - global/instanceTemplates/instanceTemplate This field is optional.
 }
 
@@ -1896,6 +1914,12 @@
         &quot;labels&quot;: { # Labels to apply to this disk. These can be later modified by the disks.setLabels method. This field is only applicable for persistent disks.
           &quot;a_key&quot;: &quot;A String&quot;,
         },
+        &quot;licenseCodes&quot;: [ # Integer license codes indicating which licenses are attached to this disk.
+          &quot;A String&quot;,
+        ],
+        &quot;licenses&quot;: [ # A list of publicly visible licenses. Reserved for Google&#x27;s use.
+          &quot;A String&quot;,
+        ],
         &quot;multiWriter&quot;: True or False, # Indicates whether or not the disk can be read/write attached to more than one instance.
         &quot;onUpdateAction&quot;: &quot;A String&quot;, # Specifies which action to take on instance update with this disk. Default is to use the existing disk.
         &quot;provisionedIops&quot;: &quot;A String&quot;, # Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be between 10,000 and 120,000. For more details, see the Extreme persistent disk documentation.
@@ -2201,7 +2225,7 @@
           &quot;enableLogging&quot;: True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on &quot;goto_next&quot; rules.
           &quot;kind&quot;: &quot;compute#firewallPolicyRule&quot;, # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
           &quot;match&quot;: { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding &#x27;action&#x27; is enforced.
-            &quot;destIpRanges&quot;: [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+            &quot;destIpRanges&quot;: [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
               &quot;A String&quot;,
             ],
             &quot;layer4Configs&quot;: [ # Pairs of IP protocols and ports that the rule should match.
@@ -2212,7 +2236,7 @@
                 ],
               },
             ],
-            &quot;srcIpRanges&quot;: [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+            &quot;srcIpRanges&quot;: [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
               &quot;A String&quot;,
             ],
             &quot;srcSecureTags&quot;: [ # List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256.
@@ -2262,7 +2286,7 @@
         },
       ],
       &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
-      &quot;destinationRanges&quot;: [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Only IPv4 is supported.
+      &quot;destinationRanges&quot;: [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Both IPv4 and IPv6 are supported.
         &quot;A String&quot;,
       ],
       &quot;direction&quot;: &quot;A String&quot;, # Direction of traffic to which this firewall applies, either `INGRESS` or `EGRESS`. The default is `INGRESS`. For `INGRESS` traffic, you cannot specify the destinationRanges field, and for `EGRESS` traffic, you cannot specify the sourceRanges or sourceTags fields.
@@ -2279,7 +2303,7 @@
       &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
       &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
-      &quot;sourceRanges&quot;: [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Only IPv4 is supported.
+      &quot;sourceRanges&quot;: [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Both IPv4 and IPv6 are supported.
         &quot;A String&quot;,
       ],
       &quot;sourceServiceAccounts&quot;: [ # If source service accounts are specified, the firewall rules apply only to traffic originating from an instance with a service account in this list. Source service accounts cannot be used to control traffic to an instance&#x27;s external IP address because service accounts are associated with an instance, not an IP address. sourceRanges can be set at the same time as sourceServiceAccounts. If both are set, the firewall applies to traffic that has a source IP address within the sourceRanges OR a source IP that belongs to an instance with service account listed in sourceServiceAccount. The connection does not need to match both fields for the firewall to apply. sourceServiceAccounts cannot be used at the same time as sourceTags or targetTags.
@@ -2356,7 +2380,8 @@
               &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
             },
             &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-            &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+            &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+            &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
             &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
             &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
               &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -2640,7 +2665,7 @@
 </div>
 
 <div class="method">
-    <code class="details" id="insert">insert(project, zone, body=None, requestId=None, secureTags=None, sourceInstanceTemplate=None, sourceMachineImage=None, x__xgafv=None)</code>
+    <code class="details" id="insert">insert(project, zone, body=None, requestId=None, sourceInstanceTemplate=None, sourceMachineImage=None, x__xgafv=None)</code>
   <pre>Creates an instance resource in the specified project using the data included in the request.
 
 Args:
@@ -2698,6 +2723,12 @@
         &quot;labels&quot;: { # Labels to apply to this disk. These can be later modified by the disks.setLabels method. This field is only applicable for persistent disks.
           &quot;a_key&quot;: &quot;A String&quot;,
         },
+        &quot;licenseCodes&quot;: [ # Integer license codes indicating which licenses are attached to this disk.
+          &quot;A String&quot;,
+        ],
+        &quot;licenses&quot;: [ # A list of publicly visible licenses. Reserved for Google&#x27;s use.
+          &quot;A String&quot;,
+        ],
         &quot;multiWriter&quot;: True or False, # Indicates whether or not the disk can be read/write attached to more than one instance.
         &quot;onUpdateAction&quot;: &quot;A String&quot;, # Specifies which action to take on instance update with this disk. Default is to use the existing disk.
         &quot;provisionedIops&quot;: &quot;A String&quot;, # Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be between 10,000 and 120,000. For more details, see the Extreme persistent disk documentation.
@@ -2972,7 +3003,6 @@
 }
 
   requestId: string, An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported ( 00000000-0000-0000-0000-000000000000).
-  secureTags: string, DEPRECATED: Please use resource.secure_tag instead. Secure tags to apply to this instance. These can be later modified by the update method. Maximum number of secure tags allowed is 50. (repeated)
   sourceInstanceTemplate: string, Specifies instance template to create the instance. This field is optional. It can be a full or partial URL. For example, the following are all valid URLs to an instance template: - https://www.googleapis.com/compute/v1/projects/project /global/instanceTemplates/instanceTemplate - projects/project/global/instanceTemplates/instanceTemplate - global/instanceTemplates/instanceTemplate 
   sourceMachineImage: string, Specifies the machine image to use to create the instance. This field is optional. It can be a full or partial URL. For example, the following are all valid URLs to a machine image: - https://www.googleapis.com/compute/v1/projects/project/global/global /machineImages/machineImage - projects/project/global/global/machineImages/machineImage - global/machineImages/machineImage 
   x__xgafv: string, V1 error format.
@@ -3103,6 +3133,12 @@
             &quot;labels&quot;: { # Labels to apply to this disk. These can be later modified by the disks.setLabels method. This field is only applicable for persistent disks.
               &quot;a_key&quot;: &quot;A String&quot;,
             },
+            &quot;licenseCodes&quot;: [ # Integer license codes indicating which licenses are attached to this disk.
+              &quot;A String&quot;,
+            ],
+            &quot;licenses&quot;: [ # A list of publicly visible licenses. Reserved for Google&#x27;s use.
+              &quot;A String&quot;,
+            ],
             &quot;multiWriter&quot;: True or False, # Indicates whether or not the disk can be read/write attached to more than one instance.
             &quot;onUpdateAction&quot;: &quot;A String&quot;, # Specifies which action to take on instance update with this disk. Default is to use the existing disk.
             &quot;provisionedIops&quot;: &quot;A String&quot;, # Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be between 10,000 and 120,000. For more details, see the Extreme persistent disk documentation.
@@ -5340,7 +5376,7 @@
 </div>
 
 <div class="method">
-    <code class="details" id="update">update(project, zone, instance, body=None, clearSecureTag=None, minimalAction=None, mostDisruptiveAllowedAction=None, requestId=None, secureTags=None, x__xgafv=None)</code>
+    <code class="details" id="update">update(project, zone, instance, body=None, clearSecureTag=None, minimalAction=None, mostDisruptiveAllowedAction=None, requestId=None, x__xgafv=None)</code>
   <pre>Updates an instance only if the necessary resources are available. This method can update only a specific set of instance properties. See Updating a running instance for a list of updatable instance properties.
 
 Args:
@@ -5399,6 +5435,12 @@
         &quot;labels&quot;: { # Labels to apply to this disk. These can be later modified by the disks.setLabels method. This field is only applicable for persistent disks.
           &quot;a_key&quot;: &quot;A String&quot;,
         },
+        &quot;licenseCodes&quot;: [ # Integer license codes indicating which licenses are attached to this disk.
+          &quot;A String&quot;,
+        ],
+        &quot;licenses&quot;: [ # A list of publicly visible licenses. Reserved for Google&#x27;s use.
+          &quot;A String&quot;,
+        ],
         &quot;multiWriter&quot;: True or False, # Indicates whether or not the disk can be read/write attached to more than one instance.
         &quot;onUpdateAction&quot;: &quot;A String&quot;, # Specifies which action to take on instance update with this disk. Default is to use the existing disk.
         &quot;provisionedIops&quot;: &quot;A String&quot;, # Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be between 10,000 and 120,000. For more details, see the Extreme persistent disk documentation.
@@ -5686,7 +5728,6 @@
       REFRESH - The instance will not restart.
       RESTART - The instance will restart.
   requestId: string, An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported ( 00000000-0000-0000-0000-000000000000).
-  secureTags: string, DEPRECATED: Please use resource.secure_tag instead. Secure tags to apply to this instance. Maximum number of secure tags allowed is 50. (repeated)
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format

docs/dyn/compute_alpha.interconnects.html

diff --git a/docs/dyn/compute_alpha.interconnects.html b/docs/dyn/compute_alpha.interconnects.html
index 1094d66..8182098 100644
--- a/docs/dyn/compute_alpha.interconnects.html
+++ b/docs/dyn/compute_alpha.interconnects.html
@@ -90,6 +90,9 @@
   <code><a href="#getIamPolicy">getIamPolicy(project, resource, optionsRequestedPolicyVersion=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Gets the access control policy for a resource. May be empty if no such policy or resource exists.</p>
 <p class="toc_element">
+  <code><a href="#getMacsecConfig">getMacsecConfig(project, interconnect, x__xgafv=None)</a></code></p>
+<p class="firstline">Returns the interconnectMacsecConfig for the specified interconnect.</p>
+<p class="toc_element">
   <code><a href="#insert">insert(project, body=None, requestId=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Creates a Interconnect in the specified project using the data included in the request.</p>
 <p class="toc_element">
@@ -296,6 +299,10 @@
           &quot;neighborSystemId&quot;: &quot;A String&quot;, # System ID of the port on the neighbor&#x27;s side of the LACP exchange.
           &quot;state&quot;: &quot;A String&quot;, # The state of a LACP link, which can take one of the following values: - ACTIVE: The link is configured and active within the bundle. - DETACHED: The link is not configured within the bundle. This means that the rest of the object should be empty.
         },
+        &quot;macsec&quot;: { # Describes the status of MACsec encryption on the link. # Describes the status of MACsec encryption on this link.
+          &quot;ckn&quot;: &quot;A String&quot;, # Indicates the Connectivity Association Key Name (CKN) currently being used if MACsec is operational.
+          &quot;operational&quot;: True or False, # Indicates whether or not MACsec is operational on this link.
+        },
         &quot;receivingOpticalPower&quot;: { # An InterconnectDiagnostics.LinkOpticalPower object, describing the current value and status of the received light level.
           &quot;state&quot;: &quot;A String&quot;, # The status of the current value when compared to the warning and alarm levels for the receiving or transmitting transceiver. Possible states include: - OK: The value has not crossed a warning threshold. - LOW_WARNING: The value has crossed below the low warning threshold. - HIGH_WARNING: The value has crossed above the high warning threshold. - LOW_ALARM: The value has crossed below the low alarm threshold. - HIGH_ALARM: The value has crossed above the high alarm threshold.
           &quot;value&quot;: 3.14, # Value of the current receiving or transmitting optical power, read in dBm. Take a known good optical value, give it a 10% margin and trigger warnings relative to that value. In general, a -7dBm warning and a -11dBm alarm are good optical value estimates for most links.
@@ -307,12 +314,6 @@
       },
     ],
     &quot;macAddress&quot;: &quot;A String&quot;, # The MAC address of the Interconnect&#x27;s bundle interface.
-    &quot;macsec&quot;: { # Describes the status of MACsec encryption on the Interconnect&#x27;s bundle interface. # Describes the status of MACsec encryption on the Interconnect&#x27;s bundle interface.
-      &quot;ckn&quot;: &quot;A String&quot;, # Indicates the Connectivity Association Key Name (CKN) currently being used.
-      &quot;keyRolloverFailure&quot;: True or False, # If true, this field indicates that the Google edge router was unable to rollover the MACsec session to the next key in the key chain. Ensure that the CKN/CAK values and the start time of the keys in your router&#x27;s MACsec key chain match the output of the GetMacsecConfig API for this Interconnect. The Google edge router will retry the rollover process for grace period of 30 minutes past the start time of the new key, while maintaining the ongoing MACsec session. If the Google edge router is unable to switch to the new key within this grace period, it will terminate the MACsec session. Subsequent behavior will depend on the MACsec fail open setting on this Interconnect.
-      &quot;rolloverCkn&quot;: &quot;A String&quot;, # In the event of a key rollover failure, this field indicates the CKN that the Google edge router is trying to rollover to.
-      &quot;state&quot;: &quot;A String&quot;, # The current state of MACsec configuration on this Interconnect, which can take one of the following values: - INITIALIZED: MACsec has been configured on the bundle interface. The Google edge router is waiting to establish a MACsec session with the customer router on the other side of this Interconnect. In addition, when key rollover fails between the two routers, the bundle interface will return to the initialized state. - SECURED: MACsec session has been successfully established between the Google edge router and the customer router. - FAILED: MACsec configuration on the bundle interface encountered an error. - DISABLED: MACsec is explicitly disabled on this Interconnect.
-    },
   },
 }</pre>
 </div>
@@ -422,6 +423,36 @@
 </div>
 
 <div class="method">
+    <code class="details" id="getMacsecConfig">getMacsecConfig(project, interconnect, x__xgafv=None)</code>
+  <pre>Returns the interconnectMacsecConfig for the specified interconnect.
+
+Args:
+  project: string, Project ID for this request. (required)
+  interconnect: string, Name of the interconnect resource to query. (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response for the InterconnectsGetMacsecConfigRequest.
+  &quot;etag&quot;: &quot;A String&quot;, # end_interface: MixerGetResponseWithEtagBuilder
+  &quot;result&quot;: { # MACsec configuration information for the Interconnect. Contains the generated Connectivity Association Key Name (CKN) and the key (CAK) for this Interconnect.
+    &quot;preSharedKeys&quot;: [ # A keychain placeholder describing a set of named key objects along with their start times. A MACsec CKN/CAK will be generated for each key in the key chain. Google router will automatically pick the key with the most recent startTime when establishing or re-establishing a MACsec secure link.
+      { # Describes a pre-shared key used to setup MACsec in static connectivity association key (CAK) mode.
+        &quot;cak&quot;: &quot;A String&quot;, # An auto-generated Connectivity Association Key (CAK) for this key.
+        &quot;ckn&quot;: &quot;A String&quot;, # An auto-generated Connectivity Association Key Name (CKN) for this key.
+        &quot;name&quot;: &quot;A String&quot;, # User provided name for this pre-shared key.
+        &quot;startTime&quot;: &quot;A String&quot;, # User provided timestamp on or after which this key is valid.
+      },
+    ],
+  },
+}</pre>
+</div>
+
+<div class="method">
     <code class="details" id="insert">insert(project, body=None, requestId=None, x__xgafv=None)</code>
   <pre>Creates a Interconnect in the specified project using the data included in the request.
 

docs/dyn/compute_alpha.networkFirewallPolicies.html

diff --git a/docs/dyn/compute_alpha.networkFirewallPolicies.html b/docs/dyn/compute_alpha.networkFirewallPolicies.html
index f8f5af2..b72712f 100644
--- a/docs/dyn/compute_alpha.networkFirewallPolicies.html
+++ b/docs/dyn/compute_alpha.networkFirewallPolicies.html
@@ -223,7 +223,7 @@
   "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
   "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
   "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
       "A String",
     ],
     "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -234,7 +234,7 @@
         ],
       },
     ],
-    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
       "A String",
     ],
     "srcSecureTags": [ # List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256.
@@ -497,7 +497,7 @@
       "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
       "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
       "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
           "A String",
         ],
         "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -508,7 +508,7 @@
             ],
           },
         ],
-        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
           "A String",
         ],
         "srcSecureTags": [ # List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256.
@@ -693,7 +693,7 @@
   "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
   "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
   "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
       "A String",
     ],
     "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -704,7 +704,7 @@
         ],
       },
     ],
-    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
       "A String",
     ],
     "srcSecureTags": [ # List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256.
@@ -769,7 +769,7 @@
       "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
       "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
       "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
           "A String",
         ],
         "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -780,7 +780,7 @@
             ],
           },
         ],
-        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
           "A String",
         ],
         "srcSecureTags": [ # List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256.
@@ -919,7 +919,7 @@
           "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
           "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
           "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-            "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+            "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
               "A String",
             ],
             "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -930,7 +930,7 @@
                 ],
               },
             ],
-            "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+            "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
               "A String",
             ],
             "srcSecureTags": [ # List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256.
@@ -1029,7 +1029,7 @@
       "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
       "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
       "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
           "A String",
         ],
         "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -1040,7 +1040,7 @@
             ],
           },
         ],
-        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
           "A String",
         ],
         "srcSecureTags": [ # List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256.
@@ -1146,7 +1146,7 @@
   "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
   "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
   "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
       "A String",
     ],
     "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -1157,7 +1157,7 @@
         ],
       },
     ],
-    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
       "A String",
     ],
     "srcSecureTags": [ # List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256.

docs/dyn/compute_alpha.networks.html

diff --git a/docs/dyn/compute_alpha.networks.html b/docs/dyn/compute_alpha.networks.html
index 1ef3452..98569b4 100644
--- a/docs/dyn/compute_alpha.networks.html
+++ b/docs/dyn/compute_alpha.networks.html
@@ -130,7 +130,7 @@
 <p class="firstline">Returns permissions that a caller has on the specified resource.</p>
 <p class="toc_element">
   <code><a href="#updatePeering">updatePeering(project, network, body=None, requestId=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Updates the specified network peering with the data included in the request Only the following fields can be modified: NetworkPeering.export_custom_routes, and NetworkPeering.import_custom_routes</p>
+<p class="firstline">Updates the specified network peering with the data included in the request. You can only modify the NetworkPeering.export_custom_routes field and the NetworkPeering.import_custom_routes field.</p>
 <h3>Method Details</h3>
 <div class="method">
     <code class="details" id="addPeering">addPeering(project, network, body=None, requestId=None, x__xgafv=None)</code>
@@ -152,9 +152,9 @@
     &quot;autoCreateRoutes&quot;: True or False, # This field will be deprecated soon. Use the exchange_subnet_routes field instead. Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
     &quot;exchangeSubnetRoutes&quot;: True or False, # Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
     &quot;exportCustomRoutes&quot;: True or False, # Whether to export the custom routes to peer network.
-    &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always exported to peers and are not controlled by this field.
+    &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. IPv4 special-use ranges are always exported to peers and are not controlled by this field.
     &quot;importCustomRoutes&quot;: True or False, # Whether to import the custom routes from peer network.
-    &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always imported from peers and are not controlled by this field.
+    &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. IPv4 special-use ranges are always imported from peers and are not controlled by this field.
     &quot;name&quot;: &quot;A String&quot;, # Name of this peering. Provided by the client when the peering is created. The name must comply with RFC1035. Specifically, the name must be 1-63 characters long and match regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all the following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
     &quot;network&quot;: &quot;A String&quot;, # The URL of the peer network. It can be either full URL or partial URL. The peer network may belong to a different project. If the partial URL does not contain project, it is assumed that the peer network is in the same project as the current network.
     &quot;peerMtu&quot;: 42, # Maximum Transmission Unit in bytes.
@@ -322,9 +322,9 @@
       &quot;autoCreateRoutes&quot;: True or False, # This field will be deprecated soon. Use the exchange_subnet_routes field instead. Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
       &quot;exchangeSubnetRoutes&quot;: True or False, # Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
       &quot;exportCustomRoutes&quot;: True or False, # Whether to export the custom routes to peer network.
-      &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always exported to peers and are not controlled by this field.
+      &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. IPv4 special-use ranges are always exported to peers and are not controlled by this field.
       &quot;importCustomRoutes&quot;: True or False, # Whether to import the custom routes from peer network.
-      &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always imported from peers and are not controlled by this field.
+      &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. IPv4 special-use ranges are always imported from peers and are not controlled by this field.
       &quot;name&quot;: &quot;A String&quot;, # Name of this peering. Provided by the client when the peering is created. The name must comply with RFC1035. Specifically, the name must be 1-63 characters long and match regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all the following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
       &quot;network&quot;: &quot;A String&quot;, # The URL of the peer network. It can be either full URL or partial URL. The peer network may belong to a different project. If the partial URL does not contain project, it is assumed that the peer network is in the same project as the current network.
       &quot;peerMtu&quot;: 42, # Maximum Transmission Unit in bytes.
@@ -372,7 +372,7 @@
           &quot;enableLogging&quot;: True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on &quot;goto_next&quot; rules.
           &quot;kind&quot;: &quot;compute#firewallPolicyRule&quot;, # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
           &quot;match&quot;: { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding &#x27;action&#x27; is enforced.
-            &quot;destIpRanges&quot;: [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+            &quot;destIpRanges&quot;: [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
               &quot;A String&quot;,
             ],
             &quot;layer4Configs&quot;: [ # Pairs of IP protocols and ports that the rule should match.
@@ -383,7 +383,7 @@
                 ],
               },
             ],
-            &quot;srcIpRanges&quot;: [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+            &quot;srcIpRanges&quot;: [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
               &quot;A String&quot;,
             ],
             &quot;srcSecureTags&quot;: [ # List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256.
@@ -433,7 +433,7 @@
         },
       ],
       &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
-      &quot;destinationRanges&quot;: [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Only IPv4 is supported.
+      &quot;destinationRanges&quot;: [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Both IPv4 and IPv6 are supported.
         &quot;A String&quot;,
       ],
       &quot;direction&quot;: &quot;A String&quot;, # Direction of traffic to which this firewall applies, either `INGRESS` or `EGRESS`. The default is `INGRESS`. For `INGRESS` traffic, you cannot specify the destinationRanges field, and for `EGRESS` traffic, you cannot specify the sourceRanges or sourceTags fields.
@@ -450,7 +450,7 @@
       &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
       &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
-      &quot;sourceRanges&quot;: [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Only IPv4 is supported.
+      &quot;sourceRanges&quot;: [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Both IPv4 and IPv6 are supported.
         &quot;A String&quot;,
       ],
       &quot;sourceServiceAccounts&quot;: [ # If source service accounts are specified, the firewall rules apply only to traffic originating from an instance with a service account in this list. Source service accounts cannot be used to control traffic to an instance&#x27;s external IP address because service accounts are associated with an instance, not an IP address. sourceRanges can be set at the same time as sourceServiceAccounts. If both are set, the firewall applies to traffic that has a source IP address within the sourceRanges OR a source IP that belongs to an instance with service account listed in sourceServiceAccount. The connection does not need to match both fields for the firewall to apply. sourceServiceAccounts cannot be used at the same time as sourceTags or targetTags.
@@ -527,7 +527,8 @@
               &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
             },
             &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-            &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+            &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+            &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
             &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
             &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
               &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -580,9 +581,9 @@
       &quot;autoCreateRoutes&quot;: True or False, # This field will be deprecated soon. Use the exchange_subnet_routes field instead. Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
       &quot;exchangeSubnetRoutes&quot;: True or False, # Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
       &quot;exportCustomRoutes&quot;: True or False, # Whether to export the custom routes to peer network.
-      &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always exported to peers and are not controlled by this field.
+      &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. IPv4 special-use ranges are always exported to peers and are not controlled by this field.
       &quot;importCustomRoutes&quot;: True or False, # Whether to import the custom routes from peer network.
-      &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always imported from peers and are not controlled by this field.
+      &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. IPv4 special-use ranges are always imported from peers and are not controlled by this field.
       &quot;name&quot;: &quot;A String&quot;, # Name of this peering. Provided by the client when the peering is created. The name must comply with RFC1035. Specifically, the name must be 1-63 characters long and match regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all the following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
       &quot;network&quot;: &quot;A String&quot;, # The URL of the peer network. It can be either full URL or partial URL. The peer network may belong to a different project. If the partial URL does not contain project, it is assumed that the peer network is in the same project as the current network.
       &quot;peerMtu&quot;: 42, # Maximum Transmission Unit in bytes.
@@ -696,9 +697,9 @@
           &quot;autoCreateRoutes&quot;: True or False, # This field will be deprecated soon. Use the exchange_subnet_routes field instead. Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
           &quot;exchangeSubnetRoutes&quot;: True or False, # Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
           &quot;exportCustomRoutes&quot;: True or False, # Whether to export the custom routes to peer network.
-          &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always exported to peers and are not controlled by this field.
+          &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. IPv4 special-use ranges are always exported to peers and are not controlled by this field.
           &quot;importCustomRoutes&quot;: True or False, # Whether to import the custom routes from peer network.
-          &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always imported from peers and are not controlled by this field.
+          &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. IPv4 special-use ranges are always imported from peers and are not controlled by this field.
           &quot;name&quot;: &quot;A String&quot;, # Name of this peering. Provided by the client when the peering is created. The name must comply with RFC1035. Specifically, the name must be 1-63 characters long and match regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all the following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
           &quot;network&quot;: &quot;A String&quot;, # The URL of the peer network. It can be either full URL or partial URL. The peer network may belong to a different project. If the partial URL does not contain project, it is assumed that the peer network is in the same project as the current network.
           &quot;peerMtu&quot;: 42, # Maximum Transmission Unit in bytes.
@@ -968,9 +969,9 @@
       &quot;autoCreateRoutes&quot;: True or False, # This field will be deprecated soon. Use the exchange_subnet_routes field instead. Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
       &quot;exchangeSubnetRoutes&quot;: True or False, # Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
       &quot;exportCustomRoutes&quot;: True or False, # Whether to export the custom routes to peer network.
-      &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always exported to peers and are not controlled by this field.
+      &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. IPv4 special-use ranges are always exported to peers and are not controlled by this field.
       &quot;importCustomRoutes&quot;: True or False, # Whether to import the custom routes from peer network.
-      &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always imported from peers and are not controlled by this field.
+      &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. IPv4 special-use ranges are always imported from peers and are not controlled by this field.
       &quot;name&quot;: &quot;A String&quot;, # Name of this peering. Provided by the client when the peering is created. The name must comply with RFC1035. Specifically, the name must be 1-63 characters long and match regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all the following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
       &quot;network&quot;: &quot;A String&quot;, # The URL of the peer network. It can be either full URL or partial URL. The peer network may belong to a different project. If the partial URL does not contain project, it is assumed that the peer network is in the same project as the current network.
       &quot;peerMtu&quot;: 42, # Maximum Transmission Unit in bytes.
@@ -1213,7 +1214,7 @@
 
 <div class="method">
     <code class="details" id="updatePeering">updatePeering(project, network, body=None, requestId=None, x__xgafv=None)</code>
-  <pre>Updates the specified network peering with the data included in the request Only the following fields can be modified: NetworkPeering.export_custom_routes, and NetworkPeering.import_custom_routes
+  <pre>Updates the specified network peering with the data included in the request. You can only modify the NetworkPeering.export_custom_routes field and the NetworkPeering.import_custom_routes field.
 
 Args:
   project: string, Project ID for this request. (required)
@@ -1227,9 +1228,9 @@
     &quot;autoCreateRoutes&quot;: True or False, # This field will be deprecated soon. Use the exchange_subnet_routes field instead. Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
     &quot;exchangeSubnetRoutes&quot;: True or False, # Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
     &quot;exportCustomRoutes&quot;: True or False, # Whether to export the custom routes to peer network.
-    &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always exported to peers and are not controlled by this field.
+    &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. IPv4 special-use ranges are always exported to peers and are not controlled by this field.
     &quot;importCustomRoutes&quot;: True or False, # Whether to import the custom routes from peer network.
-    &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always imported from peers and are not controlled by this field.
+    &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. IPv4 special-use ranges are always imported from peers and are not controlled by this field.
     &quot;name&quot;: &quot;A String&quot;, # Name of this peering. Provided by the client when the peering is created. The name must comply with RFC1035. Specifically, the name must be 1-63 characters long and match regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all the following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
     &quot;network&quot;: &quot;A String&quot;, # The URL of the peer network. It can be either full URL or partial URL. The peer network may belong to a different project. If the partial URL does not contain project, it is assumed that the peer network is in the same project as the current network.
     &quot;peerMtu&quot;: 42, # Maximum Transmission Unit in bytes.

docs/dyn/compute_alpha.nodeGroups.html

diff --git a/docs/dyn/compute_alpha.nodeGroups.html b/docs/dyn/compute_alpha.nodeGroups.html
index d4647d1..c133a46 100644
--- a/docs/dyn/compute_alpha.nodeGroups.html
+++ b/docs/dyn/compute_alpha.nodeGroups.html
@@ -223,7 +223,7 @@
   "items": { # A list of NodeGroupsScopedList resources.
     "a_key": { # [Output Only] Name of the scope containing this set of node groups.
       "nodeGroups": [ # [Output Only] A list of node groups contained in this scope.
-        { # Represent a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
+        { # Represents a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
           "autoscalingPolicy": { # Specifies how autoscaling should behave.
             "maxNodes": 42, # The maximum number of nodes that the group should have. Must be set if autoscaling is enabled. Maximum value allowed is 100.
             "minNodes": 42, # The minimum number of nodes that the group should have.
@@ -249,6 +249,11 @@
           "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
           "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
           "shareSettings": { # The share setting for reservations and sole tenancy node groups. # Share-settings for the node group
+            "folderMap": { # A map of folder id and folder config to specify consumer projects for this shared-reservation. This is only valid when share_type's value is DIRECT_PROJECTS_UNDER_SPECIFIC_FOLDERS.
+              "a_key": { # Config for each folder in the share settings.
+                "folderId": "A String", # The folder ID, should be same as the key of this folder config in the parent map.
+              },
+            },
             "projects": [ # A List of Project names to specify consumer projects for this shared-reservation. This is only valid when share_type's value is SPECIFIC_PROJECTS.
               "A String",
             ],
@@ -464,7 +469,7 @@
 Returns:
   An object of the form:
 
-    { # Represent a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
+    { # Represents a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
   "autoscalingPolicy": { # Specifies how autoscaling should behave.
     "maxNodes": 42, # The maximum number of nodes that the group should have. Must be set if autoscaling is enabled. Maximum value allowed is 100.
     "minNodes": 42, # The minimum number of nodes that the group should have.
@@ -490,6 +495,11 @@
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
   "shareSettings": { # The share setting for reservations and sole tenancy node groups. # Share-settings for the node group
+    "folderMap": { # A map of folder id and folder config to specify consumer projects for this shared-reservation. This is only valid when share_type's value is DIRECT_PROJECTS_UNDER_SPECIFIC_FOLDERS.
+      "a_key": { # Config for each folder in the share settings.
+        "folderId": "A String", # The folder ID, should be same as the key of this folder config in the parent map.
+      },
+    },
     "projects": [ # A List of Project names to specify consumer projects for this shared-reservation. This is only valid when share_type's value is SPECIFIC_PROJECTS.
       "A String",
     ],
@@ -617,7 +627,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represent a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
+{ # Represents a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
   "autoscalingPolicy": { # Specifies how autoscaling should behave.
     "maxNodes": 42, # The maximum number of nodes that the group should have. Must be set if autoscaling is enabled. Maximum value allowed is 100.
     "minNodes": 42, # The minimum number of nodes that the group should have.
@@ -643,6 +653,11 @@
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
   "shareSettings": { # The share setting for reservations and sole tenancy node groups. # Share-settings for the node group
+    "folderMap": { # A map of folder id and folder config to specify consumer projects for this shared-reservation. This is only valid when share_type's value is DIRECT_PROJECTS_UNDER_SPECIFIC_FOLDERS.
+      "a_key": { # Config for each folder in the share settings.
+        "folderId": "A String", # The folder ID, should be same as the key of this folder config in the parent map.
+      },
+    },
     "projects": [ # A List of Project names to specify consumer projects for this shared-reservation. This is only valid when share_type's value is SPECIFIC_PROJECTS.
       "A String",
     ],
@@ -733,7 +748,7 @@
     { # Contains a list of nodeGroups.
   "id": "A String", # [Output Only] Unique identifier for the resource; defined by the server.
   "items": [ # A list of NodeGroup resources.
-    { # Represent a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
+    { # Represents a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
       "autoscalingPolicy": { # Specifies how autoscaling should behave.
         "maxNodes": 42, # The maximum number of nodes that the group should have. Must be set if autoscaling is enabled. Maximum value allowed is 100.
         "minNodes": 42, # The minimum number of nodes that the group should have.
@@ -759,6 +774,11 @@
       "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
       "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
       "shareSettings": { # The share setting for reservations and sole tenancy node groups. # Share-settings for the node group
+        "folderMap": { # A map of folder id and folder config to specify consumer projects for this shared-reservation. This is only valid when share_type's value is DIRECT_PROJECTS_UNDER_SPECIFIC_FOLDERS.
+          "a_key": { # Config for each folder in the share settings.
+            "folderId": "A String", # The folder ID, should be same as the key of this folder config in the parent map.
+          },
+        },
         "projects": [ # A List of Project names to specify consumer projects for this shared-reservation. This is only valid when share_type's value is SPECIFIC_PROJECTS.
           "A String",
         ],
@@ -892,7 +912,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represent a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
+{ # Represents a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
   "autoscalingPolicy": { # Specifies how autoscaling should behave.
     "maxNodes": 42, # The maximum number of nodes that the group should have. Must be set if autoscaling is enabled. Maximum value allowed is 100.
     "minNodes": 42, # The minimum number of nodes that the group should have.
@@ -918,6 +938,11 @@
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
   "shareSettings": { # The share setting for reservations and sole tenancy node groups. # Share-settings for the node group
+    "folderMap": { # A map of folder id and folder config to specify consumer projects for this shared-reservation. This is only valid when share_type's value is DIRECT_PROJECTS_UNDER_SPECIFIC_FOLDERS.
+      "a_key": { # Config for each folder in the share settings.
+        "folderId": "A String", # The folder ID, should be same as the key of this folder config in the parent map.
+      },
+    },
     "projects": [ # A List of Project names to specify consumer projects for this shared-reservation. This is only valid when share_type's value is SPECIFIC_PROJECTS.
       "A String",
     ],

docs/dyn/compute_alpha.organizationSecurityPolicies.html

diff --git a/docs/dyn/compute_alpha.organizationSecurityPolicies.html b/docs/dyn/compute_alpha.organizationSecurityPolicies.html
index 527bdb3..02a07f2 100644
--- a/docs/dyn/compute_alpha.organizationSecurityPolicies.html
+++ b/docs/dyn/compute_alpha.organizationSecurityPolicies.html
@@ -265,7 +265,8 @@
       "intervalSec": 42, # Interval over which the threshold is computed.
     },
     "conformAction": "A String", # Action to take for requests that are under the configured rate limit threshold. Valid option is "allow" only.
-    "enforceOnKey": "A String", # Determines the key to enforce the threshold_rps limit on. If key is "IP", each IP has this limit enforced separately, whereas "ALL_IPs" means a single limit is applied to all requests matching this rule.
+    "enforceOnKey": "A String", # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field 'enforce_on_key' is not configured. “ALL_IPS” -- This definition, equivalent to "ALL", has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+    "enforceOnKeyName": "A String", # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
     "exceedAction": "A String", # When a request is denied, returns the HTTP response code specified. Valid options are "deny()" where valid values for status are 403, 404, 429, and 502.
     "rateLimitThreshold": { # Threshold at which to begin ratelimiting.
       "count": 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -586,7 +587,8 @@
           "intervalSec": 42, # Interval over which the threshold is computed.
         },
         "conformAction": "A String", # Action to take for requests that are under the configured rate limit threshold. Valid option is "allow" only.
-        "enforceOnKey": "A String", # Determines the key to enforce the threshold_rps limit on. If key is "IP", each IP has this limit enforced separately, whereas "ALL_IPs" means a single limit is applied to all requests matching this rule.
+        "enforceOnKey": "A String", # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field 'enforce_on_key' is not configured. “ALL_IPS” -- This definition, equivalent to "ALL", has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+        "enforceOnKeyName": "A String", # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
         "exceedAction": "A String", # When a request is denied, returns the HTTP response code specified. Valid options are "deny()" where valid values for status are 403, 404, 429, and 502.
         "rateLimitThreshold": { # Threshold at which to begin ratelimiting.
           "count": 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -610,7 +612,7 @@
   ],
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
-  "type": "A String", # The type indicates the intended use of the security policy. CLOUD_ARMOR policies apply to backend services. FIREWALL policies apply to organizations.
+  "type": "A String", # The type indicates the intended use of the security policy. CLOUD_ARMOR - Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services. They filter requests before they hit the origin servers. CLOUD_ARMOR_EDGE - Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services (including Cloud CDN-enabled) as well as backend buckets (GCS). They filter requests before the request is served from Google’s cache.
 }</pre>
 </div>
 
@@ -708,7 +710,8 @@
       &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
     },
     &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-    &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+    &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+    &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
     &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
     &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
       &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -835,7 +838,8 @@
           &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
         },
         &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-        &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+        &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+        &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
         &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
         &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
           &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -859,7 +863,7 @@
   ],
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
-  &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR policies apply to backend services. FIREWALL policies apply to organizations.
+  &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR - Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services. They filter requests before they hit the origin servers. CLOUD_ARMOR_EDGE - Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services (including Cloud CDN-enabled) as well as backend buckets (GCS). They filter requests before the request is served from Google’s cache.
 }
 
   parentId: string, Parent ID for this request. The ID can be either be &quot;folders/[FOLDER_ID]&quot; if the parent is a folder or &quot;organizations/[ORGANIZATION_ID]&quot; if the parent is an organization.
@@ -1039,7 +1043,8 @@
               &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
             },
             &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-            &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+            &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+            &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
             &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
             &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
               &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -1063,7 +1068,7 @@
       ],
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
       &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
-      &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR policies apply to backend services. FIREWALL policies apply to organizations.
+      &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR - Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services. They filter requests before they hit the origin servers. CLOUD_ARMOR_EDGE - Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services (including Cloud CDN-enabled) as well as backend buckets (GCS). They filter requests before the request is served from Google’s cache.
     },
   ],
   &quot;kind&quot;: &quot;compute#securityPolicyList&quot;, # [Output Only] Type of resource. Always compute#securityPolicyList for listsof securityPolicies
@@ -1294,7 +1299,8 @@
           &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
         },
         &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-        &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+        &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+        &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
         &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
         &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
           &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -1318,7 +1324,7 @@
   ],
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
-  &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR policies apply to backend services. FIREWALL policies apply to organizations.
+  &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR - Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services. They filter requests before they hit the origin servers. CLOUD_ARMOR_EDGE - Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services (including Cloud CDN-enabled) as well as backend buckets (GCS). They filter requests before the request is served from Google’s cache.
 }
 
   requestId: string, An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported ( 00000000-0000-0000-0000-000000000000).
@@ -1443,7 +1449,8 @@
       &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
     },
     &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-    &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+    &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+    &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
     &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
     &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
       &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.

docs/dyn/compute_alpha.projects.html

diff --git a/docs/dyn/compute_alpha.projects.html b/docs/dyn/compute_alpha.projects.html
index 01b6b93..32805bc 100644
--- a/docs/dyn/compute_alpha.projects.html
+++ b/docs/dyn/compute_alpha.projects.html
@@ -449,7 +449,7 @@
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "usageExportLocation": { # The location in Cloud Storage and naming method of the daily usage report. Contains bucket_name and report_name prefix. # The naming prefix for daily usage reports and the Google Cloud Storage bucket where they are stored.
     "bucketName": "A String", # The name of an existing bucket in Cloud Storage where the usage report object is stored. The Google Service Account is granted write access to this bucket. This can either be the bucket name by itself, such as example-bucket, or the bucket name with gs:// or https://storage.googleapis.com/ in front of it, such as gs://example-bucket.
-    "reportNamePrefix": "A String", # An optional prefix for the name of the usage report object stored in bucketName. If not supplied, defaults to usage. The report is stored as a CSV file named report_name_prefix_gce_YYYYMMDD.csv where YYYYMMDD is the day of the usage according to Pacific Time. If you supply a prefix, it should conform to Cloud Storage object naming conventions.
+    "reportNamePrefix": "A String", # An optional prefix for the name of the usage report object stored in bucketName. If not supplied, defaults to usage_gce. The report is stored as a CSV file named report_name_prefix_gce_YYYYMMDD.csv where YYYYMMDD is the day of the usage according to Pacific Time. If you supply a prefix, it should conform to Cloud Storage object naming conventions.
   },
   "xpnProjectStatus": "A String", # [Output Only] The role this project has in a shared VPC configuration. Currently, only projects with the host role, which is specified by the value HOST, are differentiated.
 }</pre>
@@ -501,7 +501,7 @@
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;usageExportLocation&quot;: { # The location in Cloud Storage and naming method of the daily usage report. Contains bucket_name and report_name prefix. # The naming prefix for daily usage reports and the Google Cloud Storage bucket where they are stored.
     &quot;bucketName&quot;: &quot;A String&quot;, # The name of an existing bucket in Cloud Storage where the usage report object is stored. The Google Service Account is granted write access to this bucket. This can either be the bucket name by itself, such as example-bucket, or the bucket name with gs:// or https://storage.googleapis.com/ in front of it, such as gs://example-bucket.
-    &quot;reportNamePrefix&quot;: &quot;A String&quot;, # An optional prefix for the name of the usage report object stored in bucketName. If not supplied, defaults to usage. The report is stored as a CSV file named report_name_prefix_gce_YYYYMMDD.csv where YYYYMMDD is the day of the usage according to Pacific Time. If you supply a prefix, it should conform to Cloud Storage object naming conventions.
+    &quot;reportNamePrefix&quot;: &quot;A String&quot;, # An optional prefix for the name of the usage report object stored in bucketName. If not supplied, defaults to usage_gce. The report is stored as a CSV file named report_name_prefix_gce_YYYYMMDD.csv where YYYYMMDD is the day of the usage according to Pacific Time. If you supply a prefix, it should conform to Cloud Storage object naming conventions.
   },
   &quot;xpnProjectStatus&quot;: &quot;A String&quot;, # [Output Only] The role this project has in a shared VPC configuration. Currently, only projects with the host role, which is specified by the value HOST, are differentiated.
 }</pre>
@@ -563,6 +563,7 @@
 
 {
   &quot;organization&quot;: &quot;A String&quot;, # Optional organization ID managed by Cloud Resource Manager, for which to list shared VPC host projects. If not specified, the organization will be inferred from the project.
+  &quot;returnPartialPage&quot;: True or False, # Opt-in for partial page behavior which provides a partial filled page (number of items on which may be smaller than maxResults) within the API deadline. If opt-in, then the user should rely on if nextPageToken is empty in the response to determine if there is a next page. Empty page is also valid and possible. The default value is false.
 }
 
   filter: string, A filter expression that filters resources listed in the response. The expression must specify the field name, a comparison operator, and the value that you want to use for filtering. The value must be a string, a number, or a boolean. The comparison operator must be either `=`, `!=`, `&gt;`, or `&lt;`. For example, if you are filtering Compute Engine instances, you can exclude instances named `example-instance` by specifying `name != example-instance`. You can also filter nested fields. For example, you could specify `scheduling.automaticRestart = false` to include instances only if they are not scheduled for automatic restarts. You can use filtering on nested fields to filter based on resource labels. To filter on multiple expressions, provide each separate expression within parentheses. For example: ``` (scheduling.automaticRestart = true) (cpuPlatform = &quot;Intel Skylake&quot;) ``` By default, each expression is an `AND` expression. However, you can include `AND` and `OR` expressions explicitly. For example: ``` (cpuPlatform = &quot;Intel Skylake&quot;) OR (cpuPlatform = &quot;Intel Broadwell&quot;) AND (scheduling.automaticRestart = true) ```
@@ -613,7 +614,7 @@
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
       &quot;usageExportLocation&quot;: { # The location in Cloud Storage and naming method of the daily usage report. Contains bucket_name and report_name prefix. # The naming prefix for daily usage reports and the Google Cloud Storage bucket where they are stored.
         &quot;bucketName&quot;: &quot;A String&quot;, # The name of an existing bucket in Cloud Storage where the usage report object is stored. The Google Service Account is granted write access to this bucket. This can either be the bucket name by itself, such as example-bucket, or the bucket name with gs:// or https://storage.googleapis.com/ in front of it, such as gs://example-bucket.
-        &quot;reportNamePrefix&quot;: &quot;A String&quot;, # An optional prefix for the name of the usage report object stored in bucketName. If not supplied, defaults to usage. The report is stored as a CSV file named report_name_prefix_gce_YYYYMMDD.csv where YYYYMMDD is the day of the usage according to Pacific Time. If you supply a prefix, it should conform to Cloud Storage object naming conventions.
+        &quot;reportNamePrefix&quot;: &quot;A String&quot;, # An optional prefix for the name of the usage report object stored in bucketName. If not supplied, defaults to usage_gce. The report is stored as a CSV file named report_name_prefix_gce_YYYYMMDD.csv where YYYYMMDD is the day of the usage according to Pacific Time. If you supply a prefix, it should conform to Cloud Storage object naming conventions.
       },
       &quot;xpnProjectStatus&quot;: &quot;A String&quot;, # [Output Only] The role this project has in a shared VPC configuration. Currently, only projects with the host role, which is specified by the value HOST, are differentiated.
     },
@@ -1018,7 +1019,7 @@
 
 { # The location in Cloud Storage and naming method of the daily usage report. Contains bucket_name and report_name prefix.
   &quot;bucketName&quot;: &quot;A String&quot;, # The name of an existing bucket in Cloud Storage where the usage report object is stored. The Google Service Account is granted write access to this bucket. This can either be the bucket name by itself, such as example-bucket, or the bucket name with gs:// or https://storage.googleapis.com/ in front of it, such as gs://example-bucket.
-  &quot;reportNamePrefix&quot;: &quot;A String&quot;, # An optional prefix for the name of the usage report object stored in bucketName. If not supplied, defaults to usage. The report is stored as a CSV file named report_name_prefix_gce_YYYYMMDD.csv where YYYYMMDD is the day of the usage according to Pacific Time. If you supply a prefix, it should conform to Cloud Storage object naming conventions.
+  &quot;reportNamePrefix&quot;: &quot;A String&quot;, # An optional prefix for the name of the usage report object stored in bucketName. If not supplied, defaults to usage_gce. The report is stored as a CSV file named report_name_prefix_gce_YYYYMMDD.csv where YYYYMMDD is the day of the usage according to Pacific Time. If you supply a prefix, it should conform to Cloud Storage object naming conventions.
 }
 
   requestId: string, An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported ( 00000000-0000-0000-0000-000000000000).

docs/dyn/compute_alpha.regionBackendServices.html

diff --git a/docs/dyn/compute_alpha.regionBackendServices.html b/docs/dyn/compute_alpha.regionBackendServices.html
index 0022f25..10f1781 100644
--- a/docs/dyn/compute_alpha.regionBackendServices.html
+++ b/docs/dyn/compute_alpha.regionBackendServices.html
@@ -201,7 +201,7 @@
   "affinityCookieTtlSec": 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   "backends": [ # The list of backends that serve this BackendService.
     { # Message containing information of one individual backend.
-      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
       "capacityScaler": 3.14, # A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
       "failover": True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -212,7 +212,7 @@
       "maxRate": 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerEndpoint": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerInstance": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
-      "maxUtilization": 3.14,
+      "maxUtilization": 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
     },
   ],
   "cdnPolicy": { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -583,7 +583,7 @@
   "sessionAffinity": "A String", # Type of session affinity to use. The default is NONE. For a detailed description of session affinity options, see: [Session affinity](https://cloud.google.com/load-balancing/docs/backend-service#session_affinity). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   "subsetting": { # Subsetting configuration for this BackendService. Currently this is applicable only for Internal TCP/UDP load balancing, Internal HTTP(S) load balancing and Traffic Director.
     "policy": "A String",
-    "subsetSize": 42, # The number of backends per backend group assigned to each proxy instance or each service mesh client. An input parameter to the `CONSISTENT_HASH_SUBSETTING` algorithm. Can only be set if `policy` is set to `CONSISTENT_HASH_SUBSETTING`. Can only be set if load balancing scheme is `INTERNAL_MANAGED` or 'INTERNAL_SELF_MANAGED'. 'subset_size' is optional for Internal HTTP(S) load balancing and required for Traffic Director. If you do not provide this value, Cloud Load Balancing will calculate it dynamically to optimize the number of proxies/clients visible to each backend and vice versa. Must be greater than 0. If `subset_size` is larger than the number of backends/endpoints, then subsetting is disabled.
+    "subsetSize": 42, # The number of backends per backend group assigned to each proxy instance or each service mesh client. An input parameter to the `CONSISTENT_HASH_SUBSETTING` algorithm. Can only be set if `policy` is set to `CONSISTENT_HASH_SUBSETTING`. Can only be set if load balancing scheme is `INTERNAL_MANAGED` or `INTERNAL_SELF_MANAGED`. `subset_size` is optional for Internal HTTP(S) load balancing and required for Traffic Director. If you do not provide this value, Cloud Load Balancing will calculate it dynamically to optimize the number of proxies/clients visible to each backend and vice versa. Must be greater than 0. If `subset_size` is larger than the number of backends/endpoints, then subsetting is disabled.
   },
   "timeoutSec": 42, # Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true. Instead, use maxStreamDuration.
 }</pre>
@@ -754,7 +754,7 @@
   &quot;affinityCookieTtlSec&quot;: 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   &quot;backends&quot;: [ # The list of backends that serve this BackendService.
     { # Message containing information of one individual backend.
-      &quot;balancingMode&quot;: &quot;A String&quot;, # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+      &quot;balancingMode&quot;: &quot;A String&quot;, # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
       &quot;capacityScaler&quot;: 3.14, # A multiplier applied to the backend&#x27;s target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
       &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
       &quot;failover&quot;: True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -765,7 +765,7 @@
       &quot;maxRate&quot;: 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend&#x27;s balancingMode is CONNECTION.
       &quot;maxRatePerEndpoint&quot;: 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend&#x27;s balancingMode is CONNECTION.
       &quot;maxRatePerInstance&quot;: 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend&#x27;s balancingMode is CONNECTION.
-      &quot;maxUtilization&quot;: 3.14,
+      &quot;maxUtilization&quot;: 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
     },
   ],
   &quot;cdnPolicy&quot;: { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -1136,7 +1136,7 @@
   &quot;sessionAffinity&quot;: &quot;A String&quot;, # Type of session affinity to use. The default is NONE. For a detailed description of session affinity options, see: [Session affinity](https://cloud.google.com/load-balancing/docs/backend-service#session_affinity). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   &quot;subsetting&quot;: { # Subsetting configuration for this BackendService. Currently this is applicable only for Internal TCP/UDP load balancing, Internal HTTP(S) load balancing and Traffic Director.
     &quot;policy&quot;: &quot;A String&quot;,
-    &quot;subsetSize&quot;: 42, # The number of backends per backend group assigned to each proxy instance or each service mesh client. An input parameter to the `CONSISTENT_HASH_SUBSETTING` algorithm. Can only be set if `policy` is set to `CONSISTENT_HASH_SUBSETTING`. Can only be set if load balancing scheme is `INTERNAL_MANAGED` or &#x27;INTERNAL_SELF_MANAGED&#x27;. &#x27;subset_size&#x27; is optional for Internal HTTP(S) load balancing and required for Traffic Director. If you do not provide this value, Cloud Load Balancing will calculate it dynamically to optimize the number of proxies/clients visible to each backend and vice versa. Must be greater than 0. If `subset_size` is larger than the number of backends/endpoints, then subsetting is disabled.
+    &quot;subsetSize&quot;: 42, # The number of backends per backend group assigned to each proxy instance or each service mesh client. An input parameter to the `CONSISTENT_HASH_SUBSETTING` algorithm. Can only be set if `policy` is set to `CONSISTENT_HASH_SUBSETTING`. Can only be set if load balancing scheme is `INTERNAL_MANAGED` or `INTERNAL_SELF_MANAGED`. `subset_size` is optional for Internal HTTP(S) load balancing and required for Traffic Director. If you do not provide this value, Cloud Load Balancing will calculate it dynamically to optimize the number of proxies/clients visible to each backend and vice versa. Must be greater than 0. If `subset_size` is larger than the number of backends/endpoints, then subsetting is disabled.
   },
   &quot;timeoutSec&quot;: 42, # Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true. Instead, use maxStreamDuration.
 }
@@ -1225,7 +1225,7 @@
       &quot;affinityCookieTtlSec&quot;: 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
       &quot;backends&quot;: [ # The list of backends that serve this BackendService.
         { # Message containing information of one individual backend.
-          &quot;balancingMode&quot;: &quot;A String&quot;, # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+          &quot;balancingMode&quot;: &quot;A String&quot;, # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
           &quot;capacityScaler&quot;: 3.14, # A multiplier applied to the backend&#x27;s target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
           &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
           &quot;failover&quot;: True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -1236,7 +1236,7 @@
           &quot;maxRate&quot;: 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend&#x27;s balancingMode is CONNECTION.
           &quot;maxRatePerEndpoint&quot;: 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend&#x27;s balancingMode is CONNECTION.
           &quot;maxRatePerInstance&quot;: 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend&#x27;s balancingMode is CONNECTION.
-          &quot;maxUtilization&quot;: 3.14,
+          &quot;maxUtilization&quot;: 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
         },
       ],
       &quot;cdnPolicy&quot;: { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -1607,7 +1607,7 @@
       &quot;sessionAffinity&quot;: &quot;A String&quot;, # Type of session affinity to use. The default is NONE. For a detailed description of session affinity options, see: [Session affinity](https://cloud.google.com/load-balancing/docs/backend-service#session_affinity). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
       &quot;subsetting&quot;: { # Subsetting configuration for this BackendService. Currently this is applicable only for Internal TCP/UDP load balancing, Internal HTTP(S) load balancing and Traffic Director.
         &quot;policy&quot;: &quot;A String&quot;,
-        &quot;subsetSize&quot;: 42, # The number of backends per backend group assigned to each proxy instance or each service mesh client. An input parameter to the `CONSISTENT_HASH_SUBSETTING` algorithm. Can only be set if `policy` is set to `CONSISTENT_HASH_SUBSETTING`. Can only be set if load balancing scheme is `INTERNAL_MANAGED` or &#x27;INTERNAL_SELF_MANAGED&#x27;. &#x27;subset_size&#x27; is optional for Internal HTTP(S) load balancing and required for Traffic Director. If you do not provide this value, Cloud Load Balancing will calculate it dynamically to optimize the number of proxies/clients visible to each backend and vice versa. Must be greater than 0. If `subset_size` is larger than the number of backends/endpoints, then subsetting is disabled.
+        &quot;subsetSize&quot;: 42, # The number of backends per backend group assigned to each proxy instance or each service mesh client. An input parameter to the `CONSISTENT_HASH_SUBSETTING` algorithm. Can only be set if `policy` is set to `CONSISTENT_HASH_SUBSETTING`. Can only be set if load balancing scheme is `INTERNAL_MANAGED` or `INTERNAL_SELF_MANAGED`. `subset_size` is optional for Internal HTTP(S) load balancing and required for Traffic Director. If you do not provide this value, Cloud Load Balancing will calculate it dynamically to optimize the number of proxies/clients visible to each backend and vice versa. Must be greater than 0. If `subset_size` is larger than the number of backends/endpoints, then subsetting is disabled.
       },
       &quot;timeoutSec&quot;: 42, # Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true. Instead, use maxStreamDuration.
     },
@@ -1657,7 +1657,7 @@
   &quot;affinityCookieTtlSec&quot;: 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   &quot;backends&quot;: [ # The list of backends that serve this BackendService.
     { # Message containing information of one individual backend.
-      &quot;balancingMode&quot;: &quot;A String&quot;, # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+      &quot;balancingMode&quot;: &quot;A String&quot;, # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
       &quot;capacityScaler&quot;: 3.14, # A multiplier applied to the backend&#x27;s target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
       &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
       &quot;failover&quot;: True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -1668,7 +1668,7 @@
       &quot;maxRate&quot;: 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend&#x27;s balancingMode is CONNECTION.
       &quot;maxRatePerEndpoint&quot;: 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend&#x27;s balancingMode is CONNECTION.
       &quot;maxRatePerInstance&quot;: 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend&#x27;s balancingMode is CONNECTION.
-      &quot;maxUtilization&quot;: 3.14,
+      &quot;maxUtilization&quot;: 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
     },
   ],
   &quot;cdnPolicy&quot;: { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -2039,7 +2039,7 @@
   &quot;sessionAffinity&quot;: &quot;A String&quot;, # Type of session affinity to use. The default is NONE. For a detailed description of session affinity options, see: [Session affinity](https://cloud.google.com/load-balancing/docs/backend-service#session_affinity). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   &quot;subsetting&quot;: { # Subsetting configuration for this BackendService. Currently this is applicable only for Internal TCP/UDP load balancing, Internal HTTP(S) load balancing and Traffic Director.
     &quot;policy&quot;: &quot;A String&quot;,
-    &quot;subsetSize&quot;: 42, # The number of backends per backend group assigned to each proxy instance or each service mesh client. An input parameter to the `CONSISTENT_HASH_SUBSETTING` algorithm. Can only be set if `policy` is set to `CONSISTENT_HASH_SUBSETTING`. Can only be set if load balancing scheme is `INTERNAL_MANAGED` or &#x27;INTERNAL_SELF_MANAGED&#x27;. &#x27;subset_size&#x27; is optional for Internal HTTP(S) load balancing and required for Traffic Director. If you do not provide this value, Cloud Load Balancing will calculate it dynamically to optimize the number of proxies/clients visible to each backend and vice versa. Must be greater than 0. If `subset_size` is larger than the number of backends/endpoints, then subsetting is disabled.
+    &quot;subsetSize&quot;: 42, # The number of backends per backend group assigned to each proxy instance or each service mesh client. An input parameter to the `CONSISTENT_HASH_SUBSETTING` algorithm. Can only be set if `policy` is set to `CONSISTENT_HASH_SUBSETTING`. Can only be set if load balancing scheme is `INTERNAL_MANAGED` or `INTERNAL_SELF_MANAGED`. `subset_size` is optional for Internal HTTP(S) load balancing and required for Traffic Director. If you do not provide this value, Cloud Load Balancing will calculate it dynamically to optimize the number of proxies/clients visible to each backend and vice versa. Must be greater than 0. If `subset_size` is larger than the number of backends/endpoints, then subsetting is disabled.
   },
   &quot;timeoutSec&quot;: 42, # Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true. Instead, use maxStreamDuration.
 }
@@ -2360,7 +2360,7 @@
   &quot;affinityCookieTtlSec&quot;: 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   &quot;backends&quot;: [ # The list of backends that serve this BackendService.
     { # Message containing information of one individual backend.
-      &quot;balancingMode&quot;: &quot;A String&quot;, # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+      &quot;balancingMode&quot;: &quot;A String&quot;, # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
       &quot;capacityScaler&quot;: 3.14, # A multiplier applied to the backend&#x27;s target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
       &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
       &quot;failover&quot;: True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -2371,7 +2371,7 @@
       &quot;maxRate&quot;: 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend&#x27;s balancingMode is CONNECTION.
       &quot;maxRatePerEndpoint&quot;: 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend&#x27;s balancingMode is CONNECTION.
       &quot;maxRatePerInstance&quot;: 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend&#x27;s balancingMode is CONNECTION.
-      &quot;maxUtilization&quot;: 3.14,
+      &quot;maxUtilization&quot;: 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
     },
   ],
   &quot;cdnPolicy&quot;: { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -2742,7 +2742,7 @@
   &quot;sessionAffinity&quot;: &quot;A String&quot;, # Type of session affinity to use. The default is NONE. For a detailed description of session affinity options, see: [Session affinity](https://cloud.google.com/load-balancing/docs/backend-service#session_affinity). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   &quot;subsetting&quot;: { # Subsetting configuration for this BackendService. Currently this is applicable only for Internal TCP/UDP load balancing, Internal HTTP(S) load balancing and Traffic Director.
     &quot;policy&quot;: &quot;A String&quot;,
-    &quot;subsetSize&quot;: 42, # The number of backends per backend group assigned to each proxy instance or each service mesh client. An input parameter to the `CONSISTENT_HASH_SUBSETTING` algorithm. Can only be set if `policy` is set to `CONSISTENT_HASH_SUBSETTING`. Can only be set if load balancing scheme is `INTERNAL_MANAGED` or &#x27;INTERNAL_SELF_MANAGED&#x27;. &#x27;subset_size&#x27; is optional for Internal HTTP(S) load balancing and required for Traffic Director. If you do not provide this value, Cloud Load Balancing will calculate it dynamically to optimize the number of proxies/clients visible to each backend and vice versa. Must be greater than 0. If `subset_size` is larger than the number of backends/endpoints, then subsetting is disabled.
+    &quot;subsetSize&quot;: 42, # The number of backends per backend group assigned to each proxy instance or each service mesh client. An input parameter to the `CONSISTENT_HASH_SUBSETTING` algorithm. Can only be set if `policy` is set to `CONSISTENT_HASH_SUBSETTING`. Can only be set if load balancing scheme is `INTERNAL_MANAGED` or `INTERNAL_SELF_MANAGED`. `subset_size` is optional for Internal HTTP(S) load balancing and required for Traffic Director. If you do not provide this value, Cloud Load Balancing will calculate it dynamically to optimize the number of proxies/clients visible to each backend and vice versa. Must be greater than 0. If `subset_size` is larger than the number of backends/endpoints, then subsetting is disabled.
   },
   &quot;timeoutSec&quot;: 42, # Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true. Instead, use maxStreamDuration.
 }

docs/dyn/compute_alpha.regionCommitments.html

diff --git a/docs/dyn/compute_alpha.regionCommitments.html b/docs/dyn/compute_alpha.regionCommitments.html
index 8b2a7d8..e8a8fd0 100644
--- a/docs/dyn/compute_alpha.regionCommitments.html
+++ b/docs/dyn/compute_alpha.regionCommitments.html
@@ -158,6 +158,11 @@
               "selfLink": "A String", # [Output Only] Server-defined fully-qualified URL for this resource.
               "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
               "shareSettings": { # The share setting for reservations and sole tenancy node groups. # Share-settings for shared-reservation
+                "folderMap": { # A map of folder id and folder config to specify consumer projects for this shared-reservation. This is only valid when share_type's value is DIRECT_PROJECTS_UNDER_SPECIFIC_FOLDERS.
+                  "a_key": { # Config for each folder in the share settings.
+                    "folderId": "A String", # The folder ID, should be same as the key of this folder config in the parent map.
+                  },
+                },
                 "projects": [ # A List of Project names to specify consumer projects for this shared-reservation. This is only valid when share_type's value is SPECIFIC_PROJECTS.
                   "A String",
                 ],
@@ -300,6 +305,11 @@
       "selfLink": "A String", # [Output Only] Server-defined fully-qualified URL for this resource.
       "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
       "shareSettings": { # The share setting for reservations and sole tenancy node groups. # Share-settings for shared-reservation
+        "folderMap": { # A map of folder id and folder config to specify consumer projects for this shared-reservation. This is only valid when share_type's value is DIRECT_PROJECTS_UNDER_SPECIFIC_FOLDERS.
+          "a_key": { # Config for each folder in the share settings.
+            "folderId": "A String", # The folder ID, should be same as the key of this folder config in the parent map.
+          },
+        },
         "projects": [ # A List of Project names to specify consumer projects for this shared-reservation. This is only valid when share_type's value is SPECIFIC_PROJECTS.
           "A String",
         ],
@@ -387,6 +397,11 @@
       "selfLink": "A String", # [Output Only] Server-defined fully-qualified URL for this resource.
       "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
       "shareSettings": { # The share setting for reservations and sole tenancy node groups. # Share-settings for shared-reservation
+        "folderMap": { # A map of folder id and folder config to specify consumer projects for this shared-reservation. This is only valid when share_type's value is DIRECT_PROJECTS_UNDER_SPECIFIC_FOLDERS.
+          "a_key": { # Config for each folder in the share settings.
+            "folderId": "A String", # The folder ID, should be same as the key of this folder config in the parent map.
+          },
+        },
         "projects": [ # A List of Project names to specify consumer projects for this shared-reservation. This is only valid when share_type's value is SPECIFIC_PROJECTS.
           "A String",
         ],
@@ -543,6 +558,11 @@
           "selfLink": "A String", # [Output Only] Server-defined fully-qualified URL for this resource.
           "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
           "shareSettings": { # The share setting for reservations and sole tenancy node groups. # Share-settings for shared-reservation
+            "folderMap": { # A map of folder id and folder config to specify consumer projects for this shared-reservation. This is only valid when share_type's value is DIRECT_PROJECTS_UNDER_SPECIFIC_FOLDERS.
+              "a_key": { # Config for each folder in the share settings.
+                "folderId": "A String", # The folder ID, should be same as the key of this folder config in the parent map.
+              },
+            },
             "projects": [ # A List of Project names to specify consumer projects for this shared-reservation. This is only valid when share_type's value is SPECIFIC_PROJECTS.
               "A String",
             ],
@@ -692,6 +712,11 @@
       "selfLink": "A String", # [Output Only] Server-defined fully-qualified URL for this resource.
       "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
       "shareSettings": { # The share setting for reservations and sole tenancy node groups. # Share-settings for shared-reservation
+        "folderMap": { # A map of folder id and folder config to specify consumer projects for this shared-reservation. This is only valid when share_type's value is DIRECT_PROJECTS_UNDER_SPECIFIC_FOLDERS.
+          "a_key": { # Config for each folder in the share settings.
+            "folderId": "A String", # The folder ID, should be same as the key of this folder config in the parent map.
+          },
+        },
         "projects": [ # A List of Project names to specify consumer projects for this shared-reservation. This is only valid when share_type's value is SPECIFIC_PROJECTS.
           "A String",
         ],
@@ -823,6 +848,11 @@
       "selfLink": "A String", # [Output Only] Server-defined fully-qualified URL for this resource.
       "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
       "shareSettings": { # The share setting for reservations and sole tenancy node groups. # Share-settings for shared-reservation
+        "folderMap": { # A map of folder id and folder config to specify consumer projects for this shared-reservation. This is only valid when share_type's value is DIRECT_PROJECTS_UNDER_SPECIFIC_FOLDERS.
+          "a_key": { # Config for each folder in the share settings.
+            "folderId": "A String", # The folder ID, should be same as the key of this folder config in the parent map.
+          },
+        },
         "projects": [ # A List of Project names to specify consumer projects for this shared-reservation. This is only valid when share_type's value is SPECIFIC_PROJECTS.
           "A String",
         ],

docs/dyn/compute_alpha.regionHealthChecks.html

diff --git a/docs/dyn/compute_alpha.regionHealthChecks.html b/docs/dyn/compute_alpha.regionHealthChecks.html
index c97f362..0fd77ac 100644
--- a/docs/dyn/compute_alpha.regionHealthChecks.html
+++ b/docs/dyn/compute_alpha.regionHealthChecks.html
@@ -188,7 +188,7 @@
 Returns:
   An object of the form:
 
-    { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/alpha/healthChecks) * [Regional](/compute/docs/reference/rest/alpha/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+    { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/alpha/healthChecks) * [Regional](/compute/docs/reference/rest/alpha/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -276,7 +276,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/alpha/healthChecks) * [Regional](/compute/docs/reference/rest/alpha/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/alpha/healthChecks) * [Regional](/compute/docs/reference/rest/alpha/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -433,7 +433,7 @@
     { # Contains a list of HealthCheck resources.
   "id": "A String", # [Output Only] Unique identifier for the resource; defined by the server.
   "items": [ # A list of HealthCheck resources.
-    { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/alpha/healthChecks) * [Regional](/compute/docs/reference/rest/alpha/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+    { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/alpha/healthChecks) * [Regional](/compute/docs/reference/rest/alpha/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
       "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
       "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -551,7 +551,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/alpha/healthChecks) * [Regional](/compute/docs/reference/rest/alpha/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/alpha/healthChecks) * [Regional](/compute/docs/reference/rest/alpha/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -728,7 +728,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/alpha/healthChecks) * [Regional](/compute/docs/reference/rest/alpha/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/alpha/healthChecks) * [Regional](/compute/docs/reference/rest/alpha/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.

docs/dyn/compute_alpha.regionInstanceGroupManagers.html

diff --git a/docs/dyn/compute_alpha.regionInstanceGroupManagers.html b/docs/dyn/compute_alpha.regionInstanceGroupManagers.html
index 95f7584..5b0dc7d 100644
--- a/docs/dyn/compute_alpha.regionInstanceGroupManagers.html
+++ b/docs/dyn/compute_alpha.regionInstanceGroupManagers.html
@@ -694,7 +694,7 @@
     "suspending": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be suspended or are currently being suspended.
     "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
   },
-  "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+  "description": "A String", # An optional description of this resource.
   "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
     "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
     "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -725,6 +725,9 @@
   "selfLink": "A String", # [Output Only] The URL for this managed instance group. The server defines this URL.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
   "serviceAccount": "A String", # The service account to be used as credentials for all operations performed by the managed instance group on instances. The service accounts needs all permissions required to create and delete instances. By default, the service account {projectNumber}@cloudservices.gserviceaccount.com is used.
+  "standbyPolicy": { # Stanby policy for stopped and suspended instances.
+    "initialDelaySec": 42,
+  },
   "statefulPolicy": { # Stateful configuration for this Instanced Group Manager
     "preservedState": { # Configuration of preserved resources.
       "disks": { # Disks created on the instances that will be preserved on instance delete, update, etc. This map is keyed with the device names of the disks.
@@ -837,7 +840,7 @@
     "suspending": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be suspended or are currently being suspended.
     "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
   },
-  "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+  "description": "A String", # An optional description of this resource.
   "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
     "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
     "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -868,6 +871,9 @@
   "selfLink": "A String", # [Output Only] The URL for this managed instance group. The server defines this URL.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
   "serviceAccount": "A String", # The service account to be used as credentials for all operations performed by the managed instance group on instances. The service accounts needs all permissions required to create and delete instances. By default, the service account {projectNumber}@cloudservices.gserviceaccount.com is used.
+  "standbyPolicy": { # Stanby policy for stopped and suspended instances.
+    "initialDelaySec": 42,
+  },
   "statefulPolicy": { # Stateful configuration for this Instanced Group Manager
     "preservedState": { # Configuration of preserved resources.
       "disks": { # Disks created on the instances that will be preserved on instance delete, update, etc. This map is keyed with the device names of the disks.
@@ -1049,7 +1055,7 @@
         "suspending": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be suspended or are currently being suspended.
         "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
       },
-      "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+      "description": "A String", # An optional description of this resource.
       "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
         "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
         "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -1080,6 +1086,9 @@
       "selfLink": "A String", # [Output Only] The URL for this managed instance group. The server defines this URL.
       "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
       "serviceAccount": "A String", # The service account to be used as credentials for all operations performed by the managed instance group on instances. The service accounts needs all permissions required to create and delete instances. By default, the service account {projectNumber}@cloudservices.gserviceaccount.com is used.
+      "standbyPolicy": { # Stanby policy for stopped and suspended instances.
+        "initialDelaySec": 42,
+      },
       "statefulPolicy": { # Stateful configuration for this Instanced Group Manager
         "preservedState": { # Configuration of preserved resources.
           "disks": { # Disks created on the instances that will be preserved on instance delete, update, etc. This map is keyed with the device names of the disks.
@@ -1499,7 +1508,7 @@
     "suspending": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be suspended or are currently being suspended.
     "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
   },
-  "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+  "description": "A String", # An optional description of this resource.
   "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
     "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
     "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -1530,6 +1539,9 @@
   "selfLink": "A String", # [Output Only] The URL for this managed instance group. The server defines this URL.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
   "serviceAccount": "A String", # The service account to be used as credentials for all operations performed by the managed instance group on instances. The service accounts needs all permissions required to create and delete instances. By default, the service account {projectNumber}@cloudservices.gserviceaccount.com is used.
+  "standbyPolicy": { # Stanby policy for stopped and suspended instances.
+    "initialDelaySec": 42,
+  },
   "statefulPolicy": { # Stateful configuration for this Instanced Group Manager
     "preservedState": { # Configuration of preserved resources.
       "disks": { # Disks created on the instances that will be preserved on instance delete, update, etc. This map is keyed with the device names of the disks.
@@ -2579,7 +2591,7 @@
     "suspending": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be suspended or are currently being suspended.
     "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
   },
-  "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+  "description": "A String", # An optional description of this resource.
   "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
     "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
     "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -2610,6 +2622,9 @@
   "selfLink": "A String", # [Output Only] The URL for this managed instance group. The server defines this URL.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
   "serviceAccount": "A String", # The service account to be used as credentials for all operations performed by the managed instance group on instances. The service accounts needs all permissions required to create and delete instances. By default, the service account {projectNumber}@cloudservices.gserviceaccount.com is used.
+  "standbyPolicy": { # Stanby policy for stopped and suspended instances.
+    "initialDelaySec": 42,
+  },
   "statefulPolicy": { # Stateful configuration for this Instanced Group Manager
     "preservedState": { # Configuration of preserved resources.
       "disks": { # Disks created on the instances that will be preserved on instance delete, update, etc. This map is keyed with the device names of the disks.

docs/dyn/compute_alpha.regionInstances.html

diff --git a/docs/dyn/compute_alpha.regionInstances.html b/docs/dyn/compute_alpha.regionInstances.html
index 6268ee6..81449e6 100644
--- a/docs/dyn/compute_alpha.regionInstances.html
+++ b/docs/dyn/compute_alpha.regionInstances.html
@@ -142,6 +142,12 @@
           "labels": { # Labels to apply to this disk. These can be later modified by the disks.setLabels method. This field is only applicable for persistent disks.
             "a_key": "A String",
           },
+          "licenseCodes": [ # Integer license codes indicating which licenses are attached to this disk.
+            "A String",
+          ],
+          "licenses": [ # A list of publicly visible licenses. Reserved for Google's use.
+            "A String",
+          ],
           "multiWriter": True or False, # Indicates whether or not the disk can be read/write attached to more than one instance.
           "onUpdateAction": "A String", # Specifies which action to take on instance update with this disk. Default is to use the existing disk.
           "provisionedIops": "A String", # Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be between 10,000 and 120,000. For more details, see the Extreme persistent disk documentation.
@@ -460,6 +466,12 @@
           "labels": { # Labels to apply to this disk. These can be later modified by the disks.setLabels method. This field is only applicable for persistent disks.
             "a_key": "A String",
           },
+          "licenseCodes": [ # Integer license codes indicating which licenses are attached to this disk.
+            "A String",
+          ],
+          "licenses": [ # A list of publicly visible licenses. Reserved for Google's use.
+            "A String",
+          ],
           "multiWriter": True or False, # Indicates whether or not the disk can be read/write attached to more than one instance.
           "onUpdateAction": "A String", # Specifies which action to take on instance update with this disk. Default is to use the existing disk.
           "provisionedIops": "A String", # Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be between 10,000 and 120,000. For more details, see the Extreme persistent disk documentation.
@@ -691,12 +703,6 @@
       "name": "A String", # This field is only temporary. It will be removed. Do not use it.
     },
   },
-  "predefinedNames": [ # DEPRECATED: Please use per_instance_properties instead.
-    "A String",
-  ],
-  "secureTags": [ # DEPRECATED: Please use instance_properties.secure_tag instead. Secure tags to apply to this instance. These can be later modified by the update method. Maximum number of secure tags allowed is 50.
-    "A String",
-  ],
   "sourceInstanceTemplate": "A String", # Specifies the instance template from which to create instances. You may combine sourceInstanceTemplate with instanceProperties to override specific values from an existing instance template. Bulk API follows the semantics of JSON Merge Patch described by RFC 7396. It can be a full or partial URL. For example, the following are all valid URLs to an instance template: - https://www.googleapis.com/compute/v1/projects/project /global/instanceTemplates/instanceTemplate - projects/project/global/instanceTemplates/instanceTemplate - global/instanceTemplates/instanceTemplate This field is optional.
 }
 

docs/dyn/compute_alpha.regionNetworkFirewallPolicies.html

diff --git a/docs/dyn/compute_alpha.regionNetworkFirewallPolicies.html b/docs/dyn/compute_alpha.regionNetworkFirewallPolicies.html
index f664161..263c3cb 100644
--- a/docs/dyn/compute_alpha.regionNetworkFirewallPolicies.html
+++ b/docs/dyn/compute_alpha.regionNetworkFirewallPolicies.html
@@ -228,7 +228,7 @@
   "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
   "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
   "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
       "A String",
     ],
     "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -239,7 +239,7 @@
         ],
       },
     ],
-    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
       "A String",
     ],
     "srcSecureTags": [ # List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256.
@@ -505,7 +505,7 @@
       "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
       "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
       "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
           "A String",
         ],
         "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -516,7 +516,7 @@
             ],
           },
         ],
-        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
           "A String",
         ],
         "srcSecureTags": [ # List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256.
@@ -604,7 +604,7 @@
           "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
           "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
           "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-            "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+            "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
               "A String",
             ],
             "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -615,7 +615,7 @@
                 ],
               },
             ],
-            "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+            "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
               "A String",
             ],
             "srcSecureTags": [ # List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256.
@@ -664,7 +664,7 @@
         },
       ],
       "description": "A String", # An optional description of this resource. Provide this field when you create the resource.
-      "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Only IPv4 is supported.
+      "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Both IPv4 and IPv6 are supported.
         "A String",
       ],
       "direction": "A String", # Direction of traffic to which this firewall applies, either `INGRESS` or `EGRESS`. The default is `INGRESS`. For `INGRESS` traffic, you cannot specify the destinationRanges field, and for `EGRESS` traffic, you cannot specify the sourceRanges or sourceTags fields.
@@ -681,7 +681,7 @@
       "priority": 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
       "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
       "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
-      "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Only IPv4 is supported.
+      "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Both IPv4 and IPv6 are supported.
         "A String",
       ],
       "sourceServiceAccounts": [ # If source service accounts are specified, the firewall rules apply only to traffic originating from an instance with a service account in this list. Source service accounts cannot be used to control traffic to an instance's external IP address because service accounts are associated with an instance, not an IP address. sourceRanges can be set at the same time as sourceServiceAccounts. If both are set, the firewall applies to traffic that has a source IP address within the sourceRanges OR a source IP that belongs to an instance with service account listed in sourceServiceAccount. The connection does not need to match both fields for the firewall to apply. sourceServiceAccounts cannot be used at the same time as sourceTags or targetTags.
@@ -831,7 +831,7 @@
   "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
   "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
   "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
       "A String",
     ],
     "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -842,7 +842,7 @@
         ],
       },
     ],
-    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
       "A String",
     ],
     "srcSecureTags": [ # List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256.
@@ -908,7 +908,7 @@
       "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
       "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
       "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
           "A String",
         ],
         "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -919,7 +919,7 @@
             ],
           },
         ],
-        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
           "A String",
         ],
         "srcSecureTags": [ # List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256.
@@ -1059,7 +1059,7 @@
           "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
           "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
           "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-            "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+            "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
               "A String",
             ],
             "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -1070,7 +1070,7 @@
                 ],
               },
             ],
-            "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+            "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
               "A String",
             ],
             "srcSecureTags": [ # List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256.
@@ -1170,7 +1170,7 @@
       "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
       "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
       "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
           "A String",
         ],
         "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -1181,7 +1181,7 @@
             ],
           },
         ],
-        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
           "A String",
         ],
         "srcSecureTags": [ # List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256.
@@ -1288,7 +1288,7 @@
   "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
   "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
   "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
       "A String",
     ],
     "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -1299,7 +1299,7 @@
         ],
       },
     ],
-    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
       "A String",
     ],
     "srcSecureTags": [ # List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256.

docs/dyn/compute_alpha.regionSecurityPolicies.html

diff --git a/docs/dyn/compute_alpha.regionSecurityPolicies.html b/docs/dyn/compute_alpha.regionSecurityPolicies.html
index 478e606..9d50127 100644
--- a/docs/dyn/compute_alpha.regionSecurityPolicies.html
+++ b/docs/dyn/compute_alpha.regionSecurityPolicies.html
@@ -278,7 +278,8 @@
           "intervalSec": 42, # Interval over which the threshold is computed.
         },
         "conformAction": "A String", # Action to take for requests that are under the configured rate limit threshold. Valid option is "allow" only.
-        "enforceOnKey": "A String", # Determines the key to enforce the threshold_rps limit on. If key is "IP", each IP has this limit enforced separately, whereas "ALL_IPs" means a single limit is applied to all requests matching this rule.
+        "enforceOnKey": "A String", # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field 'enforce_on_key' is not configured. “ALL_IPS” -- This definition, equivalent to "ALL", has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+        "enforceOnKeyName": "A String", # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
         "exceedAction": "A String", # When a request is denied, returns the HTTP response code specified. Valid options are "deny()" where valid values for status are 403, 404, 429, and 502.
         "rateLimitThreshold": { # Threshold at which to begin ratelimiting.
           "count": 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -302,7 +303,7 @@
   ],
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
-  "type": "A String", # The type indicates the intended use of the security policy. CLOUD_ARMOR policies apply to backend services. FIREWALL policies apply to organizations.
+  "type": "A String", # The type indicates the intended use of the security policy. CLOUD_ARMOR - Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services. They filter requests before they hit the origin servers. CLOUD_ARMOR_EDGE - Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services (including Cloud CDN-enabled) as well as backend buckets (GCS). They filter requests before the request is served from Google’s cache.
 }</pre>
 </div>
 
@@ -412,7 +413,8 @@
           &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
         },
         &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-        &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+        &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+        &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
         &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
         &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
           &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -436,7 +438,7 @@
   ],
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
-  &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR policies apply to backend services. FIREWALL policies apply to organizations.
+  &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR - Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services. They filter requests before they hit the origin servers. CLOUD_ARMOR_EDGE - Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services (including Cloud CDN-enabled) as well as backend buckets (GCS). They filter requests before the request is served from Google’s cache.
 }
 
   requestId: string, An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported ( 00000000-0000-0000-0000-000000000000).
@@ -617,7 +619,8 @@
               &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
             },
             &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-            &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+            &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+            &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
             &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
             &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
               &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -641,7 +644,7 @@
       ],
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
       &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
-      &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR policies apply to backend services. FIREWALL policies apply to organizations.
+      &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR - Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services. They filter requests before they hit the origin servers. CLOUD_ARMOR_EDGE - Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services (including Cloud CDN-enabled) as well as backend buckets (GCS). They filter requests before the request is served from Google’s cache.
     },
   ],
   &quot;kind&quot;: &quot;compute#securityPolicyList&quot;, # [Output Only] Type of resource. Always compute#securityPolicyList for listsof securityPolicies
@@ -783,7 +786,8 @@
           &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
         },
         &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-        &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+        &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+        &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
         &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
         &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
           &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -807,7 +811,7 @@
   ],
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
-  &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR policies apply to backend services. FIREWALL policies apply to organizations.
+  &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR - Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services. They filter requests before they hit the origin servers. CLOUD_ARMOR_EDGE - Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services (including Cloud CDN-enabled) as well as backend buckets (GCS). They filter requests before the request is served from Google’s cache.
 }
 
   requestId: string, An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported ( 00000000-0000-0000-0000-000000000000).

docs/dyn/compute_alpha.reservations.html

diff --git a/docs/dyn/compute_alpha.reservations.html b/docs/dyn/compute_alpha.reservations.html
index 26898fa..72dc416 100644
--- a/docs/dyn/compute_alpha.reservations.html
+++ b/docs/dyn/compute_alpha.reservations.html
@@ -110,6 +110,9 @@
 <p class="toc_element">
   <code><a href="#testIamPermissions">testIamPermissions(project, zone, resource, body=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Returns permissions that a caller has on the specified resource.</p>
+<p class="toc_element">
+  <code><a href="#update">update(project, zone, reservation, body=None, paths=None, requestId=None, updateMask=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Update share settings of the reservation.</p>
 <h3>Method Details</h3>
 <div class="method">
     <code class="details" id="aggregatedList">aggregatedList(project, filter=None, includeAllScopes=None, maxResults=None, orderBy=None, pageToken=None, returnPartialSuccess=None, x__xgafv=None)</code>
@@ -147,6 +150,11 @@
           &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined fully-qualified URL for this resource.
           &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
           &quot;shareSettings&quot;: { # The share setting for reservations and sole tenancy node groups. # Share-settings for shared-reservation
+            &quot;folderMap&quot;: { # A map of folder id and folder config to specify consumer projects for this shared-reservation. This is only valid when share_type&#x27;s value is DIRECT_PROJECTS_UNDER_SPECIFIC_FOLDERS.
+              &quot;a_key&quot;: { # Config for each folder in the share settings.
+                &quot;folderId&quot;: &quot;A String&quot;, # The folder ID, should be same as the key of this folder config in the parent map.
+              },
+            },
             &quot;projects&quot;: [ # A List of Project names to specify consumer projects for this shared-reservation. This is only valid when share_type&#x27;s value is SPECIFIC_PROJECTS.
               &quot;A String&quot;,
             ],
@@ -322,6 +330,11 @@
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined fully-qualified URL for this resource.
   &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
   &quot;shareSettings&quot;: { # The share setting for reservations and sole tenancy node groups. # Share-settings for shared-reservation
+    &quot;folderMap&quot;: { # A map of folder id and folder config to specify consumer projects for this shared-reservation. This is only valid when share_type&#x27;s value is DIRECT_PROJECTS_UNDER_SPECIFIC_FOLDERS.
+      &quot;a_key&quot;: { # Config for each folder in the share settings.
+        &quot;folderId&quot;: &quot;A String&quot;, # The folder ID, should be same as the key of this folder config in the parent map.
+      },
+    },
     &quot;projects&quot;: [ # A List of Project names to specify consumer projects for this shared-reservation. This is only valid when share_type&#x27;s value is SPECIFIC_PROJECTS.
       &quot;A String&quot;,
     ],
@@ -482,6 +495,11 @@
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined fully-qualified URL for this resource.
   &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
   &quot;shareSettings&quot;: { # The share setting for reservations and sole tenancy node groups. # Share-settings for shared-reservation
+    &quot;folderMap&quot;: { # A map of folder id and folder config to specify consumer projects for this shared-reservation. This is only valid when share_type&#x27;s value is DIRECT_PROJECTS_UNDER_SPECIFIC_FOLDERS.
+      &quot;a_key&quot;: { # Config for each folder in the share settings.
+        &quot;folderId&quot;: &quot;A String&quot;, # The folder ID, should be same as the key of this folder config in the parent map.
+      },
+    },
     &quot;projects&quot;: [ # A List of Project names to specify consumer projects for this shared-reservation. This is only valid when share_type&#x27;s value is SPECIFIC_PROJECTS.
       &quot;A String&quot;,
     ],
@@ -606,6 +624,11 @@
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined fully-qualified URL for this resource.
       &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
       &quot;shareSettings&quot;: { # The share setting for reservations and sole tenancy node groups. # Share-settings for shared-reservation
+        &quot;folderMap&quot;: { # A map of folder id and folder config to specify consumer projects for this shared-reservation. This is only valid when share_type&#x27;s value is DIRECT_PROJECTS_UNDER_SPECIFIC_FOLDERS.
+          &quot;a_key&quot;: { # Config for each folder in the share settings.
+            &quot;folderId&quot;: &quot;A String&quot;, # The folder ID, should be same as the key of this folder config in the parent map.
+          },
+        },
         &quot;projects&quot;: [ # A List of Project names to specify consumer projects for this shared-reservation. This is only valid when share_type&#x27;s value is SPECIFIC_PROJECTS.
           &quot;A String&quot;,
         ],
@@ -985,4 +1008,123 @@
 }</pre>
 </div>
 
+<div class="method">
+    <code class="details" id="update">update(project, zone, reservation, body=None, paths=None, requestId=None, updateMask=None, x__xgafv=None)</code>
+  <pre>Update share settings of the reservation.
+
+Args:
+  project: string, Project ID for this request. (required)
+  zone: string, Name of the zone for this request. (required)
+  reservation: string, Name of the reservation to update. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Represents a reservation resource. A reservation ensures that capacity is held in a specific zone even if the reserved VMs are not running. For more information, read Reserving zonal resources.
+  &quot;commitment&quot;: &quot;A String&quot;, # [Output Only] Full or partial URL to a parent commitment. This field displays for reservations that are tied to a commitment.
+  &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
+  &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
+  &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
+  &quot;kind&quot;: &quot;compute#reservation&quot;, # [Output Only] Type of the resource. Always compute#reservations for reservations.
+  &quot;name&quot;: &quot;A String&quot;, # The name of the resource, provided by the client when initially creating the resource. The resource name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
+  &quot;satisfiesPzs&quot;: True or False, # [Output Only] Reserved for future use.
+  &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined fully-qualified URL for this resource.
+  &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
+  &quot;shareSettings&quot;: { # The share setting for reservations and sole tenancy node groups. # Share-settings for shared-reservation
+    &quot;folderMap&quot;: { # A map of folder id and folder config to specify consumer projects for this shared-reservation. This is only valid when share_type&#x27;s value is DIRECT_PROJECTS_UNDER_SPECIFIC_FOLDERS.
+      &quot;a_key&quot;: { # Config for each folder in the share settings.
+        &quot;folderId&quot;: &quot;A String&quot;, # The folder ID, should be same as the key of this folder config in the parent map.
+      },
+    },
+    &quot;projects&quot;: [ # A List of Project names to specify consumer projects for this shared-reservation. This is only valid when share_type&#x27;s value is SPECIFIC_PROJECTS.
+      &quot;A String&quot;,
+    ],
+    &quot;shareType&quot;: &quot;A String&quot;, # Type of sharing for this shared-reservation
+  },
+  &quot;specificReservation&quot;: { # This reservation type allows to pre allocate specific instance configuration. # Reservation for instances with specific machine shapes.
+    &quot;count&quot;: &quot;A String&quot;, # Specifies the number of resources that are allocated.
+    &quot;inUseCount&quot;: &quot;A String&quot;, # [Output Only] Indicates how many instances are in use.
+    &quot;instanceProperties&quot;: { # Properties of the SKU instances being reserved. Next ID: 9 # The instance properties for the reservation.
+      &quot;guestAccelerators&quot;: [ # Specifies accelerator type and count.
+        { # A specification of the type and number of accelerator cards attached to the instance.
+          &quot;acceleratorCount&quot;: 42, # The number of the guest accelerator cards exposed to this instance.
+          &quot;acceleratorType&quot;: &quot;A String&quot;, # Full or partial URL of the accelerator type resource to attach to this instance. For example: projects/my-project/zones/us-central1-c/acceleratorTypes/nvidia-tesla-p100 If you are creating an instance template, specify only the accelerator name. See GPUs on Compute Engine for a full list of accelerator types.
+        },
+      ],
+      &quot;localSsds&quot;: [ # Specifies amount of local ssd to reserve with each instance. The type of disk is local-ssd.
+        {
+          &quot;diskSizeGb&quot;: &quot;A String&quot;, # Specifies the size of the disk in base-2 GB.
+          &quot;interface&quot;: &quot;A String&quot;, # Specifies the disk interface to use for attaching this disk, which is either SCSI or NVME. The default is SCSI. For performance characteristics of SCSI over NVMe, see Local SSD performance.
+        },
+      ],
+      &quot;locationHint&quot;: &quot;A String&quot;, # An opaque location hint used to place the allocation close to other resources. This field is for use by internal tools that use the public API.
+      &quot;machineType&quot;: &quot;A String&quot;, # Specifies type of machine (name only) which has fixed number of vCPUs and fixed amount of memory. This also includes specifying custom machine type following custom-NUMBER_OF_CPUS-AMOUNT_OF_MEMORY pattern.
+      &quot;maintenanceFreezeDurationHours&quot;: 42, # Specifies the number of hours after reservation creation where instances using the reservation won&#x27;t be scheduled for maintenance.
+      &quot;maintenanceInterval&quot;: &quot;A String&quot;, # For more information about maintenance intervals, see Setting maintenance intervals.
+      &quot;minCpuPlatform&quot;: &quot;A String&quot;, # Minimum cpu platform the reservation.
+    },
+  },
+  &quot;specificReservationRequired&quot;: True or False, # Indicates whether the reservation can be consumed by VMs with affinity for &quot;any&quot; reservation. If the field is set, then only VMs that target the reservation by name can consume from this reservation.
+  &quot;status&quot;: &quot;A String&quot;, # [Output Only] The status of the reservation.
+  &quot;zone&quot;: &quot;A String&quot;, # Zone in which the reservation resides. A zone must be provided if the reservation is created within a commitment.
+}
+
+  paths: string, A parameter (repeated)
+  requestId: string, An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported ( 00000000-0000-0000-0000-000000000000).
+  updateMask: string, Update_mask indicates fields to be updated as part of this request.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Represents an Operation resource. Google Compute Engine has three Operation resources: * [Global](/compute/docs/reference/rest/alpha/globalOperations) * [Regional](/compute/docs/reference/rest/alpha/regionOperations) * [Zonal](/compute/docs/reference/rest/alpha/zoneOperations) You can use an operation resource to manage asynchronous API requests. For more information, read Handling API responses. Operations can be global, regional or zonal. - For global operations, use the `globalOperations` resource. - For regional operations, use the `regionOperations` resource. - For zonal operations, use the `zonalOperations` resource. For more information, read Global, Regional, and Zonal Resources.
+  &quot;clientOperationId&quot;: &quot;A String&quot;, # [Output Only] The value of `requestId` if you provided it in the request. Not present otherwise.
+  &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Deprecated] This field is deprecated.
+  &quot;description&quot;: &quot;A String&quot;, # [Output Only] A textual description of the operation, which is set when the operation is created.
+  &quot;endTime&quot;: &quot;A String&quot;, # [Output Only] The time that this operation was completed. This value is in RFC3339 text format.
+  &quot;error&quot;: { # [Output Only] If errors are generated during processing of the operation, this field will be populated.
+    &quot;errors&quot;: [ # [Output Only] The array of errors encountered while processing this operation.
+      {
+        &quot;code&quot;: &quot;A String&quot;, # [Output Only] The error type identifier for this error.
+        &quot;location&quot;: &quot;A String&quot;, # [Output Only] Indicates the field in the request that caused the error. This property is optional.
+        &quot;message&quot;: &quot;A String&quot;, # [Output Only] An optional, human-readable error message.
+      },
+    ],
+  },
+  &quot;httpErrorMessage&quot;: &quot;A String&quot;, # [Output Only] If the operation fails, this field contains the HTTP error message that was returned, such as `NOT FOUND`.
+  &quot;httpErrorStatusCode&quot;: 42, # [Output Only] If the operation fails, this field contains the HTTP error status code that was returned. For example, a `404` means the resource was not found.
+  &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the operation. This identifier is defined by the server.
+  &quot;insertTime&quot;: &quot;A String&quot;, # [Output Only] The time that this operation was requested. This value is in RFC3339 text format.
+  &quot;kind&quot;: &quot;compute#operation&quot;, # [Output Only] Type of the resource. Always `compute#operation` for Operation resources.
+  &quot;name&quot;: &quot;A String&quot;, # [Output Only] Name of the operation.
+  &quot;operationGroupId&quot;: &quot;A String&quot;, # [Output Only] An ID that represents a group of operations, such as when a group of operations results from a `bulkInsert` API request.
+  &quot;operationType&quot;: &quot;A String&quot;, # [Output Only] The type of operation, such as `insert`, `update`, or `delete`, and so on.
+  &quot;progress&quot;: 42, # [Output Only] An optional progress indicator that ranges from 0 to 100. There is no requirement that this be linear or support any granularity of operations. This should not be used to guess when the operation will be complete. This number should monotonically increase as the operation progresses.
+  &quot;region&quot;: &quot;A String&quot;, # [Output Only] The URL of the region where the operation resides. Only applicable when performing regional operations.
+  &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
+  &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
+  &quot;startTime&quot;: &quot;A String&quot;, # [Output Only] The time that this operation was started by the server. This value is in RFC3339 text format.
+  &quot;status&quot;: &quot;A String&quot;, # [Output Only] The status of the operation, which can be one of the following: `PENDING`, `RUNNING`, or `DONE`.
+  &quot;statusMessage&quot;: &quot;A String&quot;, # [Output Only] An optional textual description of the current status of the operation.
+  &quot;targetId&quot;: &quot;A String&quot;, # [Output Only] The unique target ID, which identifies a specific incarnation of the target resource.
+  &quot;targetLink&quot;: &quot;A String&quot;, # [Output Only] The URL of the resource that the operation modifies. For operations related to creating a snapshot, this points to the persistent disk that the snapshot was created from.
+  &quot;user&quot;: &quot;A String&quot;, # [Output Only] User who requested the operation, for example: `user@example.com`.
+  &quot;warnings&quot;: [ # [Output Only] If warning messages are generated during processing of the operation, this field will be populated.
+    {
+      &quot;code&quot;: &quot;A String&quot;, # [Output Only] A warning code, if applicable. For example, Compute Engine returns NO_RESULTS_ON_PAGE if there are no results in the response.
+      &quot;data&quot;: [ # [Output Only] Metadata about this warning in key: value format. For example: &quot;data&quot;: [ { &quot;key&quot;: &quot;scope&quot;, &quot;value&quot;: &quot;zones/us-east1-d&quot; }
+        {
+          &quot;key&quot;: &quot;A String&quot;, # [Output Only] A key that provides more detail on the warning being returned. For example, for warnings where there are no results in a list request for a particular zone, this key might be scope and the key value might be the zone name. Other examples might be a key indicating a deprecated resource and a suggested replacement, or a warning about invalid network settings (for example, if an instance attempts to perform IP forwarding but is not enabled for IP forwarding).
+          &quot;value&quot;: &quot;A String&quot;, # [Output Only] A warning data value corresponding to the key.
+        },
+      ],
+      &quot;message&quot;: &quot;A String&quot;, # [Output Only] A human-readable description of the warning code.
+    },
+  ],
+  &quot;zone&quot;: &quot;A String&quot;, # [Output Only] The URL of the zone where the operation resides. Only applicable when performing per-zone operations.
+}</pre>
+</div>
+
 </body></html>
\ No newline at end of file

docs/dyn/compute_alpha.routers.html

diff --git a/docs/dyn/compute_alpha.routers.html b/docs/dyn/compute_alpha.routers.html
index c824061..61ab6d4 100644
--- a/docs/dyn/compute_alpha.routers.html
+++ b/docs/dyn/compute_alpha.routers.html
@@ -235,15 +235,15 @@
               "rules": [ # A list of rules associated with this NAT.
                 {
                   "action": { # The action to be enforced for traffic that matches this rule.
-                    "sourceNatActiveIps": [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project.
+                    "sourceNatActiveIps": [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.
                       "A String",
                     ],
-                    "sourceNatDrainIps": [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only.
+                    "sourceNatDrainIps": [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.
                       "A String",
                     ],
                   },
                   "description": "A String", # An optional description of this rule.
-                  "match": "A String", # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions: "inIpRange(destination.ip, '1.1.0.0/16') || inIpRange(destination.ip, '2.2.0.0/16')" "destination.ip == '1.1.0.1' || destination.ip == '8.8.8.8'"
+                  "match": "A String", # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions for public NAT: "inIpRange(destination.ip, '1.1.0.0/16') || inIpRange(destination.ip, '2.2.0.0/16')" "destination.ip == '1.1.0.1' || destination.ip == '8.8.8.8'" The following example is a valid match expression for private NAT: "nexthop.hub == '/projects/my-project/global/hub/hub-1'"
                   "ruleNumber": 42, # An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.
                 },
               ],
@@ -492,15 +492,15 @@
       "rules": [ # A list of rules associated with this NAT.
         {
           "action": { # The action to be enforced for traffic that matches this rule.
-            "sourceNatActiveIps": [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project.
+            "sourceNatActiveIps": [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.
               "A String",
             ],
-            "sourceNatDrainIps": [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only.
+            "sourceNatDrainIps": [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.
               "A String",
             ],
           },
           "description": "A String", # An optional description of this rule.
-          "match": "A String", # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions: "inIpRange(destination.ip, '1.1.0.0/16') || inIpRange(destination.ip, '2.2.0.0/16')" "destination.ip == '1.1.0.1' || destination.ip == '8.8.8.8'"
+          "match": "A String", # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions for public NAT: "inIpRange(destination.ip, '1.1.0.0/16') || inIpRange(destination.ip, '2.2.0.0/16')" "destination.ip == '1.1.0.1' || destination.ip == '8.8.8.8'" The following example is a valid match expression for private NAT: "nexthop.hub == '/projects/my-project/global/hub/hub-1'"
           "ruleNumber": 42, # An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.
         },
       ],
@@ -986,15 +986,15 @@
       "rules": [ # A list of rules associated with this NAT.
         {
           "action": { # The action to be enforced for traffic that matches this rule.
-            "sourceNatActiveIps": [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project.
+            "sourceNatActiveIps": [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.
               "A String",
             ],
-            "sourceNatDrainIps": [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only.
+            "sourceNatDrainIps": [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.
               "A String",
             ],
           },
           "description": "A String", # An optional description of this rule.
-          "match": "A String", # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions: "inIpRange(destination.ip, '1.1.0.0/16') || inIpRange(destination.ip, '2.2.0.0/16')" "destination.ip == '1.1.0.1' || destination.ip == '8.8.8.8'"
+          "match": "A String", # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions for public NAT: "inIpRange(destination.ip, '1.1.0.0/16') || inIpRange(destination.ip, '2.2.0.0/16')" "destination.ip == '1.1.0.1' || destination.ip == '8.8.8.8'" The following example is a valid match expression for private NAT: "nexthop.hub == '/projects/my-project/global/hub/hub-1'"
           "ruleNumber": 42, # An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.
         },
       ],
@@ -1192,15 +1192,15 @@
           "rules": [ # A list of rules associated with this NAT.
             {
               "action": { # The action to be enforced for traffic that matches this rule.
-                "sourceNatActiveIps": [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project.
+                "sourceNatActiveIps": [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.
                   "A String",
                 ],
-                "sourceNatDrainIps": [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only.
+                "sourceNatDrainIps": [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.
                   "A String",
                 ],
               },
               "description": "A String", # An optional description of this rule.
-              "match": "A String", # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions: "inIpRange(destination.ip, '1.1.0.0/16') || inIpRange(destination.ip, '2.2.0.0/16')" "destination.ip == '1.1.0.1' || destination.ip == '8.8.8.8'"
+              "match": "A String", # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions for public NAT: "inIpRange(destination.ip, '1.1.0.0/16') || inIpRange(destination.ip, '2.2.0.0/16')" "destination.ip == '1.1.0.1' || destination.ip == '8.8.8.8'" The following example is a valid match expression for private NAT: "nexthop.hub == '/projects/my-project/global/hub/hub-1'"
               "ruleNumber": 42, # An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.
             },
           ],
@@ -1359,15 +1359,15 @@
       "rules": [ # A list of rules associated with this NAT.
         {
           "action": { # The action to be enforced for traffic that matches this rule.
-            "sourceNatActiveIps": [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project.
+            "sourceNatActiveIps": [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.
               "A String",
             ],
-            "sourceNatDrainIps": [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only.
+            "sourceNatDrainIps": [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.
               "A String",
             ],
           },
           "description": "A String", # An optional description of this rule.
-          "match": "A String", # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions: "inIpRange(destination.ip, '1.1.0.0/16') || inIpRange(destination.ip, '2.2.0.0/16')" "destination.ip == '1.1.0.1' || destination.ip == '8.8.8.8'"
+          "match": "A String", # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions for public NAT: "inIpRange(destination.ip, '1.1.0.0/16') || inIpRange(destination.ip, '2.2.0.0/16')" "destination.ip == '1.1.0.1' || destination.ip == '8.8.8.8'" The following example is a valid match expression for private NAT: "nexthop.hub == '/projects/my-project/global/hub/hub-1'"
           "ruleNumber": 42, # An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.
         },
       ],
@@ -1553,15 +1553,15 @@
       "rules": [ # A list of rules associated with this NAT.
         {
           "action": { # The action to be enforced for traffic that matches this rule.
-            "sourceNatActiveIps": [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project.
+            "sourceNatActiveIps": [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.
               "A String",
             ],
-            "sourceNatDrainIps": [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only.
+            "sourceNatDrainIps": [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.
               "A String",
             ],
           },
           "description": "A String", # An optional description of this rule.
-          "match": "A String", # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions: "inIpRange(destination.ip, '1.1.0.0/16') || inIpRange(destination.ip, '2.2.0.0/16')" "destination.ip == '1.1.0.1' || destination.ip == '8.8.8.8'"
+          "match": "A String", # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions for public NAT: "inIpRange(destination.ip, '1.1.0.0/16') || inIpRange(destination.ip, '2.2.0.0/16')" "destination.ip == '1.1.0.1' || destination.ip == '8.8.8.8'" The following example is a valid match expression for private NAT: "nexthop.hub == '/projects/my-project/global/hub/hub-1'"
           "ruleNumber": 42, # An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.
         },
       ],
@@ -1688,15 +1688,15 @@
         "rules": [ # A list of rules associated with this NAT.
           {
             "action": { # The action to be enforced for traffic that matches this rule.
-              "sourceNatActiveIps": [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project.
+              "sourceNatActiveIps": [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.
                 "A String",
               ],
-              "sourceNatDrainIps": [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only.
+              "sourceNatDrainIps": [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.
                 "A String",
               ],
             },
             "description": "A String", # An optional description of this rule.
-            "match": "A String", # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions: "inIpRange(destination.ip, '1.1.0.0/16') || inIpRange(destination.ip, '2.2.0.0/16')" "destination.ip == '1.1.0.1' || destination.ip == '8.8.8.8'"
+            "match": "A String", # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions for public NAT: "inIpRange(destination.ip, '1.1.0.0/16') || inIpRange(destination.ip, '2.2.0.0/16')" "destination.ip == '1.1.0.1' || destination.ip == '8.8.8.8'" The following example is a valid match expression for private NAT: "nexthop.hub == '/projects/my-project/global/hub/hub-1'"
             "ruleNumber": 42, # An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.
           },
         ],
@@ -1859,15 +1859,15 @@
       "rules": [ # A list of rules associated with this NAT.
         {
           "action": { # The action to be enforced for traffic that matches this rule.
-            "sourceNatActiveIps": [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project.
+            "sourceNatActiveIps": [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.
               "A String",
             ],
-            "sourceNatDrainIps": [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only.
+            "sourceNatDrainIps": [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.
               "A String",
             ],
           },
           "description": "A String", # An optional description of this rule.
-          "match": "A String", # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions: "inIpRange(destination.ip, '1.1.0.0/16') || inIpRange(destination.ip, '2.2.0.0/16')" "destination.ip == '1.1.0.1' || destination.ip == '8.8.8.8'"
+          "match": "A String", # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions for public NAT: "inIpRange(destination.ip, '1.1.0.0/16') || inIpRange(destination.ip, '2.2.0.0/16')" "destination.ip == '1.1.0.1' || destination.ip == '8.8.8.8'" The following example is a valid match expression for private NAT: "nexthop.hub == '/projects/my-project/global/hub/hub-1'"
           "ruleNumber": 42, # An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.
         },
       ],

docs/dyn/compute_alpha.securityPolicies.html

diff --git a/docs/dyn/compute_alpha.securityPolicies.html b/docs/dyn/compute_alpha.securityPolicies.html
index a6a4916..96257fb 100644
--- a/docs/dyn/compute_alpha.securityPolicies.html
+++ b/docs/dyn/compute_alpha.securityPolicies.html
@@ -189,7 +189,8 @@
       "intervalSec": 42, # Interval over which the threshold is computed.
     },
     "conformAction": "A String", # Action to take for requests that are under the configured rate limit threshold. Valid option is "allow" only.
-    "enforceOnKey": "A String", # Determines the key to enforce the threshold_rps limit on. If key is "IP", each IP has this limit enforced separately, whereas "ALL_IPs" means a single limit is applied to all requests matching this rule.
+    "enforceOnKey": "A String", # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field 'enforce_on_key' is not configured. “ALL_IPS” -- This definition, equivalent to "ALL", has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+    "enforceOnKeyName": "A String", # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
     "exceedAction": "A String", # When a request is denied, returns the HTTP response code specified. Valid options are "deny()" where valid values for status are 403, 404, 429, and 502.
     "rateLimitThreshold": { # Threshold at which to begin ratelimiting.
       "count": 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -390,7 +391,8 @@
                   "intervalSec": 42, # Interval over which the threshold is computed.
                 },
                 "conformAction": "A String", # Action to take for requests that are under the configured rate limit threshold. Valid option is "allow" only.
-                "enforceOnKey": "A String", # Determines the key to enforce the threshold_rps limit on. If key is "IP", each IP has this limit enforced separately, whereas "ALL_IPs" means a single limit is applied to all requests matching this rule.
+                "enforceOnKey": "A String", # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field 'enforce_on_key' is not configured. “ALL_IPS” -- This definition, equivalent to "ALL", has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+                "enforceOnKeyName": "A String", # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
                 "exceedAction": "A String", # When a request is denied, returns the HTTP response code specified. Valid options are "deny()" where valid values for status are 403, 404, 429, and 502.
                 "rateLimitThreshold": { # Threshold at which to begin ratelimiting.
                   "count": 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -414,7 +416,7 @@
           ],
           "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
           "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
-          "type": "A String", # The type indicates the intended use of the security policy. CLOUD_ARMOR policies apply to backend services. FIREWALL policies apply to organizations.
+          "type": "A String", # The type indicates the intended use of the security policy. CLOUD_ARMOR - Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services. They filter requests before they hit the origin servers. CLOUD_ARMOR_EDGE - Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services (including Cloud CDN-enabled) as well as backend buckets (GCS). They filter requests before the request is served from Google’s cache.
         },
       ],
       "warning": { # Informational warning which replaces the list of security policies when the list is empty.
@@ -642,7 +644,8 @@
           "intervalSec": 42, # Interval over which the threshold is computed.
         },
         "conformAction": "A String", # Action to take for requests that are under the configured rate limit threshold. Valid option is "allow" only.
-        "enforceOnKey": "A String", # Determines the key to enforce the threshold_rps limit on. If key is "IP", each IP has this limit enforced separately, whereas "ALL_IPs" means a single limit is applied to all requests matching this rule.
+        "enforceOnKey": "A String", # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field 'enforce_on_key' is not configured. “ALL_IPS” -- This definition, equivalent to "ALL", has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+        "enforceOnKeyName": "A String", # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
         "exceedAction": "A String", # When a request is denied, returns the HTTP response code specified. Valid options are "deny()" where valid values for status are 403, 404, 429, and 502.
         "rateLimitThreshold": { # Threshold at which to begin ratelimiting.
           "count": 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -666,7 +669,7 @@
   ],
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
-  "type": "A String", # The type indicates the intended use of the security policy. CLOUD_ARMOR policies apply to backend services. FIREWALL policies apply to organizations.
+  "type": "A String", # The type indicates the intended use of the security policy. CLOUD_ARMOR - Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services. They filter requests before they hit the origin servers. CLOUD_ARMOR_EDGE - Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services (including Cloud CDN-enabled) as well as backend buckets (GCS). They filter requests before the request is served from Google’s cache.
 }</pre>
 </div>
 
@@ -742,7 +745,8 @@
       &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
     },
     &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-    &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+    &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+    &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
     &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
     &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
       &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -870,7 +874,8 @@
           &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
         },
         &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-        &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+        &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+        &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
         &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
         &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
           &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -894,7 +899,7 @@
   ],
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
-  &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR policies apply to backend services. FIREWALL policies apply to organizations.
+  &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR - Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services. They filter requests before they hit the origin servers. CLOUD_ARMOR_EDGE - Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services (including Cloud CDN-enabled) as well as backend buckets (GCS). They filter requests before the request is served from Google’s cache.
 }
 
   requestId: string, An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported ( 00000000-0000-0000-0000-000000000000).
@@ -1074,7 +1079,8 @@
               &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
             },
             &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-            &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+            &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+            &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
             &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
             &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
               &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -1098,7 +1104,7 @@
       ],
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
       &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
-      &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR policies apply to backend services. FIREWALL policies apply to organizations.
+      &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR - Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services. They filter requests before they hit the origin servers. CLOUD_ARMOR_EDGE - Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services (including Cloud CDN-enabled) as well as backend buckets (GCS). They filter requests before the request is served from Google’s cache.
     },
   ],
   &quot;kind&quot;: &quot;compute#securityPolicyList&quot;, # [Output Only] Type of resource. Always compute#securityPolicyList for listsof securityPolicies
@@ -1279,7 +1285,8 @@
           &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
         },
         &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-        &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+        &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+        &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
         &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
         &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
           &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -1303,7 +1310,7 @@
   ],
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
-  &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR policies apply to backend services. FIREWALL policies apply to organizations.
+  &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR - Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services. They filter requests before they hit the origin servers. CLOUD_ARMOR_EDGE - Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services (including Cloud CDN-enabled) as well as backend buckets (GCS). They filter requests before the request is served from Google’s cache.
 }
 
   requestId: string, An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported ( 00000000-0000-0000-0000-000000000000).
@@ -1429,7 +1436,8 @@
       &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
     },
     &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-    &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+    &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+    &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
     &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
     &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
       &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.

docs/dyn/compute_alpha.serviceAttachments.html

diff --git a/docs/dyn/compute_alpha.serviceAttachments.html b/docs/dyn/compute_alpha.serviceAttachments.html
index 051c64b..acbbe79 100644
--- a/docs/dyn/compute_alpha.serviceAttachments.html
+++ b/docs/dyn/compute_alpha.serviceAttachments.html
@@ -140,7 +140,6 @@
           "connectedEndpoints": [ # [Output Only] An array of connections for all the consumers connected to this service attachment.
             { # [Output Only] A connection connected to this service attachment.
               "endpoint": "A String", # The url of a connected endpoint.
-              "forwardingRule": "A String", # The url of a consumer forwarding rule. [Deprecated] Do not use.
               "pscConnectionId": "A String", # The PSC connection id of the connected endpoint.
               "status": "A String", # The status of a connected endpoint to this service attachment.
             },
@@ -152,13 +151,6 @@
               "projectIdOrNum": "A String", # The project id or number for the project to set the limit for.
             },
           ],
-          "consumerForwardingRules": [ # [Output Only] An array of forwarding rules for all the consumers connected to this service attachment.
-            { # [Output Only] A consumer forwarding rule connected to this service attachment. [Deprecated] Do not use.
-              "forwardingRule": "A String", # The url of a consumer forwarding rule.
-              "pscConnectionId": "A String", # The PSC connection id of the PSC Forwarding Rule.
-              "status": "A String", # The status of the forwarding rule.
-            },
-          ],
           "consumerRejectLists": [ # Projects that are not allowed to connect to this service attachment. The project can be specified using its id or number.
             "A String",
           ],
@@ -317,7 +309,6 @@
   "connectedEndpoints": [ # [Output Only] An array of connections for all the consumers connected to this service attachment.
     { # [Output Only] A connection connected to this service attachment.
       "endpoint": "A String", # The url of a connected endpoint.
-      "forwardingRule": "A String", # The url of a consumer forwarding rule. [Deprecated] Do not use.
       "pscConnectionId": "A String", # The PSC connection id of the connected endpoint.
       "status": "A String", # The status of a connected endpoint to this service attachment.
     },
@@ -329,13 +320,6 @@
       "projectIdOrNum": "A String", # The project id or number for the project to set the limit for.
     },
   ],
-  "consumerForwardingRules": [ # [Output Only] An array of forwarding rules for all the consumers connected to this service attachment.
-    { # [Output Only] A consumer forwarding rule connected to this service attachment. [Deprecated] Do not use.
-      "forwardingRule": "A String", # The url of a consumer forwarding rule.
-      "pscConnectionId": "A String", # The PSC connection id of the PSC Forwarding Rule.
-      "status": "A String", # The status of the forwarding rule.
-    },
-  ],
   "consumerRejectLists": [ # Projects that are not allowed to connect to this service attachment. The project can be specified using its id or number.
     "A String",
   ],
@@ -479,7 +463,6 @@
   "connectedEndpoints": [ # [Output Only] An array of connections for all the consumers connected to this service attachment.
     { # [Output Only] A connection connected to this service attachment.
       "endpoint": "A String", # The url of a connected endpoint.
-      "forwardingRule": "A String", # The url of a consumer forwarding rule. [Deprecated] Do not use.
       "pscConnectionId": "A String", # The PSC connection id of the connected endpoint.
       "status": "A String", # The status of a connected endpoint to this service attachment.
     },
@@ -491,13 +474,6 @@
       "projectIdOrNum": "A String", # The project id or number for the project to set the limit for.
     },
   ],
-  "consumerForwardingRules": [ # [Output Only] An array of forwarding rules for all the consumers connected to this service attachment.
-    { # [Output Only] A consumer forwarding rule connected to this service attachment. [Deprecated] Do not use.
-      "forwardingRule": "A String", # The url of a consumer forwarding rule.
-      "pscConnectionId": "A String", # The PSC connection id of the PSC Forwarding Rule.
-      "status": "A String", # The status of the forwarding rule.
-    },
-  ],
   "consumerRejectLists": [ # Projects that are not allowed to connect to this service attachment. The project can be specified using its id or number.
     "A String",
   ],
@@ -605,7 +581,6 @@
       "connectedEndpoints": [ # [Output Only] An array of connections for all the consumers connected to this service attachment.
         { # [Output Only] A connection connected to this service attachment.
           "endpoint": "A String", # The url of a connected endpoint.
-          "forwardingRule": "A String", # The url of a consumer forwarding rule. [Deprecated] Do not use.
           "pscConnectionId": "A String", # The PSC connection id of the connected endpoint.
           "status": "A String", # The status of a connected endpoint to this service attachment.
         },
@@ -617,13 +592,6 @@
           "projectIdOrNum": "A String", # The project id or number for the project to set the limit for.
         },
       ],
-      "consumerForwardingRules": [ # [Output Only] An array of forwarding rules for all the consumers connected to this service attachment.
-        { # [Output Only] A consumer forwarding rule connected to this service attachment. [Deprecated] Do not use.
-          "forwardingRule": "A String", # The url of a consumer forwarding rule.
-          "pscConnectionId": "A String", # The PSC connection id of the PSC Forwarding Rule.
-          "status": "A String", # The status of the forwarding rule.
-        },
-      ],
       "consumerRejectLists": [ # Projects that are not allowed to connect to this service attachment. The project can be specified using its id or number.
         "A String",
       ],
@@ -692,7 +660,6 @@
   "connectedEndpoints": [ # [Output Only] An array of connections for all the consumers connected to this service attachment.
     { # [Output Only] A connection connected to this service attachment.
       "endpoint": "A String", # The url of a connected endpoint.
-      "forwardingRule": "A String", # The url of a consumer forwarding rule. [Deprecated] Do not use.
       "pscConnectionId": "A String", # The PSC connection id of the connected endpoint.
       "status": "A String", # The status of a connected endpoint to this service attachment.
     },
@@ -704,13 +671,6 @@
       "projectIdOrNum": "A String", # The project id or number for the project to set the limit for.
     },
   ],
-  "consumerForwardingRules": [ # [Output Only] An array of forwarding rules for all the consumers connected to this service attachment.
-    { # [Output Only] A consumer forwarding rule connected to this service attachment. [Deprecated] Do not use.
-      "forwardingRule": "A String", # The url of a consumer forwarding rule.
-      "pscConnectionId": "A String", # The PSC connection id of the PSC Forwarding Rule.
-      "status": "A String", # The status of the forwarding rule.
-    },
-  ],
   "consumerRejectLists": [ # Projects that are not allowed to connect to this service attachment. The project can be specified using its id or number.
     "A String",
   ],

docs/dyn/compute_alpha.subnetworks.html

diff --git a/docs/dyn/compute_alpha.subnetworks.html b/docs/dyn/compute_alpha.subnetworks.html
index dc45453..05059d9 100644
--- a/docs/dyn/compute_alpha.subnetworks.html
+++ b/docs/dyn/compute_alpha.subnetworks.html
@@ -102,7 +102,7 @@
   <code><a href="#list">list(project, region, filter=None, maxResults=None, orderBy=None, pageToken=None, returnPartialSuccess=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Retrieves a list of subnetworks available to the specified project.</p>
 <p class="toc_element">
-  <code><a href="#listUsable">listUsable(project, filter=None, maxResults=None, orderBy=None, pageToken=None, returnPartialSuccess=None, x__xgafv=None)</a></code></p>
+  <code><a href="#listUsable">listUsable(project, filter=None, maxResults=None, orderBy=None, pageToken=None, returnPartialSuccess=None, serviceProject=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Retrieves an aggregated list of all usable subnetworks in the project.</p>
 <p class="toc_element">
   <code><a href="#listUsable_next">listUsable_next(previous_request, previous_response)</a></code></p>
@@ -784,7 +784,7 @@
 </div>
 
 <div class="method">
-    <code class="details" id="listUsable">listUsable(project, filter=None, maxResults=None, orderBy=None, pageToken=None, returnPartialSuccess=None, x__xgafv=None)</code>
+    <code class="details" id="listUsable">listUsable(project, filter=None, maxResults=None, orderBy=None, pageToken=None, returnPartialSuccess=None, serviceProject=None, x__xgafv=None)</code>
   <pre>Retrieves an aggregated list of all usable subnetworks in the project.
 
 Args:
@@ -794,6 +794,7 @@
   orderBy: string, Sorts list results by a certain order. By default, results are returned in alphanumerical order based on the resource name. You can also sort results in descending order based on the creation timestamp using `orderBy=&quot;creationTimestamp desc&quot;`. This sorts results based on the `creationTimestamp` field in reverse chronological order (newest result first). Use this to sort resources like operations so that the newest operation is returned first. Currently, only sorting by `name` or `creationTimestamp desc` is supported.
   pageToken: string, Specifies a page token to use. Set `pageToken` to the `nextPageToken` returned by a previous list request to get the next page of results.
   returnPartialSuccess: boolean, Opt-in for partial success behavior which provides partial results in case of failure. The default value is false.
+  serviceProject: string, The project id or project number in which the subnetwork is intended to be used. Only applied for Shared VPC. See [Shared VPC documentation](https://cloud.google.com/vpc/docs/shared-vpc/)
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format

docs/dyn/compute_alpha.vpnGateways.html

diff --git a/docs/dyn/compute_alpha.vpnGateways.html b/docs/dyn/compute_alpha.vpnGateways.html
index 409ad83..ad3b144 100644
--- a/docs/dyn/compute_alpha.vpnGateways.html
+++ b/docs/dyn/compute_alpha.vpnGateways.html
@@ -146,6 +146,7 @@
           "network": "A String", # URL of the network to which this VPN gateway is attached. Provided by the client when the VPN gateway is created.
           "region": "A String", # [Output Only] URL of the region where the VPN gateway resides.
           "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
+          "stackType": "A String", # The stack type for this VPN gateway to identify the IP protocols that are enabled. If not specified, IPV4_ONLY will be used.
           "vpnInterfaces": [ # The list of VPN interfaces associated with this VPN gateway.
             { # A VPN gateway interface.
               "id": 42, # [Output Only] Numeric identifier for this VPN interface associated with the VPN gateway.
@@ -299,6 +300,7 @@
   "network": "A String", # URL of the network to which this VPN gateway is attached. Provided by the client when the VPN gateway is created.
   "region": "A String", # [Output Only] URL of the region where the VPN gateway resides.
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
+  "stackType": "A String", # The stack type for this VPN gateway to identify the IP protocols that are enabled. If not specified, IPV4_ONLY will be used.
   "vpnInterfaces": [ # The list of VPN interfaces associated with this VPN gateway.
     { # A VPN gateway interface.
       "id": 42, # [Output Only] Numeric identifier for this VPN interface associated with the VPN gateway.
@@ -371,6 +373,7 @@
   "network": "A String", # URL of the network to which this VPN gateway is attached. Provided by the client when the VPN gateway is created.
   "region": "A String", # [Output Only] URL of the region where the VPN gateway resides.
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
+  "stackType": "A String", # The stack type for this VPN gateway to identify the IP protocols that are enabled. If not specified, IPV4_ONLY will be used.
   "vpnInterfaces": [ # The list of VPN interfaces associated with this VPN gateway.
     { # A VPN gateway interface.
       "id": 42, # [Output Only] Numeric identifier for this VPN interface associated with the VPN gateway.
@@ -473,6 +476,7 @@
       "network": "A String", # URL of the network to which this VPN gateway is attached. Provided by the client when the VPN gateway is created.
       "region": "A String", # [Output Only] URL of the region where the VPN gateway resides.
       "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
+      "stackType": "A String", # The stack type for this VPN gateway to identify the IP protocols that are enabled. If not specified, IPV4_ONLY will be used.
       "vpnInterfaces": [ # The list of VPN interfaces associated with this VPN gateway.
         { # A VPN gateway interface.
           "id": 42, # [Output Only] Numeric identifier for this VPN interface associated with the VPN gateway.

docs/dyn/compute_beta.addresses.html

diff --git a/docs/dyn/compute_beta.addresses.html b/docs/dyn/compute_beta.addresses.html
index 59effc8..9ae14d7 100644
--- a/docs/dyn/compute_beta.addresses.html
+++ b/docs/dyn/compute_beta.addresses.html
@@ -130,7 +130,7 @@
   "items": { # A list of AddressesScopedList resources.
     "a_key": { # [Output Only] Name of the scope containing this set of addresses.
       "addresses": [ # [Output Only] A list of addresses contained in this scope.
-        { # Use global external addresses for GFE-based external HTTP(S) load balancers in Premium Tier. Use global internal addresses for reserved peering network range. Use regional external addresses for the following resources: - External IP addresses for VM instances - Regional external forwarding rules - Cloud NAT external IP addresses - GFE based LBs in Standard Tier - Network LBs in Premium or Standard Tier - Cloud VPN gateways (both Classic and HA) Use regional internal IP addresses for subnet IP ranges (primary and secondary). This includes: - Internal IP addresses for VM instances - Alias IP ranges of VM instances (/32 only) - Regional internal forwarding rules - Internal TCP/UDP load balancer addresses - Internal HTTP(S) load balancer addresses - Cloud DNS inbound forwarding IP addresses For more information, see Reserving a static external IP address.
+        { # Represents an IP Address resource. Google Compute Engine has two IP Address resources: * [Global (external and internal)](https://cloud.google.com/compute/docs/reference/rest/beta/globalAddresses) * [Regional (external and internal)](https://cloud.google.com/compute/docs/reference/rest/beta/addresses) For more information, see Reserving a static external IP address.
           "address": "A String", # The static IP address represented by this resource.
           "addressType": "A String", # The type of address to reserve, either INTERNAL or EXTERNAL. If unspecified, defaults to EXTERNAL.
           "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
@@ -142,11 +142,11 @@
           "labels": { # Labels for this resource. These can only be added or modified by the setLabels method. Each label key/value pair must comply with RFC1035. Label values may be empty.
             "a_key": "A String",
           },
-          "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+          "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
           "network": "A String", # The URL of the network in which to reserve the address. This field can only be used with INTERNAL type with the VPC_PEERING purpose.
-          "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Global forwarding rules can only be Premium Tier. Regional forwarding rules can be either Premium or Standard Tier. Standard Tier addresses applied to regional forwarding rules can be used with any external load balancer. Regional forwarding rules in Premium Tier can only be used with a network load balancer. If this field is not specified, it is assumed to be PREMIUM.
+          "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Internal IP addresses are always Premium Tier; global external IP addresses are always Premium Tier; regional external IP addresses can be either Standard or Premium Tier. If this field is not specified, it is assumed to be PREMIUM.
           "prefixLength": 42, # The prefix length if the resource represents an IP range.
-          "purpose": "A String", # The purpose of this resource, which can be one of the following values: - `GCE_ENDPOINT` for addresses that are used by VM instances, alias IP ranges, internal load balancers, and similar resources. - `DNS_RESOLVER` for a DNS resolver address in a subnetwork - `VPC_PEERING` for addresses that are reserved for VPC peer networks. - `NAT_AUTO` for addresses that are external IP addresses automatically reserved for Cloud NAT. - `IPSEC_INTERCONNECT` for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
+          "purpose": "A String", # The purpose of this resource, which can be one of the following values: - GCE_ENDPOINT for addresses that are used by VM instances, alias IP ranges, load balancers, and similar resources. - DNS_RESOLVER for a DNS resolver address in a subnetwork for a Cloud DNS inbound forwarder IP addresses (regional internal IP address in a subnet of a VPC network) - VPC_PEERING for global internal IP addresses used for private services access allocated ranges. - NAT_AUTO for the regional external IP addresses used by Cloud NAT when allocating addresses using . - IPSEC_INTERCONNECT for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
           "region": "A String", # [Output Only] The URL of the region where a regional address resides. For regional addresses, you must specify the region as a path parameter in the HTTP request URL. *This field is not applicable to global addresses.*
           "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
           "status": "A String", # [Output Only] The status of the address, which can be one of RESERVING, RESERVED, or IN_USE. An address that is RESERVING is currently in the process of being reserved. A RESERVED address is currently reserved and available to use. An IN_USE address is currently being used by another resource and is not available.
@@ -286,7 +286,7 @@
 Returns:
   An object of the form:
 
-    { # Use global external addresses for GFE-based external HTTP(S) load balancers in Premium Tier. Use global internal addresses for reserved peering network range. Use regional external addresses for the following resources: - External IP addresses for VM instances - Regional external forwarding rules - Cloud NAT external IP addresses - GFE based LBs in Standard Tier - Network LBs in Premium or Standard Tier - Cloud VPN gateways (both Classic and HA) Use regional internal IP addresses for subnet IP ranges (primary and secondary). This includes: - Internal IP addresses for VM instances - Alias IP ranges of VM instances (/32 only) - Regional internal forwarding rules - Internal TCP/UDP load balancer addresses - Internal HTTP(S) load balancer addresses - Cloud DNS inbound forwarding IP addresses For more information, see Reserving a static external IP address.
+    { # Represents an IP Address resource. Google Compute Engine has two IP Address resources: * [Global (external and internal)](https://cloud.google.com/compute/docs/reference/rest/beta/globalAddresses) * [Regional (external and internal)](https://cloud.google.com/compute/docs/reference/rest/beta/addresses) For more information, see Reserving a static external IP address.
   "address": "A String", # The static IP address represented by this resource.
   "addressType": "A String", # The type of address to reserve, either INTERNAL or EXTERNAL. If unspecified, defaults to EXTERNAL.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
@@ -298,11 +298,11 @@
   "labels": { # Labels for this resource. These can only be added or modified by the setLabels method. Each label key/value pair must comply with RFC1035. Label values may be empty.
     "a_key": "A String",
   },
-  "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
   "network": "A String", # The URL of the network in which to reserve the address. This field can only be used with INTERNAL type with the VPC_PEERING purpose.
-  "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Global forwarding rules can only be Premium Tier. Regional forwarding rules can be either Premium or Standard Tier. Standard Tier addresses applied to regional forwarding rules can be used with any external load balancer. Regional forwarding rules in Premium Tier can only be used with a network load balancer. If this field is not specified, it is assumed to be PREMIUM.
+  "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Internal IP addresses are always Premium Tier; global external IP addresses are always Premium Tier; regional external IP addresses can be either Standard or Premium Tier. If this field is not specified, it is assumed to be PREMIUM.
   "prefixLength": 42, # The prefix length if the resource represents an IP range.
-  "purpose": "A String", # The purpose of this resource, which can be one of the following values: - `GCE_ENDPOINT` for addresses that are used by VM instances, alias IP ranges, internal load balancers, and similar resources. - `DNS_RESOLVER` for a DNS resolver address in a subnetwork - `VPC_PEERING` for addresses that are reserved for VPC peer networks. - `NAT_AUTO` for addresses that are external IP addresses automatically reserved for Cloud NAT. - `IPSEC_INTERCONNECT` for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
+  "purpose": "A String", # The purpose of this resource, which can be one of the following values: - GCE_ENDPOINT for addresses that are used by VM instances, alias IP ranges, load balancers, and similar resources. - DNS_RESOLVER for a DNS resolver address in a subnetwork for a Cloud DNS inbound forwarder IP addresses (regional internal IP address in a subnet of a VPC network) - VPC_PEERING for global internal IP addresses used for private services access allocated ranges. - NAT_AUTO for the regional external IP addresses used by Cloud NAT when allocating addresses using . - IPSEC_INTERCONNECT for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
   "region": "A String", # [Output Only] The URL of the region where a regional address resides. For regional addresses, you must specify the region as a path parameter in the HTTP request URL. *This field is not applicable to global addresses.*
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "status": "A String", # [Output Only] The status of the address, which can be one of RESERVING, RESERVED, or IN_USE. An address that is RESERVING is currently in the process of being reserved. A RESERVED address is currently reserved and available to use. An IN_USE address is currently being used by another resource and is not available.
@@ -323,7 +323,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Use global external addresses for GFE-based external HTTP(S) load balancers in Premium Tier. Use global internal addresses for reserved peering network range. Use regional external addresses for the following resources: - External IP addresses for VM instances - Regional external forwarding rules - Cloud NAT external IP addresses - GFE based LBs in Standard Tier - Network LBs in Premium or Standard Tier - Cloud VPN gateways (both Classic and HA) Use regional internal IP addresses for subnet IP ranges (primary and secondary). This includes: - Internal IP addresses for VM instances - Alias IP ranges of VM instances (/32 only) - Regional internal forwarding rules - Internal TCP/UDP load balancer addresses - Internal HTTP(S) load balancer addresses - Cloud DNS inbound forwarding IP addresses For more information, see Reserving a static external IP address.
+{ # Represents an IP Address resource. Google Compute Engine has two IP Address resources: * [Global (external and internal)](https://cloud.google.com/compute/docs/reference/rest/beta/globalAddresses) * [Regional (external and internal)](https://cloud.google.com/compute/docs/reference/rest/beta/addresses) For more information, see Reserving a static external IP address.
   "address": "A String", # The static IP address represented by this resource.
   "addressType": "A String", # The type of address to reserve, either INTERNAL or EXTERNAL. If unspecified, defaults to EXTERNAL.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
@@ -335,11 +335,11 @@
   "labels": { # Labels for this resource. These can only be added or modified by the setLabels method. Each label key/value pair must comply with RFC1035. Label values may be empty.
     "a_key": "A String",
   },
-  "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
   "network": "A String", # The URL of the network in which to reserve the address. This field can only be used with INTERNAL type with the VPC_PEERING purpose.
-  "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Global forwarding rules can only be Premium Tier. Regional forwarding rules can be either Premium or Standard Tier. Standard Tier addresses applied to regional forwarding rules can be used with any external load balancer. Regional forwarding rules in Premium Tier can only be used with a network load balancer. If this field is not specified, it is assumed to be PREMIUM.
+  "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Internal IP addresses are always Premium Tier; global external IP addresses are always Premium Tier; regional external IP addresses can be either Standard or Premium Tier. If this field is not specified, it is assumed to be PREMIUM.
   "prefixLength": 42, # The prefix length if the resource represents an IP range.
-  "purpose": "A String", # The purpose of this resource, which can be one of the following values: - `GCE_ENDPOINT` for addresses that are used by VM instances, alias IP ranges, internal load balancers, and similar resources. - `DNS_RESOLVER` for a DNS resolver address in a subnetwork - `VPC_PEERING` for addresses that are reserved for VPC peer networks. - `NAT_AUTO` for addresses that are external IP addresses automatically reserved for Cloud NAT. - `IPSEC_INTERCONNECT` for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
+  "purpose": "A String", # The purpose of this resource, which can be one of the following values: - GCE_ENDPOINT for addresses that are used by VM instances, alias IP ranges, load balancers, and similar resources. - DNS_RESOLVER for a DNS resolver address in a subnetwork for a Cloud DNS inbound forwarder IP addresses (regional internal IP address in a subnet of a VPC network) - VPC_PEERING for global internal IP addresses used for private services access allocated ranges. - NAT_AUTO for the regional external IP addresses used by Cloud NAT when allocating addresses using . - IPSEC_INTERCONNECT for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
   "region": "A String", # [Output Only] The URL of the region where a regional address resides. For regional addresses, you must specify the region as a path parameter in the HTTP request URL. *This field is not applicable to global addresses.*
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "status": "A String", # [Output Only] The status of the address, which can be one of RESERVING, RESERVED, or IN_USE. An address that is RESERVING is currently in the process of being reserved. A RESERVED address is currently reserved and available to use. An IN_USE address is currently being used by another resource and is not available.
@@ -428,7 +428,7 @@
     { # Contains a list of addresses.
   "id": "A String", # [Output Only] Unique identifier for the resource; defined by the server.
   "items": [ # A list of Address resources.
-    { # Use global external addresses for GFE-based external HTTP(S) load balancers in Premium Tier. Use global internal addresses for reserved peering network range. Use regional external addresses for the following resources: - External IP addresses for VM instances - Regional external forwarding rules - Cloud NAT external IP addresses - GFE based LBs in Standard Tier - Network LBs in Premium or Standard Tier - Cloud VPN gateways (both Classic and HA) Use regional internal IP addresses for subnet IP ranges (primary and secondary). This includes: - Internal IP addresses for VM instances - Alias IP ranges of VM instances (/32 only) - Regional internal forwarding rules - Internal TCP/UDP load balancer addresses - Internal HTTP(S) load balancer addresses - Cloud DNS inbound forwarding IP addresses For more information, see Reserving a static external IP address.
+    { # Represents an IP Address resource. Google Compute Engine has two IP Address resources: * [Global (external and internal)](https://cloud.google.com/compute/docs/reference/rest/beta/globalAddresses) * [Regional (external and internal)](https://cloud.google.com/compute/docs/reference/rest/beta/addresses) For more information, see Reserving a static external IP address.
       "address": "A String", # The static IP address represented by this resource.
       "addressType": "A String", # The type of address to reserve, either INTERNAL or EXTERNAL. If unspecified, defaults to EXTERNAL.
       "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
@@ -440,11 +440,11 @@
       "labels": { # Labels for this resource. These can only be added or modified by the setLabels method. Each label key/value pair must comply with RFC1035. Label values may be empty.
         "a_key": "A String",
       },
-      "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+      "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
       "network": "A String", # The URL of the network in which to reserve the address. This field can only be used with INTERNAL type with the VPC_PEERING purpose.
-      "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Global forwarding rules can only be Premium Tier. Regional forwarding rules can be either Premium or Standard Tier. Standard Tier addresses applied to regional forwarding rules can be used with any external load balancer. Regional forwarding rules in Premium Tier can only be used with a network load balancer. If this field is not specified, it is assumed to be PREMIUM.
+      "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Internal IP addresses are always Premium Tier; global external IP addresses are always Premium Tier; regional external IP addresses can be either Standard or Premium Tier. If this field is not specified, it is assumed to be PREMIUM.
       "prefixLength": 42, # The prefix length if the resource represents an IP range.
-      "purpose": "A String", # The purpose of this resource, which can be one of the following values: - `GCE_ENDPOINT` for addresses that are used by VM instances, alias IP ranges, internal load balancers, and similar resources. - `DNS_RESOLVER` for a DNS resolver address in a subnetwork - `VPC_PEERING` for addresses that are reserved for VPC peer networks. - `NAT_AUTO` for addresses that are external IP addresses automatically reserved for Cloud NAT. - `IPSEC_INTERCONNECT` for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
+      "purpose": "A String", # The purpose of this resource, which can be one of the following values: - GCE_ENDPOINT for addresses that are used by VM instances, alias IP ranges, load balancers, and similar resources. - DNS_RESOLVER for a DNS resolver address in a subnetwork for a Cloud DNS inbound forwarder IP addresses (regional internal IP address in a subnet of a VPC network) - VPC_PEERING for global internal IP addresses used for private services access allocated ranges. - NAT_AUTO for the regional external IP addresses used by Cloud NAT when allocating addresses using . - IPSEC_INTERCONNECT for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
       "region": "A String", # [Output Only] The URL of the region where a regional address resides. For regional addresses, you must specify the region as a path parameter in the HTTP request URL. *This field is not applicable to global addresses.*
       "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
       "status": "A String", # [Output Only] The status of the address, which can be one of RESERVING, RESERVED, or IN_USE. An address that is RESERVING is currently in the process of being reserved. A RESERVED address is currently reserved and available to use. An IN_USE address is currently being used by another resource and is not available.

docs/dyn/compute_beta.backendServices.html

diff --git a/docs/dyn/compute_beta.backendServices.html b/docs/dyn/compute_beta.backendServices.html
index ce8c695..86d4806 100644
--- a/docs/dyn/compute_beta.backendServices.html
+++ b/docs/dyn/compute_beta.backendServices.html
@@ -229,7 +229,7 @@
           "affinityCookieTtlSec": 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
           "backends": [ # The list of backends that serve this BackendService.
             { # Message containing information of one individual backend.
-              "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+              "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
               "capacityScaler": 3.14, # A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
               "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
               "failover": True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -240,7 +240,7 @@
               "maxRate": 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
               "maxRatePerEndpoint": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
               "maxRatePerInstance": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
-              "maxUtilization": 3.14,
+              "maxUtilization": 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
             },
           ],
           "cdnPolicy": { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -591,7 +591,7 @@
   "affinityCookieTtlSec": 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   "backends": [ # The list of backends that serve this BackendService.
     { # Message containing information of one individual backend.
-      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
       "capacityScaler": 3.14, # A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
       "failover": True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -602,7 +602,7 @@
       "maxRate": 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerEndpoint": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerInstance": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
-      "maxUtilization": 3.14,
+      "maxUtilization": 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
     },
   ],
   "cdnPolicy": { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -920,7 +920,7 @@
   "affinityCookieTtlSec": 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   "backends": [ # The list of backends that serve this BackendService.
     { # Message containing information of one individual backend.
-      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
       "capacityScaler": 3.14, # A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
       "failover": True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -931,7 +931,7 @@
       "maxRate": 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerEndpoint": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerInstance": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
-      "maxUtilization": 3.14,
+      "maxUtilization": 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
     },
   ],
   "cdnPolicy": { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -1168,7 +1168,7 @@
       "affinityCookieTtlSec": 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
       "backends": [ # The list of backends that serve this BackendService.
         { # Message containing information of one individual backend.
-          "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+          "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
           "capacityScaler": 3.14, # A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
           "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
           "failover": True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -1179,7 +1179,7 @@
           "maxRate": 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
           "maxRatePerEndpoint": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
           "maxRatePerInstance": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
-          "maxUtilization": 3.14,
+          "maxUtilization": 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
         },
       ],
       "cdnPolicy": { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -1378,7 +1378,7 @@
   "affinityCookieTtlSec": 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   "backends": [ # The list of backends that serve this BackendService.
     { # Message containing information of one individual backend.
-      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
       "capacityScaler": 3.14, # A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
       "failover": True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -1389,7 +1389,7 @@
       "maxRate": 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerEndpoint": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerInstance": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
-      "maxUtilization": 3.14,
+      "maxUtilization": 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
     },
   ],
   "cdnPolicy": { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -1996,7 +1996,7 @@
   "affinityCookieTtlSec": 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   "backends": [ # The list of backends that serve this BackendService.
     { # Message containing information of one individual backend.
-      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
       "capacityScaler": 3.14, # A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
       "failover": True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -2007,7 +2007,7 @@
       "maxRate": 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerEndpoint": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerInstance": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
-      "maxUtilization": 3.14,
+      "maxUtilization": 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
     },
   ],
   "cdnPolicy": { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.

docs/dyn/compute_beta.disks.html

diff --git a/docs/dyn/compute_beta.disks.html b/docs/dyn/compute_beta.disks.html
index 2fa1b9a..2ec64d8 100644
--- a/docs/dyn/compute_beta.disks.html
+++ b/docs/dyn/compute_beta.disks.html
@@ -295,6 +295,9 @@
           "status": "A String", # [Output Only] The status of disk creation. - CREATING: Disk is provisioning. - RESTORING: Source data is being copied into the disk. - FAILED: Disk creation failed. - READY: Disk is ready for use. - DELETING: Disk is deleting.
           "storageType": "A String", # [Deprecated] Storage type of the persistent disk.
           "type": "A String", # URL of the disk type resource describing which disk type to use to create the disk. Provide this when creating the disk. For example: projects/project /zones/zone/diskTypes/pd-ssd . See Persistent disk types.
+          "userLicenses": [ # A list of publicly visible user-licenses. Unlike regular licenses, user provided licenses can be modified after the disk is created. This includes a list of URLs to the license resource. For example, to provide a debian license: https://www.googleapis.com/compute/v1/projects/debian-cloud/global/licenses/debian-9-stretch
+            "A String",
+          ],
           "users": [ # [Output Only] Links to the users of the disk (attached instances) in form: projects/project/zones/zone/instances/instance
             "A String",
           ],
@@ -621,6 +624,9 @@
   "status": "A String", # [Output Only] The status of disk creation. - CREATING: Disk is provisioning. - RESTORING: Source data is being copied into the disk. - FAILED: Disk creation failed. - READY: Disk is ready for use. - DELETING: Disk is deleting.
   "storageType": "A String", # [Deprecated] Storage type of the persistent disk.
   "type": "A String", # URL of the disk type resource describing which disk type to use to create the disk. Provide this when creating the disk. For example: projects/project /zones/zone/diskTypes/pd-ssd . See Persistent disk types.
+  "userLicenses": [ # A list of publicly visible user-licenses. Unlike regular licenses, user provided licenses can be modified after the disk is created. This includes a list of URLs to the license resource. For example, to provide a debian license: https://www.googleapis.com/compute/v1/projects/debian-cloud/global/licenses/debian-9-stretch
+    "A String",
+  ],
   "users": [ # [Output Only] Links to the users of the disk (attached instances) in form: projects/project/zones/zone/instances/instance
     "A String",
   ],
@@ -814,6 +820,9 @@
   "status": "A String", # [Output Only] The status of disk creation. - CREATING: Disk is provisioning. - RESTORING: Source data is being copied into the disk. - FAILED: Disk creation failed. - READY: Disk is ready for use. - DELETING: Disk is deleting.
   "storageType": "A String", # [Deprecated] Storage type of the persistent disk.
   "type": "A String", # URL of the disk type resource describing which disk type to use to create the disk. Provide this when creating the disk. For example: projects/project /zones/zone/diskTypes/pd-ssd . See Persistent disk types.
+  "userLicenses": [ # A list of publicly visible user-licenses. Unlike regular licenses, user provided licenses can be modified after the disk is created. This includes a list of URLs to the license resource. For example, to provide a debian license: https://www.googleapis.com/compute/v1/projects/debian-cloud/global/licenses/debian-9-stretch
+    "A String",
+  ],
   "users": [ # [Output Only] Links to the users of the disk (attached instances) in form: projects/project/zones/zone/instances/instance
     "A String",
   ],
@@ -971,6 +980,9 @@
       "status": "A String", # [Output Only] The status of disk creation. - CREATING: Disk is provisioning. - RESTORING: Source data is being copied into the disk. - FAILED: Disk creation failed. - READY: Disk is ready for use. - DELETING: Disk is deleting.
       "storageType": "A String", # [Deprecated] Storage type of the persistent disk.
       "type": "A String", # URL of the disk type resource describing which disk type to use to create the disk. Provide this when creating the disk. For example: projects/project /zones/zone/diskTypes/pd-ssd . See Persistent disk types.
+      "userLicenses": [ # A list of publicly visible user-licenses. Unlike regular licenses, user provided licenses can be modified after the disk is created. This includes a list of URLs to the license resource. For example, to provide a debian license: https://www.googleapis.com/compute/v1/projects/debian-cloud/global/licenses/debian-9-stretch
+        "A String",
+      ],
       "users": [ # [Output Only] Links to the users of the disk (attached instances) in form: projects/project/zones/zone/instances/instance
         "A String",
       ],
@@ -1551,6 +1563,9 @@
   "status": "A String", # [Output Only] The status of disk creation. - CREATING: Disk is provisioning. - RESTORING: Source data is being copied into the disk. - FAILED: Disk creation failed. - READY: Disk is ready for use. - DELETING: Disk is deleting.
   "storageType": "A String", # [Deprecated] Storage type of the persistent disk.
   "type": "A String", # URL of the disk type resource describing which disk type to use to create the disk. Provide this when creating the disk. For example: projects/project /zones/zone/diskTypes/pd-ssd . See Persistent disk types.
+  "userLicenses": [ # A list of publicly visible user-licenses. Unlike regular licenses, user provided licenses can be modified after the disk is created. This includes a list of URLs to the license resource. For example, to provide a debian license: https://www.googleapis.com/compute/v1/projects/debian-cloud/global/licenses/debian-9-stretch
+    "A String",
+  ],
   "users": [ # [Output Only] Links to the users of the disk (attached instances) in form: projects/project/zones/zone/instances/instance
     "A String",
   ],

docs/dyn/compute_beta.firewallPolicies.html

diff --git a/docs/dyn/compute_beta.firewallPolicies.html b/docs/dyn/compute_beta.firewallPolicies.html
index 51108e7..40406d5 100644
--- a/docs/dyn/compute_beta.firewallPolicies.html
+++ b/docs/dyn/compute_beta.firewallPolicies.html
@@ -226,7 +226,7 @@
   "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
   "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
   "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
       "A String",
     ],
     "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -237,7 +237,7 @@
         ],
       },
     ],
-    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
       "A String",
     ],
   },
@@ -479,7 +479,7 @@
       "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
       "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
       "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
           "A String",
         ],
         "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -490,7 +490,7 @@
             ],
           },
         ],
-        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
           "A String",
         ],
       },
@@ -660,7 +660,7 @@
   "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
   "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
   "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
       "A String",
     ],
     "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -671,7 +671,7 @@
         ],
       },
     ],
-    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
       "A String",
     ],
   },
@@ -722,7 +722,7 @@
       "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
       "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
       "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
           "A String",
         ],
         "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -733,7 +733,7 @@
             ],
           },
         ],
-        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
           "A String",
         ],
       },
@@ -859,7 +859,7 @@
           "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
           "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
           "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-            "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+            "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
               "A String",
             ],
             "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -870,7 +870,7 @@
                 ],
               },
             ],
-            "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+            "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
               "A String",
             ],
           },
@@ -1046,7 +1046,7 @@
       "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
       "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
       "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
           "A String",
         ],
         "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -1057,7 +1057,7 @@
             ],
           },
         ],
-        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
           "A String",
         ],
       },
@@ -1149,7 +1149,7 @@
   "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
   "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
   "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
       "A String",
     ],
     "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -1160,7 +1160,7 @@
         ],
       },
     ],
-    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
       "A String",
     ],
   },

docs/dyn/compute_beta.firewalls.html

diff --git a/docs/dyn/compute_beta.firewalls.html b/docs/dyn/compute_beta.firewalls.html
index 6da39d5..e36f173 100644
--- a/docs/dyn/compute_beta.firewalls.html
+++ b/docs/dyn/compute_beta.firewalls.html
@@ -204,7 +204,7 @@
     },
   ],
   "description": "A String", # An optional description of this resource. Provide this field when you create the resource.
-  "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Only IPv4 is supported.
+  "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Both IPv4 and IPv6 are supported.
     "A String",
   ],
   "direction": "A String", # Direction of traffic to which this firewall applies, either `INGRESS` or `EGRESS`. The default is `INGRESS`. For `INGRESS` traffic, you cannot specify the destinationRanges field, and for `EGRESS` traffic, you cannot specify the sourceRanges or sourceTags fields.
@@ -220,7 +220,7 @@
   "network": "A String", # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
   "priority": 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
-  "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Only IPv4 is supported.
+  "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Both IPv4 and IPv6 are supported.
     "A String",
   ],
   "sourceServiceAccounts": [ # If source service accounts are specified, the firewall rules apply only to traffic originating from an instance with a service account in this list. Source service accounts cannot be used to control traffic to an instance's external IP address because service accounts are associated with an instance, not an IP address. sourceRanges can be set at the same time as sourceServiceAccounts. If both are set, the firewall applies to traffic that has a source IP address within the sourceRanges OR a source IP that belongs to an instance with service account listed in sourceServiceAccount. The connection does not need to match both fields for the firewall to apply. sourceServiceAccounts cannot be used at the same time as sourceTags or targetTags.
@@ -266,7 +266,7 @@
     },
   ],
   "description": "A String", # An optional description of this resource. Provide this field when you create the resource.
-  "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Only IPv4 is supported.
+  "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Both IPv4 and IPv6 are supported.
     "A String",
   ],
   "direction": "A String", # Direction of traffic to which this firewall applies, either `INGRESS` or `EGRESS`. The default is `INGRESS`. For `INGRESS` traffic, you cannot specify the destinationRanges field, and for `EGRESS` traffic, you cannot specify the sourceRanges or sourceTags fields.
@@ -282,7 +282,7 @@
   "network": "A String", # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
   "priority": 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
-  "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Only IPv4 is supported.
+  "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Both IPv4 and IPv6 are supported.
     "A String",
   ],
   "sourceServiceAccounts": [ # If source service accounts are specified, the firewall rules apply only to traffic originating from an instance with a service account in this list. Source service accounts cannot be used to control traffic to an instance's external IP address because service accounts are associated with an instance, not an IP address. sourceRanges can be set at the same time as sourceServiceAccounts. If both are set, the firewall applies to traffic that has a source IP address within the sourceRanges OR a source IP that belongs to an instance with service account listed in sourceServiceAccount. The connection does not need to match both fields for the firewall to apply. sourceServiceAccounts cannot be used at the same time as sourceTags or targetTags.
@@ -396,7 +396,7 @@
         },
       ],
       "description": "A String", # An optional description of this resource. Provide this field when you create the resource.
-      "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Only IPv4 is supported.
+      "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Both IPv4 and IPv6 are supported.
         "A String",
       ],
       "direction": "A String", # Direction of traffic to which this firewall applies, either `INGRESS` or `EGRESS`. The default is `INGRESS`. For `INGRESS` traffic, you cannot specify the destinationRanges field, and for `EGRESS` traffic, you cannot specify the sourceRanges or sourceTags fields.
@@ -412,7 +412,7 @@
       "network": "A String", # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
       "priority": 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
       "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
-      "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Only IPv4 is supported.
+      "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Both IPv4 and IPv6 are supported.
         "A String",
       ],
       "sourceServiceAccounts": [ # If source service accounts are specified, the firewall rules apply only to traffic originating from an instance with a service account in this list. Source service accounts cannot be used to control traffic to an instance's external IP address because service accounts are associated with an instance, not an IP address. sourceRanges can be set at the same time as sourceServiceAccounts. If both are set, the firewall applies to traffic that has a source IP address within the sourceRanges OR a source IP that belongs to an instance with service account listed in sourceServiceAccount. The connection does not need to match both fields for the firewall to apply. sourceServiceAccounts cannot be used at the same time as sourceTags or targetTags.
@@ -488,7 +488,7 @@
     },
   ],
   "description": "A String", # An optional description of this resource. Provide this field when you create the resource.
-  "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Only IPv4 is supported.
+  "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Both IPv4 and IPv6 are supported.
     "A String",
   ],
   "direction": "A String", # Direction of traffic to which this firewall applies, either `INGRESS` or `EGRESS`. The default is `INGRESS`. For `INGRESS` traffic, you cannot specify the destinationRanges field, and for `EGRESS` traffic, you cannot specify the sourceRanges or sourceTags fields.
@@ -504,7 +504,7 @@
   "network": "A String", # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
   "priority": 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
-  "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Only IPv4 is supported.
+  "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Both IPv4 and IPv6 are supported.
     "A String",
   ],
   "sourceServiceAccounts": [ # If source service accounts are specified, the firewall rules apply only to traffic originating from an instance with a service account in this list. Source service accounts cannot be used to control traffic to an instance's external IP address because service accounts are associated with an instance, not an IP address. sourceRanges can be set at the same time as sourceServiceAccounts. If both are set, the firewall applies to traffic that has a source IP address within the sourceRanges OR a source IP that belongs to an instance with service account listed in sourceServiceAccount. The connection does not need to match both fields for the firewall to apply. sourceServiceAccounts cannot be used at the same time as sourceTags or targetTags.
@@ -637,7 +637,7 @@
     },
   ],
   "description": "A String", # An optional description of this resource. Provide this field when you create the resource.
-  "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Only IPv4 is supported.
+  "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Both IPv4 and IPv6 are supported.
     "A String",
   ],
   "direction": "A String", # Direction of traffic to which this firewall applies, either `INGRESS` or `EGRESS`. The default is `INGRESS`. For `INGRESS` traffic, you cannot specify the destinationRanges field, and for `EGRESS` traffic, you cannot specify the sourceRanges or sourceTags fields.
@@ -653,7 +653,7 @@
   "network": "A String", # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
   "priority": 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
-  "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Only IPv4 is supported.
+  "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Both IPv4 and IPv6 are supported.
     "A String",
   ],
   "sourceServiceAccounts": [ # If source service accounts are specified, the firewall rules apply only to traffic originating from an instance with a service account in this list. Source service accounts cannot be used to control traffic to an instance's external IP address because service accounts are associated with an instance, not an IP address. sourceRanges can be set at the same time as sourceServiceAccounts. If both are set, the firewall applies to traffic that has a source IP address within the sourceRanges OR a source IP that belongs to an instance with service account listed in sourceServiceAccount. The connection does not need to match both fields for the firewall to apply. sourceServiceAccounts cannot be used at the same time as sourceTags or targetTags.

docs/dyn/compute_beta.globalAddresses.html

diff --git a/docs/dyn/compute_beta.globalAddresses.html b/docs/dyn/compute_beta.globalAddresses.html
index 256cb09..a249776 100644
--- a/docs/dyn/compute_beta.globalAddresses.html
+++ b/docs/dyn/compute_beta.globalAddresses.html
@@ -182,7 +182,7 @@
 Returns:
   An object of the form:
 
-    { # Use global external addresses for GFE-based external HTTP(S) load balancers in Premium Tier. Use global internal addresses for reserved peering network range. Use regional external addresses for the following resources: - External IP addresses for VM instances - Regional external forwarding rules - Cloud NAT external IP addresses - GFE based LBs in Standard Tier - Network LBs in Premium or Standard Tier - Cloud VPN gateways (both Classic and HA) Use regional internal IP addresses for subnet IP ranges (primary and secondary). This includes: - Internal IP addresses for VM instances - Alias IP ranges of VM instances (/32 only) - Regional internal forwarding rules - Internal TCP/UDP load balancer addresses - Internal HTTP(S) load balancer addresses - Cloud DNS inbound forwarding IP addresses For more information, see Reserving a static external IP address.
+    { # Represents an IP Address resource. Google Compute Engine has two IP Address resources: * [Global (external and internal)](https://cloud.google.com/compute/docs/reference/rest/beta/globalAddresses) * [Regional (external and internal)](https://cloud.google.com/compute/docs/reference/rest/beta/addresses) For more information, see Reserving a static external IP address.
   "address": "A String", # The static IP address represented by this resource.
   "addressType": "A String", # The type of address to reserve, either INTERNAL or EXTERNAL. If unspecified, defaults to EXTERNAL.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
@@ -194,11 +194,11 @@
   "labels": { # Labels for this resource. These can only be added or modified by the setLabels method. Each label key/value pair must comply with RFC1035. Label values may be empty.
     "a_key": "A String",
   },
-  "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
   "network": "A String", # The URL of the network in which to reserve the address. This field can only be used with INTERNAL type with the VPC_PEERING purpose.
-  "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Global forwarding rules can only be Premium Tier. Regional forwarding rules can be either Premium or Standard Tier. Standard Tier addresses applied to regional forwarding rules can be used with any external load balancer. Regional forwarding rules in Premium Tier can only be used with a network load balancer. If this field is not specified, it is assumed to be PREMIUM.
+  "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Internal IP addresses are always Premium Tier; global external IP addresses are always Premium Tier; regional external IP addresses can be either Standard or Premium Tier. If this field is not specified, it is assumed to be PREMIUM.
   "prefixLength": 42, # The prefix length if the resource represents an IP range.
-  "purpose": "A String", # The purpose of this resource, which can be one of the following values: - `GCE_ENDPOINT` for addresses that are used by VM instances, alias IP ranges, internal load balancers, and similar resources. - `DNS_RESOLVER` for a DNS resolver address in a subnetwork - `VPC_PEERING` for addresses that are reserved for VPC peer networks. - `NAT_AUTO` for addresses that are external IP addresses automatically reserved for Cloud NAT. - `IPSEC_INTERCONNECT` for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
+  "purpose": "A String", # The purpose of this resource, which can be one of the following values: - GCE_ENDPOINT for addresses that are used by VM instances, alias IP ranges, load balancers, and similar resources. - DNS_RESOLVER for a DNS resolver address in a subnetwork for a Cloud DNS inbound forwarder IP addresses (regional internal IP address in a subnet of a VPC network) - VPC_PEERING for global internal IP addresses used for private services access allocated ranges. - NAT_AUTO for the regional external IP addresses used by Cloud NAT when allocating addresses using . - IPSEC_INTERCONNECT for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
   "region": "A String", # [Output Only] The URL of the region where a regional address resides. For regional addresses, you must specify the region as a path parameter in the HTTP request URL. *This field is not applicable to global addresses.*
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "status": "A String", # [Output Only] The status of the address, which can be one of RESERVING, RESERVED, or IN_USE. An address that is RESERVING is currently in the process of being reserved. A RESERVED address is currently reserved and available to use. An IN_USE address is currently being used by another resource and is not available.
@@ -218,7 +218,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Use global external addresses for GFE-based external HTTP(S) load balancers in Premium Tier. Use global internal addresses for reserved peering network range. Use regional external addresses for the following resources: - External IP addresses for VM instances - Regional external forwarding rules - Cloud NAT external IP addresses - GFE based LBs in Standard Tier - Network LBs in Premium or Standard Tier - Cloud VPN gateways (both Classic and HA) Use regional internal IP addresses for subnet IP ranges (primary and secondary). This includes: - Internal IP addresses for VM instances - Alias IP ranges of VM instances (/32 only) - Regional internal forwarding rules - Internal TCP/UDP load balancer addresses - Internal HTTP(S) load balancer addresses - Cloud DNS inbound forwarding IP addresses For more information, see Reserving a static external IP address.
+{ # Represents an IP Address resource. Google Compute Engine has two IP Address resources: * [Global (external and internal)](https://cloud.google.com/compute/docs/reference/rest/beta/globalAddresses) * [Regional (external and internal)](https://cloud.google.com/compute/docs/reference/rest/beta/addresses) For more information, see Reserving a static external IP address.
   "address": "A String", # The static IP address represented by this resource.
   "addressType": "A String", # The type of address to reserve, either INTERNAL or EXTERNAL. If unspecified, defaults to EXTERNAL.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
@@ -230,11 +230,11 @@
   "labels": { # Labels for this resource. These can only be added or modified by the setLabels method. Each label key/value pair must comply with RFC1035. Label values may be empty.
     "a_key": "A String",
   },
-  "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
   "network": "A String", # The URL of the network in which to reserve the address. This field can only be used with INTERNAL type with the VPC_PEERING purpose.
-  "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Global forwarding rules can only be Premium Tier. Regional forwarding rules can be either Premium or Standard Tier. Standard Tier addresses applied to regional forwarding rules can be used with any external load balancer. Regional forwarding rules in Premium Tier can only be used with a network load balancer. If this field is not specified, it is assumed to be PREMIUM.
+  "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Internal IP addresses are always Premium Tier; global external IP addresses are always Premium Tier; regional external IP addresses can be either Standard or Premium Tier. If this field is not specified, it is assumed to be PREMIUM.
   "prefixLength": 42, # The prefix length if the resource represents an IP range.
-  "purpose": "A String", # The purpose of this resource, which can be one of the following values: - `GCE_ENDPOINT` for addresses that are used by VM instances, alias IP ranges, internal load balancers, and similar resources. - `DNS_RESOLVER` for a DNS resolver address in a subnetwork - `VPC_PEERING` for addresses that are reserved for VPC peer networks. - `NAT_AUTO` for addresses that are external IP addresses automatically reserved for Cloud NAT. - `IPSEC_INTERCONNECT` for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
+  "purpose": "A String", # The purpose of this resource, which can be one of the following values: - GCE_ENDPOINT for addresses that are used by VM instances, alias IP ranges, load balancers, and similar resources. - DNS_RESOLVER for a DNS resolver address in a subnetwork for a Cloud DNS inbound forwarder IP addresses (regional internal IP address in a subnet of a VPC network) - VPC_PEERING for global internal IP addresses used for private services access allocated ranges. - NAT_AUTO for the regional external IP addresses used by Cloud NAT when allocating addresses using . - IPSEC_INTERCONNECT for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
   "region": "A String", # [Output Only] The URL of the region where a regional address resides. For regional addresses, you must specify the region as a path parameter in the HTTP request URL. *This field is not applicable to global addresses.*
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "status": "A String", # [Output Only] The status of the address, which can be one of RESERVING, RESERVED, or IN_USE. An address that is RESERVING is currently in the process of being reserved. A RESERVED address is currently reserved and available to use. An IN_USE address is currently being used by another resource and is not available.
@@ -322,7 +322,7 @@
     { # Contains a list of addresses.
   "id": "A String", # [Output Only] Unique identifier for the resource; defined by the server.
   "items": [ # A list of Address resources.
-    { # Use global external addresses for GFE-based external HTTP(S) load balancers in Premium Tier. Use global internal addresses for reserved peering network range. Use regional external addresses for the following resources: - External IP addresses for VM instances - Regional external forwarding rules - Cloud NAT external IP addresses - GFE based LBs in Standard Tier - Network LBs in Premium or Standard Tier - Cloud VPN gateways (both Classic and HA) Use regional internal IP addresses for subnet IP ranges (primary and secondary). This includes: - Internal IP addresses for VM instances - Alias IP ranges of VM instances (/32 only) - Regional internal forwarding rules - Internal TCP/UDP load balancer addresses - Internal HTTP(S) load balancer addresses - Cloud DNS inbound forwarding IP addresses For more information, see Reserving a static external IP address.
+    { # Represents an IP Address resource. Google Compute Engine has two IP Address resources: * [Global (external and internal)](https://cloud.google.com/compute/docs/reference/rest/beta/globalAddresses) * [Regional (external and internal)](https://cloud.google.com/compute/docs/reference/rest/beta/addresses) For more information, see Reserving a static external IP address.
       "address": "A String", # The static IP address represented by this resource.
       "addressType": "A String", # The type of address to reserve, either INTERNAL or EXTERNAL. If unspecified, defaults to EXTERNAL.
       "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
@@ -334,11 +334,11 @@
       "labels": { # Labels for this resource. These can only be added or modified by the setLabels method. Each label key/value pair must comply with RFC1035. Label values may be empty.
         "a_key": "A String",
       },
-      "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+      "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
       "network": "A String", # The URL of the network in which to reserve the address. This field can only be used with INTERNAL type with the VPC_PEERING purpose.
-      "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Global forwarding rules can only be Premium Tier. Regional forwarding rules can be either Premium or Standard Tier. Standard Tier addresses applied to regional forwarding rules can be used with any external load balancer. Regional forwarding rules in Premium Tier can only be used with a network load balancer. If this field is not specified, it is assumed to be PREMIUM.
+      "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Internal IP addresses are always Premium Tier; global external IP addresses are always Premium Tier; regional external IP addresses can be either Standard or Premium Tier. If this field is not specified, it is assumed to be PREMIUM.
       "prefixLength": 42, # The prefix length if the resource represents an IP range.
-      "purpose": "A String", # The purpose of this resource, which can be one of the following values: - `GCE_ENDPOINT` for addresses that are used by VM instances, alias IP ranges, internal load balancers, and similar resources. - `DNS_RESOLVER` for a DNS resolver address in a subnetwork - `VPC_PEERING` for addresses that are reserved for VPC peer networks. - `NAT_AUTO` for addresses that are external IP addresses automatically reserved for Cloud NAT. - `IPSEC_INTERCONNECT` for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
+      "purpose": "A String", # The purpose of this resource, which can be one of the following values: - GCE_ENDPOINT for addresses that are used by VM instances, alias IP ranges, load balancers, and similar resources. - DNS_RESOLVER for a DNS resolver address in a subnetwork for a Cloud DNS inbound forwarder IP addresses (regional internal IP address in a subnet of a VPC network) - VPC_PEERING for global internal IP addresses used for private services access allocated ranges. - NAT_AUTO for the regional external IP addresses used by Cloud NAT when allocating addresses using . - IPSEC_INTERCONNECT for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
       "region": "A String", # [Output Only] The URL of the region where a regional address resides. For regional addresses, you must specify the region as a path parameter in the HTTP request URL. *This field is not applicable to global addresses.*
       "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
       "status": "A String", # [Output Only] The status of the address, which can be one of RESERVING, RESERVED, or IN_USE. An address that is RESERVING is currently in the process of being reserved. A RESERVED address is currently reserved and available to use. An IN_USE address is currently being used by another resource and is not available.

docs/dyn/compute_beta.healthChecks.html

diff --git a/docs/dyn/compute_beta.healthChecks.html b/docs/dyn/compute_beta.healthChecks.html
index 42fd73d..30a370b 100644
--- a/docs/dyn/compute_beta.healthChecks.html
+++ b/docs/dyn/compute_beta.healthChecks.html
@@ -133,7 +133,7 @@
   "items": { # A list of HealthChecksScopedList resources.
     "a_key": { # Name of the scope containing this set of HealthChecks.
       "healthChecks": [ # A list of HealthChecks contained in this scope.
-        { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/beta/healthChecks) * [Regional](/compute/docs/reference/rest/beta/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+        { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/beta/healthChecks) * [Regional](/compute/docs/reference/rest/beta/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
           "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
           "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
           "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -328,7 +328,7 @@
 Returns:
   An object of the form:
 
-    { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/beta/healthChecks) * [Regional](/compute/docs/reference/rest/beta/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+    { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/beta/healthChecks) * [Regional](/compute/docs/reference/rest/beta/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -405,7 +405,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/beta/healthChecks) * [Regional](/compute/docs/reference/rest/beta/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/beta/healthChecks) * [Regional](/compute/docs/reference/rest/beta/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -550,7 +550,7 @@
     { # Contains a list of HealthCheck resources.
   "id": "A String", # [Output Only] Unique identifier for the resource; defined by the server.
   "items": [ # A list of HealthCheck resources.
-    { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/beta/healthChecks) * [Regional](/compute/docs/reference/rest/beta/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+    { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/beta/healthChecks) * [Regional](/compute/docs/reference/rest/beta/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
       "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
       "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -657,7 +657,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/beta/healthChecks) * [Regional](/compute/docs/reference/rest/beta/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/beta/healthChecks) * [Regional](/compute/docs/reference/rest/beta/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -821,7 +821,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/beta/healthChecks) * [Regional](/compute/docs/reference/rest/beta/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/beta/healthChecks) * [Regional](/compute/docs/reference/rest/beta/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.

docs/dyn/compute_beta.httpHealthChecks.html

diff --git a/docs/dyn/compute_beta.httpHealthChecks.html b/docs/dyn/compute_beta.httpHealthChecks.html
index 20cd261..c3208d1 100644
--- a/docs/dyn/compute_beta.httpHealthChecks.html
+++ b/docs/dyn/compute_beta.httpHealthChecks.html
@@ -185,7 +185,7 @@
 Returns:
   An object of the form:
 
-    { # Represents a legacy HTTP Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+    { # Represents a legacy HTTP Health Check resource. Legacy HTTP health checks are now only required by target pool-based network load balancers. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -211,7 +211,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a legacy HTTP Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+{ # Represents a legacy HTTP Health Check resource. Legacy HTTP health checks are now only required by target pool-based network load balancers. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -305,7 +305,7 @@
     { # Contains a list of HttpHealthCheck resources.
   "id": "A String", # [Output Only] Unique identifier for the resource; defined by the server.
   "items": [ # A list of HttpHealthCheck resources.
-    { # Represents a legacy HTTP Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+    { # Represents a legacy HTTP Health Check resource. Legacy HTTP health checks are now only required by target pool-based network load balancers. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
       "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
       "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -361,7 +361,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a legacy HTTP Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+{ # Represents a legacy HTTP Health Check resource. Legacy HTTP health checks are now only required by target pool-based network load balancers. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -474,7 +474,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a legacy HTTP Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+{ # Represents a legacy HTTP Health Check resource. Legacy HTTP health checks are now only required by target pool-based network load balancers. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.

docs/dyn/compute_beta.httpsHealthChecks.html

diff --git a/docs/dyn/compute_beta.httpsHealthChecks.html b/docs/dyn/compute_beta.httpsHealthChecks.html
index e697871..1bc9e3e 100644
--- a/docs/dyn/compute_beta.httpsHealthChecks.html
+++ b/docs/dyn/compute_beta.httpsHealthChecks.html
@@ -185,7 +185,7 @@
 Returns:
   An object of the form:
 
-    { # Represents a legacy HTTPS Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+    { # Represents a legacy HTTPS Health Check resource. Legacy HTTPS health checks have been deprecated. If you are using a target pool-based network load balancer, you must use a legacy HTTP (not HTTPS) health check. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -211,7 +211,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a legacy HTTPS Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+{ # Represents a legacy HTTPS Health Check resource. Legacy HTTPS health checks have been deprecated. If you are using a target pool-based network load balancer, you must use a legacy HTTP (not HTTPS) health check. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -305,7 +305,7 @@
     { # Contains a list of HttpsHealthCheck resources.
   "id": "A String", # [Output Only] Unique identifier for the resource; defined by the server.
   "items": [ # A list of HttpsHealthCheck resources.
-    { # Represents a legacy HTTPS Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+    { # Represents a legacy HTTPS Health Check resource. Legacy HTTPS health checks have been deprecated. If you are using a target pool-based network load balancer, you must use a legacy HTTP (not HTTPS) health check. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
       "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
       "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -361,7 +361,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a legacy HTTPS Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+{ # Represents a legacy HTTPS Health Check resource. Legacy HTTPS health checks have been deprecated. If you are using a target pool-based network load balancer, you must use a legacy HTTP (not HTTPS) health check. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -474,7 +474,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a legacy HTTPS Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+{ # Represents a legacy HTTPS Health Check resource. Legacy HTTPS health checks have been deprecated. If you are using a target pool-based network load balancer, you must use a legacy HTTP (not HTTPS) health check. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.

docs/dyn/compute_beta.imageFamilyViews.html

diff --git a/docs/dyn/compute_beta.imageFamilyViews.html b/docs/dyn/compute_beta.imageFamilyViews.html
index 0ee012f..20ee614 100644
--- a/docs/dyn/compute_beta.imageFamilyViews.html
+++ b/docs/dyn/compute_beta.imageFamilyViews.html
@@ -150,7 +150,7 @@
     "rawDisk": { # The parameters of the raw disk image.
       "containerType": "A String", # The format used to encode and transmit the block device, which should be TAR. This is just a container and transmission format and not a runtime format. Provided by the client when the disk image is created.
       "sha1Checksum": "A String", # [Deprecated] This field is deprecated. An optional SHA1 checksum of the disk image before unpackaging provided by the client when the disk image is created.
-      "source": "A String", # The full Google Cloud Storage URL where the disk image is stored. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+      "source": "A String", # The full Google Cloud Storage URL where the raw disk image archive is stored. The following are valid formats for the URL: - https://storage.googleapis.com/bucket_name/image_archive_name - https://storage.googleapis.com/bucket_name/folder_name/ image_archive_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
     },
     "rolloutOverride": { # A rollout policy configuration. # A rollout policy to apply to this image. When specified, the rollout policy overrides per-zone references to the image via the associated image family. The rollout policy restricts the zones where this image is accessible when using a zonal image family reference. When the rollout policy does not include the user specified zone, or if the zone is rolled out, this image is accessible. The rollout policy for this image is read-only, except for allowlisted users. This field might not be configured. To view the latest non-deprecated image in a specific zone, use the imageFamilyViews.get method.
       "defaultRolloutTime": "A String", # An optional RFC3339 timestamp on or after which the update is considered rolled out to any zone that is not explicitly stated.
@@ -193,7 +193,7 @@
       "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     "sourceDiskId": "A String", # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
-    "sourceImage": "A String", # URL of the source image used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+    "sourceImage": "A String", # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
     "sourceImageEncryptionKey": { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
       "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
       "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
@@ -202,7 +202,7 @@
       "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     "sourceImageId": "A String", # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
-    "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+    "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
     "sourceSnapshotEncryptionKey": { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
       "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
       "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.

docs/dyn/compute_beta.images.html

diff --git a/docs/dyn/compute_beta.images.html b/docs/dyn/compute_beta.images.html
index ba65695..3760659 100644
--- a/docs/dyn/compute_beta.images.html
+++ b/docs/dyn/compute_beta.images.html
@@ -324,7 +324,7 @@
   "rawDisk": { # The parameters of the raw disk image.
     "containerType": "A String", # The format used to encode and transmit the block device, which should be TAR. This is just a container and transmission format and not a runtime format. Provided by the client when the disk image is created.
     "sha1Checksum": "A String", # [Deprecated] This field is deprecated. An optional SHA1 checksum of the disk image before unpackaging provided by the client when the disk image is created.
-    "source": "A String", # The full Google Cloud Storage URL where the disk image is stored. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+    "source": "A String", # The full Google Cloud Storage URL where the raw disk image archive is stored. The following are valid formats for the URL: - https://storage.googleapis.com/bucket_name/image_archive_name - https://storage.googleapis.com/bucket_name/folder_name/ image_archive_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   },
   "rolloutOverride": { # A rollout policy configuration. # A rollout policy to apply to this image. When specified, the rollout policy overrides per-zone references to the image via the associated image family. The rollout policy restricts the zones where this image is accessible when using a zonal image family reference. When the rollout policy does not include the user specified zone, or if the zone is rolled out, this image is accessible. The rollout policy for this image is read-only, except for allowlisted users. This field might not be configured. To view the latest non-deprecated image in a specific zone, use the imageFamilyViews.get method.
     "defaultRolloutTime": "A String", # An optional RFC3339 timestamp on or after which the update is considered rolled out to any zone that is not explicitly stated.
@@ -367,7 +367,7 @@
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceDiskId": "A String", # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
-  "sourceImage": "A String", # URL of the source image used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+  "sourceImage": "A String", # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   "sourceImageEncryptionKey": { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
@@ -376,7 +376,7 @@
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceImageId": "A String", # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
-  "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+  "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   "sourceSnapshotEncryptionKey": { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
@@ -458,7 +458,7 @@
   "rawDisk": { # The parameters of the raw disk image.
     "containerType": "A String", # The format used to encode and transmit the block device, which should be TAR. This is just a container and transmission format and not a runtime format. Provided by the client when the disk image is created.
     "sha1Checksum": "A String", # [Deprecated] This field is deprecated. An optional SHA1 checksum of the disk image before unpackaging provided by the client when the disk image is created.
-    "source": "A String", # The full Google Cloud Storage URL where the disk image is stored. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+    "source": "A String", # The full Google Cloud Storage URL where the raw disk image archive is stored. The following are valid formats for the URL: - https://storage.googleapis.com/bucket_name/image_archive_name - https://storage.googleapis.com/bucket_name/folder_name/ image_archive_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   },
   "rolloutOverride": { # A rollout policy configuration. # A rollout policy to apply to this image. When specified, the rollout policy overrides per-zone references to the image via the associated image family. The rollout policy restricts the zones where this image is accessible when using a zonal image family reference. When the rollout policy does not include the user specified zone, or if the zone is rolled out, this image is accessible. The rollout policy for this image is read-only, except for allowlisted users. This field might not be configured. To view the latest non-deprecated image in a specific zone, use the imageFamilyViews.get method.
     "defaultRolloutTime": "A String", # An optional RFC3339 timestamp on or after which the update is considered rolled out to any zone that is not explicitly stated.
@@ -501,7 +501,7 @@
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceDiskId": "A String", # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
-  "sourceImage": "A String", # URL of the source image used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+  "sourceImage": "A String", # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   "sourceImageEncryptionKey": { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
@@ -510,7 +510,7 @@
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceImageId": "A String", # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
-  "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+  "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   "sourceSnapshotEncryptionKey": { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
@@ -690,7 +690,7 @@
   "rawDisk": { # The parameters of the raw disk image.
     "containerType": "A String", # The format used to encode and transmit the block device, which should be TAR. This is just a container and transmission format and not a runtime format. Provided by the client when the disk image is created.
     "sha1Checksum": "A String", # [Deprecated] This field is deprecated. An optional SHA1 checksum of the disk image before unpackaging provided by the client when the disk image is created.
-    "source": "A String", # The full Google Cloud Storage URL where the disk image is stored. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+    "source": "A String", # The full Google Cloud Storage URL where the raw disk image archive is stored. The following are valid formats for the URL: - https://storage.googleapis.com/bucket_name/image_archive_name - https://storage.googleapis.com/bucket_name/folder_name/ image_archive_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   },
   "rolloutOverride": { # A rollout policy configuration. # A rollout policy to apply to this image. When specified, the rollout policy overrides per-zone references to the image via the associated image family. The rollout policy restricts the zones where this image is accessible when using a zonal image family reference. When the rollout policy does not include the user specified zone, or if the zone is rolled out, this image is accessible. The rollout policy for this image is read-only, except for allowlisted users. This field might not be configured. To view the latest non-deprecated image in a specific zone, use the imageFamilyViews.get method.
     "defaultRolloutTime": "A String", # An optional RFC3339 timestamp on or after which the update is considered rolled out to any zone that is not explicitly stated.
@@ -733,7 +733,7 @@
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceDiskId": "A String", # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
-  "sourceImage": "A String", # URL of the source image used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+  "sourceImage": "A String", # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   "sourceImageEncryptionKey": { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
@@ -742,7 +742,7 @@
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceImageId": "A String", # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
-  "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+  "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   "sourceSnapshotEncryptionKey": { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
@@ -887,7 +887,7 @@
       "rawDisk": { # The parameters of the raw disk image.
         "containerType": "A String", # The format used to encode and transmit the block device, which should be TAR. This is just a container and transmission format and not a runtime format. Provided by the client when the disk image is created.
         "sha1Checksum": "A String", # [Deprecated] This field is deprecated. An optional SHA1 checksum of the disk image before unpackaging provided by the client when the disk image is created.
-        "source": "A String", # The full Google Cloud Storage URL where the disk image is stored. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+        "source": "A String", # The full Google Cloud Storage URL where the raw disk image archive is stored. The following are valid formats for the URL: - https://storage.googleapis.com/bucket_name/image_archive_name - https://storage.googleapis.com/bucket_name/folder_name/ image_archive_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
       },
       "rolloutOverride": { # A rollout policy configuration. # A rollout policy to apply to this image. When specified, the rollout policy overrides per-zone references to the image via the associated image family. The rollout policy restricts the zones where this image is accessible when using a zonal image family reference. When the rollout policy does not include the user specified zone, or if the zone is rolled out, this image is accessible. The rollout policy for this image is read-only, except for allowlisted users. This field might not be configured. To view the latest non-deprecated image in a specific zone, use the imageFamilyViews.get method.
         "defaultRolloutTime": "A String", # An optional RFC3339 timestamp on or after which the update is considered rolled out to any zone that is not explicitly stated.
@@ -930,7 +930,7 @@
         "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       "sourceDiskId": "A String", # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
-      "sourceImage": "A String", # URL of the source image used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+      "sourceImage": "A String", # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
       "sourceImageEncryptionKey": { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
         "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
         "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
@@ -939,7 +939,7 @@
         "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       "sourceImageId": "A String", # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
-      "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+      "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
       "sourceSnapshotEncryptionKey": { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
         "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
         "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
@@ -1045,7 +1045,7 @@
   "rawDisk": { # The parameters of the raw disk image.
     "containerType": "A String", # The format used to encode and transmit the block device, which should be TAR. This is just a container and transmission format and not a runtime format. Provided by the client when the disk image is created.
     "sha1Checksum": "A String", # [Deprecated] This field is deprecated. An optional SHA1 checksum of the disk image before unpackaging provided by the client when the disk image is created.
-    "source": "A String", # The full Google Cloud Storage URL where the disk image is stored. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+    "source": "A String", # The full Google Cloud Storage URL where the raw disk image archive is stored. The following are valid formats for the URL: - https://storage.googleapis.com/bucket_name/image_archive_name - https://storage.googleapis.com/bucket_name/folder_name/ image_archive_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   },
   "rolloutOverride": { # A rollout policy configuration. # A rollout policy to apply to this image. When specified, the rollout policy overrides per-zone references to the image via the associated image family. The rollout policy restricts the zones where this image is accessible when using a zonal image family reference. When the rollout policy does not include the user specified zone, or if the zone is rolled out, this image is accessible. The rollout policy for this image is read-only, except for allowlisted users. This field might not be configured. To view the latest non-deprecated image in a specific zone, use the imageFamilyViews.get method.
     "defaultRolloutTime": "A String", # An optional RFC3339 timestamp on or after which the update is considered rolled out to any zone that is not explicitly stated.
@@ -1088,7 +1088,7 @@
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceDiskId": "A String", # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
-  "sourceImage": "A String", # URL of the source image used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+  "sourceImage": "A String", # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   "sourceImageEncryptionKey": { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
@@ -1097,7 +1097,7 @@
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceImageId": "A String", # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
-  "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+  "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   "sourceSnapshotEncryptionKey": { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.

docs/dyn/compute_beta.instanceGroupManagers.html

diff --git a/docs/dyn/compute_beta.instanceGroupManagers.html b/docs/dyn/compute_beta.instanceGroupManagers.html
index 6961bb8..7dc477a 100644
--- a/docs/dyn/compute_beta.instanceGroupManagers.html
+++ b/docs/dyn/compute_beta.instanceGroupManagers.html
@@ -283,7 +283,7 @@
             "restarting": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be restarted or are currently being restarted.
             "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
           },
-          "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+          "description": "A String", # An optional description of this resource.
           "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
             "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
             "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -660,6 +660,7 @@
   "instances": [ # The URLs of one or more instances to delete. This can be a full URL or a partial URL, such as zones/[ZONE]/instances/[INSTANCE_NAME].
     "A String",
   ],
+  "skipInstancesOnValidationError": True or False, # Specifies whether the request should proceed despite the inclusion of instances that are not members of the group or that are already in the process of being deleted or abandoned. If this field is set to `false` and such an instance is specified in the request, the operation fails. The operation always fails if the request contains a malformed instance URL or a reference to an instance that exists in a zone or region other than the group's zone or region.
 }
 
   requestId: string, An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported ( 00000000-0000-0000-0000-000000000000).
@@ -826,7 +827,7 @@
     "restarting": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be restarted or are currently being restarted.
     "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
   },
-  "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+  "description": "A String", # An optional description of this resource.
   "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
     "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
     "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -941,7 +942,7 @@
     "restarting": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be restarted or are currently being restarted.
     "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
   },
-  "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+  "description": "A String", # An optional description of this resource.
   "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
     "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
     "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -1124,7 +1125,7 @@
         "restarting": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be restarted or are currently being restarted.
         "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
       },
-      "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+      "description": "A String", # An optional description of this resource.
       "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
         "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
         "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -1488,7 +1489,7 @@
     "restarting": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be restarted or are currently being restarted.
     "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
   },
-  "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+  "description": "A String", # An optional description of this resource.
   "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
     "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
     "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -2211,7 +2212,7 @@
     "restarting": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be restarted or are currently being restarted.
     "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
   },
-  "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+  "description": "A String", # An optional description of this resource.
   "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
     "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
     "zones": [ # Zones where the regional managed instance group will create and manage its instances.

docs/dyn/compute_beta.instances.html

diff --git a/docs/dyn/compute_beta.instances.html b/docs/dyn/compute_beta.instances.html
index 2c4b4e0..0c21f17 100644
--- a/docs/dyn/compute_beta.instances.html
+++ b/docs/dyn/compute_beta.instances.html
@@ -1713,7 +1713,7 @@
           "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
           "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
           "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-            "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+            "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
               "A String",
             ],
             "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -1724,7 +1724,7 @@
                 ],
               },
             ],
-            "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+            "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
               "A String",
             ],
           },
@@ -1762,7 +1762,7 @@
         },
       ],
       "description": "A String", # An optional description of this resource. Provide this field when you create the resource.
-      "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Only IPv4 is supported.
+      "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Both IPv4 and IPv6 are supported.
         "A String",
       ],
       "direction": "A String", # Direction of traffic to which this firewall applies, either `INGRESS` or `EGRESS`. The default is `INGRESS`. For `INGRESS` traffic, you cannot specify the destinationRanges field, and for `EGRESS` traffic, you cannot specify the sourceRanges or sourceTags fields.
@@ -1778,7 +1778,7 @@
       "network": "A String", # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
       "priority": 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
       "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
-      "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Only IPv4 is supported.
+      "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Both IPv4 and IPv6 are supported.
         "A String",
       ],
       "sourceServiceAccounts": [ # If source service accounts are specified, the firewall rules apply only to traffic originating from an instance with a service account in this list. Source service accounts cannot be used to control traffic to an instance's external IP address because service accounts are associated with an instance, not an IP address. sourceRanges can be set at the same time as sourceServiceAccounts. If both are set, the firewall applies to traffic that has a source IP address within the sourceRanges OR a source IP that belongs to an instance with service account listed in sourceServiceAccount. The connection does not need to match both fields for the firewall to apply. sourceServiceAccounts cannot be used at the same time as sourceTags or targetTags.
@@ -1847,7 +1847,8 @@
               "intervalSec": 42, # Interval over which the threshold is computed.
             },
             "conformAction": "A String", # Action to take for requests that are under the configured rate limit threshold. Valid option is "allow" only.
-            "enforceOnKey": "A String", # Determines the key to enforce the threshold_rps limit on. If key is "IP", each IP has this limit enforced separately, whereas "ALL_IPs" means a single limit is applied to all requests matching this rule.
+            "enforceOnKey": "A String", # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field 'enforce_on_key' is not configured. “ALL_IPS” -- This definition, equivalent to "ALL", has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+            "enforceOnKeyName": "A String", # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
             "exceedAction": "A String", # When a request is denied, returns the HTTP response code specified. Valid options are "deny()" where valid values for status are 403, 404, 429, and 502.
             "rateLimitThreshold": { # Threshold at which to begin ratelimiting.
               "count": 42, # Number of HTTP(S) requests for calculating the threshold.

docs/dyn/compute_beta.networks.html

diff --git a/docs/dyn/compute_beta.networks.html b/docs/dyn/compute_beta.networks.html
index abf1dc7..e491db2 100644
--- a/docs/dyn/compute_beta.networks.html
+++ b/docs/dyn/compute_beta.networks.html
@@ -118,7 +118,7 @@
 <p class="firstline">Returns permissions that a caller has on the specified resource.</p>
 <p class="toc_element">
   <code><a href="#updatePeering">updatePeering(project, network, body=None, requestId=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Updates the specified network peering with the data included in the request Only the following fields can be modified: NetworkPeering.export_custom_routes, and NetworkPeering.import_custom_routes</p>
+<p class="firstline">Updates the specified network peering with the data included in the request. You can only modify the NetworkPeering.export_custom_routes field and the NetworkPeering.import_custom_routes field.</p>
 <h3>Method Details</h3>
 <div class="method">
     <code class="details" id="addPeering">addPeering(project, network, body=None, requestId=None, x__xgafv=None)</code>
@@ -137,9 +137,9 @@
     &quot;autoCreateRoutes&quot;: True or False, # This field will be deprecated soon. Use the exchange_subnet_routes field instead. Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
     &quot;exchangeSubnetRoutes&quot;: True or False, # Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
     &quot;exportCustomRoutes&quot;: True or False, # Whether to export the custom routes to peer network.
-    &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always exported to peers and are not controlled by this field.
+    &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. IPv4 special-use ranges are always exported to peers and are not controlled by this field.
     &quot;importCustomRoutes&quot;: True or False, # Whether to import the custom routes from peer network.
-    &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always imported from peers and are not controlled by this field.
+    &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. IPv4 special-use ranges are always imported from peers and are not controlled by this field.
     &quot;name&quot;: &quot;A String&quot;, # Name of this peering. Provided by the client when the peering is created. The name must comply with RFC1035. Specifically, the name must be 1-63 characters long and match regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all the following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
     &quot;network&quot;: &quot;A String&quot;, # The URL of the peer network. It can be either full URL or partial URL. The peer network may belong to a different project. If the partial URL does not contain project, it is assumed that the peer network is in the same project as the current network.
     &quot;peerMtu&quot;: 42, # Maximum Transmission Unit in bytes.
@@ -303,9 +303,9 @@
       &quot;autoCreateRoutes&quot;: True or False, # This field will be deprecated soon. Use the exchange_subnet_routes field instead. Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
       &quot;exchangeSubnetRoutes&quot;: True or False, # Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
       &quot;exportCustomRoutes&quot;: True or False, # Whether to export the custom routes to peer network.
-      &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always exported to peers and are not controlled by this field.
+      &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. IPv4 special-use ranges are always exported to peers and are not controlled by this field.
       &quot;importCustomRoutes&quot;: True or False, # Whether to import the custom routes from peer network.
-      &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always imported from peers and are not controlled by this field.
+      &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. IPv4 special-use ranges are always imported from peers and are not controlled by this field.
       &quot;name&quot;: &quot;A String&quot;, # Name of this peering. Provided by the client when the peering is created. The name must comply with RFC1035. Specifically, the name must be 1-63 characters long and match regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all the following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
       &quot;network&quot;: &quot;A String&quot;, # The URL of the peer network. It can be either full URL or partial URL. The peer network may belong to a different project. If the partial URL does not contain project, it is assumed that the peer network is in the same project as the current network.
       &quot;peerMtu&quot;: 42, # Maximum Transmission Unit in bytes.
@@ -352,7 +352,7 @@
           &quot;enableLogging&quot;: True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on &quot;goto_next&quot; rules.
           &quot;kind&quot;: &quot;compute#firewallPolicyRule&quot;, # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
           &quot;match&quot;: { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding &#x27;action&#x27; is enforced.
-            &quot;destIpRanges&quot;: [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+            &quot;destIpRanges&quot;: [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
               &quot;A String&quot;,
             ],
             &quot;layer4Configs&quot;: [ # Pairs of IP protocols and ports that the rule should match.
@@ -363,7 +363,7 @@
                 ],
               },
             ],
-            &quot;srcIpRanges&quot;: [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+            &quot;srcIpRanges&quot;: [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
               &quot;A String&quot;,
             ],
           },
@@ -401,7 +401,7 @@
         },
       ],
       &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
-      &quot;destinationRanges&quot;: [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Only IPv4 is supported.
+      &quot;destinationRanges&quot;: [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Both IPv4 and IPv6 are supported.
         &quot;A String&quot;,
       ],
       &quot;direction&quot;: &quot;A String&quot;, # Direction of traffic to which this firewall applies, either `INGRESS` or `EGRESS`. The default is `INGRESS`. For `INGRESS` traffic, you cannot specify the destinationRanges field, and for `EGRESS` traffic, you cannot specify the sourceRanges or sourceTags fields.
@@ -417,7 +417,7 @@
       &quot;network&quot;: &quot;A String&quot;, # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
       &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
-      &quot;sourceRanges&quot;: [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Only IPv4 is supported.
+      &quot;sourceRanges&quot;: [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Both IPv4 and IPv6 are supported.
         &quot;A String&quot;,
       ],
       &quot;sourceServiceAccounts&quot;: [ # If source service accounts are specified, the firewall rules apply only to traffic originating from an instance with a service account in this list. Source service accounts cannot be used to control traffic to an instance&#x27;s external IP address because service accounts are associated with an instance, not an IP address. sourceRanges can be set at the same time as sourceServiceAccounts. If both are set, the firewall applies to traffic that has a source IP address within the sourceRanges OR a source IP that belongs to an instance with service account listed in sourceServiceAccount. The connection does not need to match both fields for the firewall to apply. sourceServiceAccounts cannot be used at the same time as sourceTags or targetTags.
@@ -486,7 +486,8 @@
               &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
             },
             &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-            &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+            &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+            &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
             &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
             &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
               &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -536,9 +537,9 @@
       &quot;autoCreateRoutes&quot;: True or False, # This field will be deprecated soon. Use the exchange_subnet_routes field instead. Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
       &quot;exchangeSubnetRoutes&quot;: True or False, # Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
       &quot;exportCustomRoutes&quot;: True or False, # Whether to export the custom routes to peer network.
-      &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always exported to peers and are not controlled by this field.
+      &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. IPv4 special-use ranges are always exported to peers and are not controlled by this field.
       &quot;importCustomRoutes&quot;: True or False, # Whether to import the custom routes from peer network.
-      &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always imported from peers and are not controlled by this field.
+      &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. IPv4 special-use ranges are always imported from peers and are not controlled by this field.
       &quot;name&quot;: &quot;A String&quot;, # Name of this peering. Provided by the client when the peering is created. The name must comply with RFC1035. Specifically, the name must be 1-63 characters long and match regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all the following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
       &quot;network&quot;: &quot;A String&quot;, # The URL of the peer network. It can be either full URL or partial URL. The peer network may belong to a different project. If the partial URL does not contain project, it is assumed that the peer network is in the same project as the current network.
       &quot;peerMtu&quot;: 42, # Maximum Transmission Unit in bytes.
@@ -648,9 +649,9 @@
           &quot;autoCreateRoutes&quot;: True or False, # This field will be deprecated soon. Use the exchange_subnet_routes field instead. Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
           &quot;exchangeSubnetRoutes&quot;: True or False, # Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
           &quot;exportCustomRoutes&quot;: True or False, # Whether to export the custom routes to peer network.
-          &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always exported to peers and are not controlled by this field.
+          &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. IPv4 special-use ranges are always exported to peers and are not controlled by this field.
           &quot;importCustomRoutes&quot;: True or False, # Whether to import the custom routes from peer network.
-          &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always imported from peers and are not controlled by this field.
+          &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. IPv4 special-use ranges are always imported from peers and are not controlled by this field.
           &quot;name&quot;: &quot;A String&quot;, # Name of this peering. Provided by the client when the peering is created. The name must comply with RFC1035. Specifically, the name must be 1-63 characters long and match regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all the following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
           &quot;network&quot;: &quot;A String&quot;, # The URL of the peer network. It can be either full URL or partial URL. The peer network may belong to a different project. If the partial URL does not contain project, it is assumed that the peer network is in the same project as the current network.
           &quot;peerMtu&quot;: 42, # Maximum Transmission Unit in bytes.
@@ -789,9 +790,9 @@
       &quot;autoCreateRoutes&quot;: True or False, # This field will be deprecated soon. Use the exchange_subnet_routes field instead. Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
       &quot;exchangeSubnetRoutes&quot;: True or False, # Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
       &quot;exportCustomRoutes&quot;: True or False, # Whether to export the custom routes to peer network.
-      &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always exported to peers and are not controlled by this field.
+      &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. IPv4 special-use ranges are always exported to peers and are not controlled by this field.
       &quot;importCustomRoutes&quot;: True or False, # Whether to import the custom routes from peer network.
-      &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always imported from peers and are not controlled by this field.
+      &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. IPv4 special-use ranges are always imported from peers and are not controlled by this field.
       &quot;name&quot;: &quot;A String&quot;, # Name of this peering. Provided by the client when the peering is created. The name must comply with RFC1035. Specifically, the name must be 1-63 characters long and match regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all the following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
       &quot;network&quot;: &quot;A String&quot;, # The URL of the peer network. It can be either full URL or partial URL. The peer network may belong to a different project. If the partial URL does not contain project, it is assumed that the peer network is in the same project as the current network.
       &quot;peerMtu&quot;: 42, # Maximum Transmission Unit in bytes.
@@ -1030,7 +1031,7 @@
 
 <div class="method">
     <code class="details" id="updatePeering">updatePeering(project, network, body=None, requestId=None, x__xgafv=None)</code>
-  <pre>Updates the specified network peering with the data included in the request Only the following fields can be modified: NetworkPeering.export_custom_routes, and NetworkPeering.import_custom_routes
+  <pre>Updates the specified network peering with the data included in the request. You can only modify the NetworkPeering.export_custom_routes field and the NetworkPeering.import_custom_routes field.
 
 Args:
   project: string, Project ID for this request. (required)
@@ -1043,9 +1044,9 @@
     &quot;autoCreateRoutes&quot;: True or False, # This field will be deprecated soon. Use the exchange_subnet_routes field instead. Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
     &quot;exchangeSubnetRoutes&quot;: True or False, # Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
     &quot;exportCustomRoutes&quot;: True or False, # Whether to export the custom routes to peer network.
-    &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always exported to peers and are not controlled by this field.
+    &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. IPv4 special-use ranges are always exported to peers and are not controlled by this field.
     &quot;importCustomRoutes&quot;: True or False, # Whether to import the custom routes from peer network.
-    &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always imported from peers and are not controlled by this field.
+    &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. IPv4 special-use ranges are always imported from peers and are not controlled by this field.
     &quot;name&quot;: &quot;A String&quot;, # Name of this peering. Provided by the client when the peering is created. The name must comply with RFC1035. Specifically, the name must be 1-63 characters long and match regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all the following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
     &quot;network&quot;: &quot;A String&quot;, # The URL of the peer network. It can be either full URL or partial URL. The peer network may belong to a different project. If the partial URL does not contain project, it is assumed that the peer network is in the same project as the current network.
     &quot;peerMtu&quot;: 42, # Maximum Transmission Unit in bytes.

docs/dyn/compute_beta.nodeGroups.html

diff --git a/docs/dyn/compute_beta.nodeGroups.html b/docs/dyn/compute_beta.nodeGroups.html
index ae9b051..eecf038 100644
--- a/docs/dyn/compute_beta.nodeGroups.html
+++ b/docs/dyn/compute_beta.nodeGroups.html
@@ -222,7 +222,7 @@
   "items": { # A list of NodeGroupsScopedList resources.
     "a_key": { # [Output Only] Name of the scope containing this set of node groups.
       "nodeGroups": [ # [Output Only] A list of node groups contained in this scope.
-        { # Represent a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
+        { # Represents a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
           "autoscalingPolicy": { # Specifies how autoscaling should behave.
             "maxNodes": 42, # The maximum number of nodes that the group should have. Must be set if autoscaling is enabled. Maximum value allowed is 100.
             "minNodes": 42, # The minimum number of nodes that the group should have.
@@ -453,7 +453,7 @@
 Returns:
   An object of the form:
 
-    { # Represent a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
+    { # Represents a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
   "autoscalingPolicy": { # Specifies how autoscaling should behave.
     "maxNodes": 42, # The maximum number of nodes that the group should have. Must be set if autoscaling is enabled. Maximum value allowed is 100.
     "minNodes": 42, # The minimum number of nodes that the group should have.
@@ -598,7 +598,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represent a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
+{ # Represents a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
   "autoscalingPolicy": { # Specifies how autoscaling should behave.
     "maxNodes": 42, # The maximum number of nodes that the group should have. Must be set if autoscaling is enabled. Maximum value allowed is 100.
     "minNodes": 42, # The minimum number of nodes that the group should have.
@@ -705,7 +705,7 @@
     { # Contains a list of nodeGroups.
   "id": "A String", # [Output Only] Unique identifier for the resource; defined by the server.
   "items": [ # A list of NodeGroup resources.
-    { # Represent a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
+    { # Represents a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
       "autoscalingPolicy": { # Specifies how autoscaling should behave.
         "maxNodes": 42, # The maximum number of nodes that the group should have. Must be set if autoscaling is enabled. Maximum value allowed is 100.
         "minNodes": 42, # The minimum number of nodes that the group should have.
@@ -856,7 +856,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represent a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
+{ # Represents a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
   "autoscalingPolicy": { # Specifies how autoscaling should behave.
     "maxNodes": 42, # The maximum number of nodes that the group should have. Must be set if autoscaling is enabled. Maximum value allowed is 100.
     "minNodes": 42, # The minimum number of nodes that the group should have.

docs/dyn/compute_beta.organizationSecurityPolicies.html

diff --git a/docs/dyn/compute_beta.organizationSecurityPolicies.html b/docs/dyn/compute_beta.organizationSecurityPolicies.html
index ba0172b..e8b953e 100644
--- a/docs/dyn/compute_beta.organizationSecurityPolicies.html
+++ b/docs/dyn/compute_beta.organizationSecurityPolicies.html
@@ -256,7 +256,8 @@
       "intervalSec": 42, # Interval over which the threshold is computed.
     },
     "conformAction": "A String", # Action to take for requests that are under the configured rate limit threshold. Valid option is "allow" only.
-    "enforceOnKey": "A String", # Determines the key to enforce the threshold_rps limit on. If key is "IP", each IP has this limit enforced separately, whereas "ALL_IPs" means a single limit is applied to all requests matching this rule.
+    "enforceOnKey": "A String", # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field 'enforce_on_key' is not configured. “ALL_IPS” -- This definition, equivalent to "ALL", has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+    "enforceOnKeyName": "A String", # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
     "exceedAction": "A String", # When a request is denied, returns the HTTP response code specified. Valid options are "deny()" where valid values for status are 403, 404, 429, and 502.
     "rateLimitThreshold": { # Threshold at which to begin ratelimiting.
       "count": 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -558,7 +559,8 @@
           "intervalSec": 42, # Interval over which the threshold is computed.
         },
         "conformAction": "A String", # Action to take for requests that are under the configured rate limit threshold. Valid option is "allow" only.
-        "enforceOnKey": "A String", # Determines the key to enforce the threshold_rps limit on. If key is "IP", each IP has this limit enforced separately, whereas "ALL_IPs" means a single limit is applied to all requests matching this rule.
+        "enforceOnKey": "A String", # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field 'enforce_on_key' is not configured. “ALL_IPS” -- This definition, equivalent to "ALL", has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+        "enforceOnKeyName": "A String", # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
         "exceedAction": "A String", # When a request is denied, returns the HTTP response code specified. Valid options are "deny()" where valid values for status are 403, 404, 429, and 502.
         "rateLimitThreshold": { # Threshold at which to begin ratelimiting.
           "count": 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -581,7 +583,7 @@
   ],
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
-  "type": "A String", # The type indicates the intended use of the security policy. CLOUD_ARMOR policies apply to backend services. FIREWALL policies apply to organizations.
+  "type": "A String", # The type indicates the intended use of the security policy. CLOUD_ARMOR - Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services. They filter requests before they hit the origin servers. CLOUD_ARMOR_EDGE - Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services (including Cloud CDN-enabled) as well as backend buckets (GCS). They filter requests before the request is served from Google’s cache.
 }</pre>
 </div>
 
@@ -671,7 +673,8 @@
       &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
     },
     &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-    &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+    &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+    &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
     &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
     &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
       &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -782,7 +785,8 @@
           &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
         },
         &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-        &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+        &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+        &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
         &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
         &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
           &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -805,7 +809,7 @@
   ],
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
-  &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR policies apply to backend services. FIREWALL policies apply to organizations.
+  &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR - Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services. They filter requests before they hit the origin servers. CLOUD_ARMOR_EDGE - Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services (including Cloud CDN-enabled) as well as backend buckets (GCS). They filter requests before the request is served from Google’s cache.
 }
 
   parentId: string, Parent ID for this request. The ID can be either be &quot;folders/[FOLDER_ID]&quot; if the parent is a folder or &quot;organizations/[ORGANIZATION_ID]&quot; if the parent is an organization.
@@ -968,7 +972,8 @@
               &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
             },
             &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-            &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+            &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+            &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
             &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
             &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
               &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -991,7 +996,7 @@
       ],
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
       &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
-      &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR policies apply to backend services. FIREWALL policies apply to organizations.
+      &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR - Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services. They filter requests before they hit the origin servers. CLOUD_ARMOR_EDGE - Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services (including Cloud CDN-enabled) as well as backend buckets (GCS). They filter requests before the request is served from Google’s cache.
     },
   ],
   &quot;kind&quot;: &quot;compute#securityPolicyList&quot;, # [Output Only] Type of resource. Always compute#securityPolicyList for listsof securityPolicies
@@ -1203,7 +1208,8 @@
           &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
         },
         &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-        &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+        &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+        &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
         &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
         &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
           &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -1226,7 +1232,7 @@
   ],
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
-  &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR policies apply to backend services. FIREWALL policies apply to organizations.
+  &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR - Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services. They filter requests before they hit the origin servers. CLOUD_ARMOR_EDGE - Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services (including Cloud CDN-enabled) as well as backend buckets (GCS). They filter requests before the request is served from Google’s cache.
 }
 
   requestId: string, An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported ( 00000000-0000-0000-0000-000000000000).
@@ -1342,7 +1348,8 @@
       &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
     },
     &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-    &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+    &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+    &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
     &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
     &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
       &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.

docs/dyn/compute_beta.projects.html

diff --git a/docs/dyn/compute_beta.projects.html b/docs/dyn/compute_beta.projects.html
index f297e58..c2a6699 100644
--- a/docs/dyn/compute_beta.projects.html
+++ b/docs/dyn/compute_beta.projects.html
@@ -442,7 +442,7 @@
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "usageExportLocation": { # The location in Cloud Storage and naming method of the daily usage report. Contains bucket_name and report_name prefix. # The naming prefix for daily usage reports and the Google Cloud Storage bucket where they are stored.
     "bucketName": "A String", # The name of an existing bucket in Cloud Storage where the usage report object is stored. The Google Service Account is granted write access to this bucket. This can either be the bucket name by itself, such as example-bucket, or the bucket name with gs:// or https://storage.googleapis.com/ in front of it, such as gs://example-bucket.
-    "reportNamePrefix": "A String", # An optional prefix for the name of the usage report object stored in bucketName. If not supplied, defaults to usage. The report is stored as a CSV file named report_name_prefix_gce_YYYYMMDD.csv where YYYYMMDD is the day of the usage according to Pacific Time. If you supply a prefix, it should conform to Cloud Storage object naming conventions.
+    "reportNamePrefix": "A String", # An optional prefix for the name of the usage report object stored in bucketName. If not supplied, defaults to usage_gce. The report is stored as a CSV file named report_name_prefix_gce_YYYYMMDD.csv where YYYYMMDD is the day of the usage according to Pacific Time. If you supply a prefix, it should conform to Cloud Storage object naming conventions.
   },
   "xpnProjectStatus": "A String", # [Output Only] The role this project has in a shared VPC configuration. Currently, only projects with the host role, which is specified by the value HOST, are differentiated.
 }</pre>
@@ -494,7 +494,7 @@
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;usageExportLocation&quot;: { # The location in Cloud Storage and naming method of the daily usage report. Contains bucket_name and report_name prefix. # The naming prefix for daily usage reports and the Google Cloud Storage bucket where they are stored.
     &quot;bucketName&quot;: &quot;A String&quot;, # The name of an existing bucket in Cloud Storage where the usage report object is stored. The Google Service Account is granted write access to this bucket. This can either be the bucket name by itself, such as example-bucket, or the bucket name with gs:// or https://storage.googleapis.com/ in front of it, such as gs://example-bucket.
-    &quot;reportNamePrefix&quot;: &quot;A String&quot;, # An optional prefix for the name of the usage report object stored in bucketName. If not supplied, defaults to usage. The report is stored as a CSV file named report_name_prefix_gce_YYYYMMDD.csv where YYYYMMDD is the day of the usage according to Pacific Time. If you supply a prefix, it should conform to Cloud Storage object naming conventions.
+    &quot;reportNamePrefix&quot;: &quot;A String&quot;, # An optional prefix for the name of the usage report object stored in bucketName. If not supplied, defaults to usage_gce. The report is stored as a CSV file named report_name_prefix_gce_YYYYMMDD.csv where YYYYMMDD is the day of the usage according to Pacific Time. If you supply a prefix, it should conform to Cloud Storage object naming conventions.
   },
   &quot;xpnProjectStatus&quot;: &quot;A String&quot;, # [Output Only] The role this project has in a shared VPC configuration. Currently, only projects with the host role, which is specified by the value HOST, are differentiated.
 }</pre>
@@ -606,7 +606,7 @@
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
       &quot;usageExportLocation&quot;: { # The location in Cloud Storage and naming method of the daily usage report. Contains bucket_name and report_name prefix. # The naming prefix for daily usage reports and the Google Cloud Storage bucket where they are stored.
         &quot;bucketName&quot;: &quot;A String&quot;, # The name of an existing bucket in Cloud Storage where the usage report object is stored. The Google Service Account is granted write access to this bucket. This can either be the bucket name by itself, such as example-bucket, or the bucket name with gs:// or https://storage.googleapis.com/ in front of it, such as gs://example-bucket.
-        &quot;reportNamePrefix&quot;: &quot;A String&quot;, # An optional prefix for the name of the usage report object stored in bucketName. If not supplied, defaults to usage. The report is stored as a CSV file named report_name_prefix_gce_YYYYMMDD.csv where YYYYMMDD is the day of the usage according to Pacific Time. If you supply a prefix, it should conform to Cloud Storage object naming conventions.
+        &quot;reportNamePrefix&quot;: &quot;A String&quot;, # An optional prefix for the name of the usage report object stored in bucketName. If not supplied, defaults to usage_gce. The report is stored as a CSV file named report_name_prefix_gce_YYYYMMDD.csv where YYYYMMDD is the day of the usage according to Pacific Time. If you supply a prefix, it should conform to Cloud Storage object naming conventions.
       },
       &quot;xpnProjectStatus&quot;: &quot;A String&quot;, # [Output Only] The role this project has in a shared VPC configuration. Currently, only projects with the host role, which is specified by the value HOST, are differentiated.
     },
@@ -937,7 +937,7 @@
 
 { # The location in Cloud Storage and naming method of the daily usage report. Contains bucket_name and report_name prefix.
   &quot;bucketName&quot;: &quot;A String&quot;, # The name of an existing bucket in Cloud Storage where the usage report object is stored. The Google Service Account is granted write access to this bucket. This can either be the bucket name by itself, such as example-bucket, or the bucket name with gs:// or https://storage.googleapis.com/ in front of it, such as gs://example-bucket.
-  &quot;reportNamePrefix&quot;: &quot;A String&quot;, # An optional prefix for the name of the usage report object stored in bucketName. If not supplied, defaults to usage. The report is stored as a CSV file named report_name_prefix_gce_YYYYMMDD.csv where YYYYMMDD is the day of the usage according to Pacific Time. If you supply a prefix, it should conform to Cloud Storage object naming conventions.
+  &quot;reportNamePrefix&quot;: &quot;A String&quot;, # An optional prefix for the name of the usage report object stored in bucketName. If not supplied, defaults to usage_gce. The report is stored as a CSV file named report_name_prefix_gce_YYYYMMDD.csv where YYYYMMDD is the day of the usage according to Pacific Time. If you supply a prefix, it should conform to Cloud Storage object naming conventions.
 }
 
   requestId: string, An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported ( 00000000-0000-0000-0000-000000000000).

docs/dyn/compute_beta.regionBackendServices.html

diff --git a/docs/dyn/compute_beta.regionBackendServices.html b/docs/dyn/compute_beta.regionBackendServices.html
index e12024a..39e7a87 100644
--- a/docs/dyn/compute_beta.regionBackendServices.html
+++ b/docs/dyn/compute_beta.regionBackendServices.html
@@ -200,7 +200,7 @@
   "affinityCookieTtlSec": 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   "backends": [ # The list of backends that serve this BackendService.
     { # Message containing information of one individual backend.
-      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
       "capacityScaler": 3.14, # A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
       "failover": True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -211,7 +211,7 @@
       "maxRate": 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerEndpoint": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerInstance": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
-      "maxUtilization": 3.14,
+      "maxUtilization": 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
     },
   ],
   "cdnPolicy": { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -532,7 +532,7 @@
   "affinityCookieTtlSec": 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   "backends": [ # The list of backends that serve this BackendService.
     { # Message containing information of one individual backend.
-      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
       "capacityScaler": 3.14, # A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
       "failover": True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -543,7 +543,7 @@
       "maxRate": 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerEndpoint": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerInstance": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
-      "maxUtilization": 3.14,
+      "maxUtilization": 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
     },
   ],
   "cdnPolicy": { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -781,7 +781,7 @@
       "affinityCookieTtlSec": 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
       "backends": [ # The list of backends that serve this BackendService.
         { # Message containing information of one individual backend.
-          "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+          "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
           "capacityScaler": 3.14, # A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
           "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
           "failover": True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -792,7 +792,7 @@
           "maxRate": 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
           "maxRatePerEndpoint": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
           "maxRatePerInstance": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
-          "maxUtilization": 3.14,
+          "maxUtilization": 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
         },
       ],
       "cdnPolicy": { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -992,7 +992,7 @@
   "affinityCookieTtlSec": 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   "backends": [ # The list of backends that serve this BackendService.
     { # Message containing information of one individual backend.
-      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
       "capacityScaler": 3.14, # A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
       "failover": True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -1003,7 +1003,7 @@
       "maxRate": 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerEndpoint": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerInstance": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
-      "maxUtilization": 3.14,
+      "maxUtilization": 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
     },
   ],
   "cdnPolicy": { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -1473,7 +1473,7 @@
   "affinityCookieTtlSec": 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   "backends": [ # The list of backends that serve this BackendService.
     { # Message containing information of one individual backend.
-      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
       "capacityScaler": 3.14, # A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
       "failover": True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -1484,7 +1484,7 @@
       "maxRate": 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerEndpoint": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerInstance": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
-      "maxUtilization": 3.14,
+      "maxUtilization": 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
     },
   ],
   "cdnPolicy": { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.

docs/dyn/compute_beta.regionDisks.html

diff --git a/docs/dyn/compute_beta.regionDisks.html b/docs/dyn/compute_beta.regionDisks.html
index 1d76c6d..07a8d8f 100644
--- a/docs/dyn/compute_beta.regionDisks.html
+++ b/docs/dyn/compute_beta.regionDisks.html
@@ -467,6 +467,9 @@
   "status": "A String", # [Output Only] The status of disk creation. - CREATING: Disk is provisioning. - RESTORING: Source data is being copied into the disk. - FAILED: Disk creation failed. - READY: Disk is ready for use. - DELETING: Disk is deleting.
   "storageType": "A String", # [Deprecated] Storage type of the persistent disk.
   "type": "A String", # URL of the disk type resource describing which disk type to use to create the disk. Provide this when creating the disk. For example: projects/project /zones/zone/diskTypes/pd-ssd . See Persistent disk types.
+  "userLicenses": [ # A list of publicly visible user-licenses. Unlike regular licenses, user provided licenses can be modified after the disk is created. This includes a list of URLs to the license resource. For example, to provide a debian license: https://www.googleapis.com/compute/v1/projects/debian-cloud/global/licenses/debian-9-stretch
+    "A String",
+  ],
   "users": [ # [Output Only] Links to the users of the disk (attached instances) in form: projects/project/zones/zone/instances/instance
     "A String",
   ],
@@ -660,6 +663,9 @@
   "status": "A String", # [Output Only] The status of disk creation. - CREATING: Disk is provisioning. - RESTORING: Source data is being copied into the disk. - FAILED: Disk creation failed. - READY: Disk is ready for use. - DELETING: Disk is deleting.
   "storageType": "A String", # [Deprecated] Storage type of the persistent disk.
   "type": "A String", # URL of the disk type resource describing which disk type to use to create the disk. Provide this when creating the disk. For example: projects/project /zones/zone/diskTypes/pd-ssd . See Persistent disk types.
+  "userLicenses": [ # A list of publicly visible user-licenses. Unlike regular licenses, user provided licenses can be modified after the disk is created. This includes a list of URLs to the license resource. For example, to provide a debian license: https://www.googleapis.com/compute/v1/projects/debian-cloud/global/licenses/debian-9-stretch
+    "A String",
+  ],
   "users": [ # [Output Only] Links to the users of the disk (attached instances) in form: projects/project/zones/zone/instances/instance
     "A String",
   ],
@@ -817,6 +823,9 @@
       "status": "A String", # [Output Only] The status of disk creation. - CREATING: Disk is provisioning. - RESTORING: Source data is being copied into the disk. - FAILED: Disk creation failed. - READY: Disk is ready for use. - DELETING: Disk is deleting.
       "storageType": "A String", # [Deprecated] Storage type of the persistent disk.
       "type": "A String", # URL of the disk type resource describing which disk type to use to create the disk. Provide this when creating the disk. For example: projects/project /zones/zone/diskTypes/pd-ssd . See Persistent disk types.
+      "userLicenses": [ # A list of publicly visible user-licenses. Unlike regular licenses, user provided licenses can be modified after the disk is created. This includes a list of URLs to the license resource. For example, to provide a debian license: https://www.googleapis.com/compute/v1/projects/debian-cloud/global/licenses/debian-9-stretch
+        "A String",
+      ],
       "users": [ # [Output Only] Links to the users of the disk (attached instances) in form: projects/project/zones/zone/instances/instance
         "A String",
       ],
@@ -1397,6 +1406,9 @@
   "status": "A String", # [Output Only] The status of disk creation. - CREATING: Disk is provisioning. - RESTORING: Source data is being copied into the disk. - FAILED: Disk creation failed. - READY: Disk is ready for use. - DELETING: Disk is deleting.
   "storageType": "A String", # [Deprecated] Storage type of the persistent disk.
   "type": "A String", # URL of the disk type resource describing which disk type to use to create the disk. Provide this when creating the disk. For example: projects/project /zones/zone/diskTypes/pd-ssd . See Persistent disk types.
+  "userLicenses": [ # A list of publicly visible user-licenses. Unlike regular licenses, user provided licenses can be modified after the disk is created. This includes a list of URLs to the license resource. For example, to provide a debian license: https://www.googleapis.com/compute/v1/projects/debian-cloud/global/licenses/debian-9-stretch
+    "A String",
+  ],
   "users": [ # [Output Only] Links to the users of the disk (attached instances) in form: projects/project/zones/zone/instances/instance
     "A String",
   ],

docs/dyn/compute_beta.regionHealthChecks.html

diff --git a/docs/dyn/compute_beta.regionHealthChecks.html b/docs/dyn/compute_beta.regionHealthChecks.html
index 8c5648e..7475113 100644
--- a/docs/dyn/compute_beta.regionHealthChecks.html
+++ b/docs/dyn/compute_beta.regionHealthChecks.html
@@ -187,7 +187,7 @@
 Returns:
   An object of the form:
 
-    { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/beta/healthChecks) * [Regional](/compute/docs/reference/rest/beta/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+    { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/beta/healthChecks) * [Regional](/compute/docs/reference/rest/beta/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -265,7 +265,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/beta/healthChecks) * [Regional](/compute/docs/reference/rest/beta/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/beta/healthChecks) * [Regional](/compute/docs/reference/rest/beta/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -411,7 +411,7 @@
     { # Contains a list of HealthCheck resources.
   "id": "A String", # [Output Only] Unique identifier for the resource; defined by the server.
   "items": [ # A list of HealthCheck resources.
-    { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/beta/healthChecks) * [Regional](/compute/docs/reference/rest/beta/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+    { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/beta/healthChecks) * [Regional](/compute/docs/reference/rest/beta/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
       "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
       "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -519,7 +519,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/beta/healthChecks) * [Regional](/compute/docs/reference/rest/beta/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/beta/healthChecks) * [Regional](/compute/docs/reference/rest/beta/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -685,7 +685,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/beta/healthChecks) * [Regional](/compute/docs/reference/rest/beta/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/beta/healthChecks) * [Regional](/compute/docs/reference/rest/beta/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.

docs/dyn/compute_beta.regionInstanceGroupManagers.html

diff --git a/docs/dyn/compute_beta.regionInstanceGroupManagers.html b/docs/dyn/compute_beta.regionInstanceGroupManagers.html
index cef9820..c9c9e57 100644
--- a/docs/dyn/compute_beta.regionInstanceGroupManagers.html
+++ b/docs/dyn/compute_beta.regionInstanceGroupManagers.html
@@ -477,6 +477,7 @@
   "instances": [ # The URLs of one or more instances to delete. This can be a full URL or a partial URL, such as zones/[ZONE]/instances/[INSTANCE_NAME].
     "A String",
   ],
+  "skipInstancesOnValidationError": True or False, # Specifies whether the request should proceed despite the inclusion of instances that are not members of the group or that are already in the process of being deleted or abandoned. If this field is set to `false` and such an instance is specified in the request, the operation fails. The operation always fails if the request contains a malformed instance URL or a reference to an instance that exists in a zone or region other than the group's zone or region.
 }
 
   requestId: string, An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported ( 00000000-0000-0000-0000-000000000000).
@@ -643,7 +644,7 @@
     "restarting": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be restarted or are currently being restarted.
     "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
   },
-  "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+  "description": "A String", # An optional description of this resource.
   "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
     "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
     "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -758,7 +759,7 @@
     "restarting": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be restarted or are currently being restarted.
     "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
   },
-  "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+  "description": "A String", # An optional description of this resource.
   "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
     "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
     "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -941,7 +942,7 @@
         "restarting": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be restarted or are currently being restarted.
         "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
       },
-      "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+      "description": "A String", # An optional description of this resource.
       "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
         "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
         "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -1305,7 +1306,7 @@
     "restarting": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be restarted or are currently being restarted.
     "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
   },
-  "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+  "description": "A String", # An optional description of this resource.
   "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
     "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
     "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -1956,7 +1957,7 @@
     "restarting": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be restarted or are currently being restarted.
     "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
   },
-  "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+  "description": "A String", # An optional description of this resource.
   "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
     "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
     "zones": [ # Zones where the regional managed instance group will create and manage its instances.

docs/dyn/compute_beta.regionTargetHttpsProxies.html

diff --git a/docs/dyn/compute_beta.regionTargetHttpsProxies.html b/docs/dyn/compute_beta.regionTargetHttpsProxies.html
index 66c5aea..c349cb2 100644
--- a/docs/dyn/compute_beta.regionTargetHttpsProxies.html
+++ b/docs/dyn/compute_beta.regionTargetHttpsProxies.html
@@ -191,6 +191,7 @@
   "authentication": "A String", # [Deprecated] Use serverTlsPolicy instead.
   "authorization": "A String", # [Deprecated] Use authorizationPolicy instead.
   "authorizationPolicy": "A String", # Optional. A URL referring to a networksecurity.AuthorizationPolicy resource that describes how the proxy should authorize inbound traffic. If left blank, access will not be restricted by an authorization policy. Refer to the AuthorizationPolicy resource for additional details. authorizationPolicy only applies to a global TargetHttpsProxy attached to globalForwardingRules with the loadBalancingScheme set to INTERNAL_SELF_MANAGED. Note: This field currently has no impact.
+  "certificateMap": "A String", # URL of a certificate map that identifies a certificate map associated with the given target proxy. This field can only be set for global target proxies. If set, sslCertificates will be ignored.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
   "fingerprint": "A String", # Fingerprint of this resource. A hash of the contents stored in this object. This field is used in optimistic locking. This field will be ignored when inserting a TargetHttpsProxy. An up-to-date fingerprint must be provided in order to patch the TargetHttpsProxy; otherwise, the request will fail with error 412 conditionNotMet. To see the latest fingerprint, make a get() request to retrieve the TargetHttpsProxy.
@@ -227,6 +228,7 @@
   "authentication": "A String", # [Deprecated] Use serverTlsPolicy instead.
   "authorization": "A String", # [Deprecated] Use authorizationPolicy instead.
   "authorizationPolicy": "A String", # Optional. A URL referring to a networksecurity.AuthorizationPolicy resource that describes how the proxy should authorize inbound traffic. If left blank, access will not be restricted by an authorization policy. Refer to the AuthorizationPolicy resource for additional details. authorizationPolicy only applies to a global TargetHttpsProxy attached to globalForwardingRules with the loadBalancingScheme set to INTERNAL_SELF_MANAGED. Note: This field currently has no impact.
+  "certificateMap": "A String", # URL of a certificate map that identifies a certificate map associated with the given target proxy. This field can only be set for global target proxies. If set, sslCertificates will be ignored.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
   "fingerprint": "A String", # Fingerprint of this resource. A hash of the contents stored in this object. This field is used in optimistic locking. This field will be ignored when inserting a TargetHttpsProxy. An up-to-date fingerprint must be provided in order to patch the TargetHttpsProxy; otherwise, the request will fail with error 412 conditionNotMet. To see the latest fingerprint, make a get() request to retrieve the TargetHttpsProxy.
@@ -331,6 +333,7 @@
       "authentication": "A String", # [Deprecated] Use serverTlsPolicy instead.
       "authorization": "A String", # [Deprecated] Use authorizationPolicy instead.
       "authorizationPolicy": "A String", # Optional. A URL referring to a networksecurity.AuthorizationPolicy resource that describes how the proxy should authorize inbound traffic. If left blank, access will not be restricted by an authorization policy. Refer to the AuthorizationPolicy resource for additional details. authorizationPolicy only applies to a global TargetHttpsProxy attached to globalForwardingRules with the loadBalancingScheme set to INTERNAL_SELF_MANAGED. Note: This field currently has no impact.
+      "certificateMap": "A String", # URL of a certificate map that identifies a certificate map associated with the given target proxy. This field can only be set for global target proxies. If set, sslCertificates will be ignored.
       "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
       "fingerprint": "A String", # Fingerprint of this resource. A hash of the contents stored in this object. This field is used in optimistic locking. This field will be ignored when inserting a TargetHttpsProxy. An up-to-date fingerprint must be provided in order to patch the TargetHttpsProxy; otherwise, the request will fail with error 412 conditionNotMet. To see the latest fingerprint, make a get() request to retrieve the TargetHttpsProxy.

docs/dyn/compute_beta.reservations.html

diff --git a/docs/dyn/compute_beta.reservations.html b/docs/dyn/compute_beta.reservations.html
index 4310152..3553659 100644
--- a/docs/dyn/compute_beta.reservations.html
+++ b/docs/dyn/compute_beta.reservations.html
@@ -110,6 +110,9 @@
 <p class="toc_element">
   <code><a href="#testIamPermissions">testIamPermissions(project, zone, resource, body=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Returns permissions that a caller has on the specified resource.</p>
+<p class="toc_element">
+  <code><a href="#update">update(project, zone, reservation, body=None, paths=None, requestId=None, updateMask=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Update share settings of the reservation.</p>
 <h3>Method Details</h3>
 <div class="method">
     <code class="details" id="aggregatedList">aggregatedList(project, filter=None, includeAllScopes=None, maxResults=None, orderBy=None, pageToken=None, returnPartialSuccess=None, x__xgafv=None)</code>
@@ -978,4 +981,116 @@
 }</pre>
 </div>
 
+<div class="method">
+    <code class="details" id="update">update(project, zone, reservation, body=None, paths=None, requestId=None, updateMask=None, x__xgafv=None)</code>
+  <pre>Update share settings of the reservation.
+
+Args:
+  project: string, Project ID for this request. (required)
+  zone: string, Name of the zone for this request. (required)
+  reservation: string, Name of the reservation to update. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Represents a reservation resource. A reservation ensures that capacity is held in a specific zone even if the reserved VMs are not running. For more information, read Reserving zonal resources.
+  &quot;commitment&quot;: &quot;A String&quot;, # [Output Only] Full or partial URL to a parent commitment. This field displays for reservations that are tied to a commitment.
+  &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
+  &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
+  &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
+  &quot;kind&quot;: &quot;compute#reservation&quot;, # [Output Only] Type of the resource. Always compute#reservations for reservations.
+  &quot;name&quot;: &quot;A String&quot;, # The name of the resource, provided by the client when initially creating the resource. The resource name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
+  &quot;satisfiesPzs&quot;: True or False, # [Output Only] Reserved for future use.
+  &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined fully-qualified URL for this resource.
+  &quot;shareSettings&quot;: { # The share setting for reservations and sole tenancy node groups. # Share-settings for shared-reservation
+    &quot;projects&quot;: [ # A List of Project names to specify consumer projects for this shared-reservation. This is only valid when share_type&#x27;s value is SPECIFIC_PROJECTS.
+      &quot;A String&quot;,
+    ],
+    &quot;shareType&quot;: &quot;A String&quot;, # Type of sharing for this shared-reservation
+  },
+  &quot;specificReservation&quot;: { # This reservation type allows to pre allocate specific instance configuration. # Reservation for instances with specific machine shapes.
+    &quot;count&quot;: &quot;A String&quot;, # Specifies the number of resources that are allocated.
+    &quot;inUseCount&quot;: &quot;A String&quot;, # [Output Only] Indicates how many instances are in use.
+    &quot;instanceProperties&quot;: { # Properties of the SKU instances being reserved. Next ID: 9 # The instance properties for the reservation.
+      &quot;guestAccelerators&quot;: [ # Specifies accelerator type and count.
+        { # A specification of the type and number of accelerator cards attached to the instance.
+          &quot;acceleratorCount&quot;: 42, # The number of the guest accelerator cards exposed to this instance.
+          &quot;acceleratorType&quot;: &quot;A String&quot;, # Full or partial URL of the accelerator type resource to attach to this instance. For example: projects/my-project/zones/us-central1-c/acceleratorTypes/nvidia-tesla-p100 If you are creating an instance template, specify only the accelerator name. See GPUs on Compute Engine for a full list of accelerator types.
+        },
+      ],
+      &quot;localSsds&quot;: [ # Specifies amount of local ssd to reserve with each instance. The type of disk is local-ssd.
+        {
+          &quot;diskSizeGb&quot;: &quot;A String&quot;, # Specifies the size of the disk in base-2 GB.
+          &quot;interface&quot;: &quot;A String&quot;, # Specifies the disk interface to use for attaching this disk, which is either SCSI or NVME. The default is SCSI. For performance characteristics of SCSI over NVMe, see Local SSD performance.
+        },
+      ],
+      &quot;locationHint&quot;: &quot;A String&quot;, # An opaque location hint used to place the allocation close to other resources. This field is for use by internal tools that use the public API.
+      &quot;machineType&quot;: &quot;A String&quot;, # Specifies type of machine (name only) which has fixed number of vCPUs and fixed amount of memory. This also includes specifying custom machine type following custom-NUMBER_OF_CPUS-AMOUNT_OF_MEMORY pattern.
+      &quot;maintenanceFreezeDurationHours&quot;: 42, # Specifies the number of hours after reservation creation where instances using the reservation won&#x27;t be scheduled for maintenance.
+      &quot;maintenanceInterval&quot;: &quot;A String&quot;, # For more information about maintenance intervals, see Setting maintenance intervals.
+      &quot;minCpuPlatform&quot;: &quot;A String&quot;, # Minimum cpu platform the reservation.
+    },
+  },
+  &quot;specificReservationRequired&quot;: True or False, # Indicates whether the reservation can be consumed by VMs with affinity for &quot;any&quot; reservation. If the field is set, then only VMs that target the reservation by name can consume from this reservation.
+  &quot;status&quot;: &quot;A String&quot;, # [Output Only] The status of the reservation.
+  &quot;zone&quot;: &quot;A String&quot;, # Zone in which the reservation resides. A zone must be provided if the reservation is created within a commitment.
+}
+
+  paths: string, A parameter (repeated)
+  requestId: string, An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported ( 00000000-0000-0000-0000-000000000000).
+  updateMask: string, Update_mask indicates fields to be updated as part of this request.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Represents an Operation resource. Google Compute Engine has three Operation resources: * [Global](/compute/docs/reference/rest/beta/globalOperations) * [Regional](/compute/docs/reference/rest/beta/regionOperations) * [Zonal](/compute/docs/reference/rest/beta/zoneOperations) You can use an operation resource to manage asynchronous API requests. For more information, read Handling API responses. Operations can be global, regional or zonal. - For global operations, use the `globalOperations` resource. - For regional operations, use the `regionOperations` resource. - For zonal operations, use the `zonalOperations` resource. For more information, read Global, Regional, and Zonal Resources.
+  &quot;clientOperationId&quot;: &quot;A String&quot;, # [Output Only] The value of `requestId` if you provided it in the request. Not present otherwise.
+  &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Deprecated] This field is deprecated.
+  &quot;description&quot;: &quot;A String&quot;, # [Output Only] A textual description of the operation, which is set when the operation is created.
+  &quot;endTime&quot;: &quot;A String&quot;, # [Output Only] The time that this operation was completed. This value is in RFC3339 text format.
+  &quot;error&quot;: { # [Output Only] If errors are generated during processing of the operation, this field will be populated.
+    &quot;errors&quot;: [ # [Output Only] The array of errors encountered while processing this operation.
+      {
+        &quot;code&quot;: &quot;A String&quot;, # [Output Only] The error type identifier for this error.
+        &quot;location&quot;: &quot;A String&quot;, # [Output Only] Indicates the field in the request that caused the error. This property is optional.
+        &quot;message&quot;: &quot;A String&quot;, # [Output Only] An optional, human-readable error message.
+      },
+    ],
+  },
+  &quot;httpErrorMessage&quot;: &quot;A String&quot;, # [Output Only] If the operation fails, this field contains the HTTP error message that was returned, such as `NOT FOUND`.
+  &quot;httpErrorStatusCode&quot;: 42, # [Output Only] If the operation fails, this field contains the HTTP error status code that was returned. For example, a `404` means the resource was not found.
+  &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the operation. This identifier is defined by the server.
+  &quot;insertTime&quot;: &quot;A String&quot;, # [Output Only] The time that this operation was requested. This value is in RFC3339 text format.
+  &quot;kind&quot;: &quot;compute#operation&quot;, # [Output Only] Type of the resource. Always `compute#operation` for Operation resources.
+  &quot;name&quot;: &quot;A String&quot;, # [Output Only] Name of the operation.
+  &quot;operationGroupId&quot;: &quot;A String&quot;, # [Output Only] An ID that represents a group of operations, such as when a group of operations results from a `bulkInsert` API request.
+  &quot;operationType&quot;: &quot;A String&quot;, # [Output Only] The type of operation, such as `insert`, `update`, or `delete`, and so on.
+  &quot;progress&quot;: 42, # [Output Only] An optional progress indicator that ranges from 0 to 100. There is no requirement that this be linear or support any granularity of operations. This should not be used to guess when the operation will be complete. This number should monotonically increase as the operation progresses.
+  &quot;region&quot;: &quot;A String&quot;, # [Output Only] The URL of the region where the operation resides. Only applicable when performing regional operations.
+  &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
+  &quot;startTime&quot;: &quot;A String&quot;, # [Output Only] The time that this operation was started by the server. This value is in RFC3339 text format.
+  &quot;status&quot;: &quot;A String&quot;, # [Output Only] The status of the operation, which can be one of the following: `PENDING`, `RUNNING`, or `DONE`.
+  &quot;statusMessage&quot;: &quot;A String&quot;, # [Output Only] An optional textual description of the current status of the operation.
+  &quot;targetId&quot;: &quot;A String&quot;, # [Output Only] The unique target ID, which identifies a specific incarnation of the target resource.
+  &quot;targetLink&quot;: &quot;A String&quot;, # [Output Only] The URL of the resource that the operation modifies. For operations related to creating a snapshot, this points to the persistent disk that the snapshot was created from.
+  &quot;user&quot;: &quot;A String&quot;, # [Output Only] User who requested the operation, for example: `user@example.com`.
+  &quot;warnings&quot;: [ # [Output Only] If warning messages are generated during processing of the operation, this field will be populated.
+    {
+      &quot;code&quot;: &quot;A String&quot;, # [Output Only] A warning code, if applicable. For example, Compute Engine returns NO_RESULTS_ON_PAGE if there are no results in the response.
+      &quot;data&quot;: [ # [Output Only] Metadata about this warning in key: value format. For example: &quot;data&quot;: [ { &quot;key&quot;: &quot;scope&quot;, &quot;value&quot;: &quot;zones/us-east1-d&quot; }
+        {
+          &quot;key&quot;: &quot;A String&quot;, # [Output Only] A key that provides more detail on the warning being returned. For example, for warnings where there are no results in a list request for a particular zone, this key might be scope and the key value might be the zone name. Other examples might be a key indicating a deprecated resource and a suggested replacement, or a warning about invalid network settings (for example, if an instance attempts to perform IP forwarding but is not enabled for IP forwarding).
+          &quot;value&quot;: &quot;A String&quot;, # [Output Only] A warning data value corresponding to the key.
+        },
+      ],
+      &quot;message&quot;: &quot;A String&quot;, # [Output Only] A human-readable description of the warning code.
+    },
+  ],
+  &quot;zone&quot;: &quot;A String&quot;, # [Output Only] The URL of the zone where the operation resides. Only applicable when performing per-zone operations.
+}</pre>
+</div>
+
 </body></html>
\ No newline at end of file

docs/dyn/compute_beta.securityPolicies.html

diff --git a/docs/dyn/compute_beta.securityPolicies.html b/docs/dyn/compute_beta.securityPolicies.html
index e677470..a82e533 100644
--- a/docs/dyn/compute_beta.securityPolicies.html
+++ b/docs/dyn/compute_beta.securityPolicies.html
@@ -175,7 +175,8 @@
       "intervalSec": 42, # Interval over which the threshold is computed.
     },
     "conformAction": "A String", # Action to take for requests that are under the configured rate limit threshold. Valid option is "allow" only.
-    "enforceOnKey": "A String", # Determines the key to enforce the threshold_rps limit on. If key is "IP", each IP has this limit enforced separately, whereas "ALL_IPs" means a single limit is applied to all requests matching this rule.
+    "enforceOnKey": "A String", # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field 'enforce_on_key' is not configured. “ALL_IPS” -- This definition, equivalent to "ALL", has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+    "enforceOnKeyName": "A String", # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
     "exceedAction": "A String", # When a request is denied, returns the HTTP response code specified. Valid options are "deny()" where valid values for status are 403, 404, 429, and 502.
     "rateLimitThreshold": { # Threshold at which to begin ratelimiting.
       "count": 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -416,7 +417,8 @@
           "intervalSec": 42, # Interval over which the threshold is computed.
         },
         "conformAction": "A String", # Action to take for requests that are under the configured rate limit threshold. Valid option is "allow" only.
-        "enforceOnKey": "A String", # Determines the key to enforce the threshold_rps limit on. If key is "IP", each IP has this limit enforced separately, whereas "ALL_IPs" means a single limit is applied to all requests matching this rule.
+        "enforceOnKey": "A String", # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field 'enforce_on_key' is not configured. “ALL_IPS” -- This definition, equivalent to "ALL", has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+        "enforceOnKeyName": "A String", # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
         "exceedAction": "A String", # When a request is denied, returns the HTTP response code specified. Valid options are "deny()" where valid values for status are 403, 404, 429, and 502.
         "rateLimitThreshold": { # Threshold at which to begin ratelimiting.
           "count": 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -439,7 +441,7 @@
   ],
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "selfLinkWithId": "A String", # [Output Only] Server-defined URL for this resource with the resource id.
-  "type": "A String", # The type indicates the intended use of the security policy. CLOUD_ARMOR policies apply to backend services. FIREWALL policies apply to organizations.
+  "type": "A String", # The type indicates the intended use of the security policy. CLOUD_ARMOR - Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services. They filter requests before they hit the origin servers. CLOUD_ARMOR_EDGE - Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services (including Cloud CDN-enabled) as well as backend buckets (GCS). They filter requests before the request is served from Google’s cache.
 }</pre>
 </div>
 
@@ -507,7 +509,8 @@
       &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
     },
     &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-    &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+    &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+    &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
     &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
     &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
       &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -619,7 +622,8 @@
           &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
         },
         &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-        &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+        &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+        &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
         &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
         &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
           &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -642,7 +646,7 @@
   ],
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
-  &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR policies apply to backend services. FIREWALL policies apply to organizations.
+  &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR - Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services. They filter requests before they hit the origin servers. CLOUD_ARMOR_EDGE - Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services (including Cloud CDN-enabled) as well as backend buckets (GCS). They filter requests before the request is served from Google’s cache.
 }
 
   requestId: string, An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported ( 00000000-0000-0000-0000-000000000000).
@@ -805,7 +809,8 @@
               &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
             },
             &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-            &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+            &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+            &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
             &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
             &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
               &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -828,7 +833,7 @@
       ],
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
       &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
-      &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR policies apply to backend services. FIREWALL policies apply to organizations.
+      &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR - Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services. They filter requests before they hit the origin servers. CLOUD_ARMOR_EDGE - Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services (including Cloud CDN-enabled) as well as backend buckets (GCS). They filter requests before the request is served from Google’s cache.
     },
   ],
   &quot;kind&quot;: &quot;compute#securityPolicyList&quot;, # [Output Only] Type of resource. Always compute#securityPolicyList for listsof securityPolicies
@@ -991,7 +996,8 @@
           &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
         },
         &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-        &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+        &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+        &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
         &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
         &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
           &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.
@@ -1014,7 +1020,7 @@
   ],
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
-  &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR policies apply to backend services. FIREWALL policies apply to organizations.
+  &quot;type&quot;: &quot;A String&quot;, # The type indicates the intended use of the security policy. CLOUD_ARMOR - Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services. They filter requests before they hit the origin servers. CLOUD_ARMOR_EDGE - Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services (including Cloud CDN-enabled) as well as backend buckets (GCS). They filter requests before the request is served from Google’s cache.
 }
 
   requestId: string, An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported ( 00000000-0000-0000-0000-000000000000).
@@ -1131,7 +1137,8 @@
       &quot;intervalSec&quot;: 42, # Interval over which the threshold is computed.
     },
     &quot;conformAction&quot;: &quot;A String&quot;, # Action to take for requests that are under the configured rate limit threshold. Valid option is &quot;allow&quot; only.
-    &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the threshold_rps limit on. If key is &quot;IP&quot;, each IP has this limit enforced separately, whereas &quot;ALL_IPs&quot; means a single limit is applied to all requests matching this rule.
+    &quot;enforceOnKey&quot;: &quot;A String&quot;, # Determines the key to enforce the rate_limit_threshold on. Possible values are: “ALL” -- A single rate limit threshold is applied to all the requests matching this rule. This is the default value if this field &#x27;enforce_on_key&#x27; is not configured. “ALL_IPS” -- This definition, equivalent to &quot;ALL&quot;, has been depprecated. “IP” -- The source IP address of the request is the key. Each IP has this limit enforced separately. “HTTP_HEADER” -- The value of the HTTP Header whose name is configured under “enforce_on_key_name”. The key value is truncated to the first 128 bytes of the Header value. If no such header is present in the request, the key type defaults to “ALL”. “XFF_IP” -- The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP Header. If no such header is present or the value is not a valid IP, the key type defaults to “ALL”.
+    &quot;enforceOnKeyName&quot;: &quot;A String&quot;, # Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP Header whose value is taken as the key value.
     &quot;exceedAction&quot;: &quot;A String&quot;, # When a request is denied, returns the HTTP response code specified. Valid options are &quot;deny()&quot; where valid values for status are 403, 404, 429, and 502.
     &quot;rateLimitThreshold&quot;: { # Threshold at which to begin ratelimiting.
       &quot;count&quot;: 42, # Number of HTTP(S) requests for calculating the threshold.

docs/dyn/compute_beta.serviceAttachments.html

diff --git a/docs/dyn/compute_beta.serviceAttachments.html b/docs/dyn/compute_beta.serviceAttachments.html
index edbe1b6..8542cb8 100644
--- a/docs/dyn/compute_beta.serviceAttachments.html
+++ b/docs/dyn/compute_beta.serviceAttachments.html
@@ -140,7 +140,6 @@
           "connectedEndpoints": [ # [Output Only] An array of connections for all the consumers connected to this service attachment.
             { # [Output Only] A connection connected to this service attachment.
               "endpoint": "A String", # The url of a connected endpoint.
-              "forwardingRule": "A String", # The url of a consumer forwarding rule. [Deprecated] Do not use.
               "pscConnectionId": "A String", # The PSC connection id of the connected endpoint.
               "status": "A String", # The status of a connected endpoint to this service attachment.
             },
@@ -152,13 +151,6 @@
               "projectIdOrNum": "A String", # The project id or number for the project to set the limit for.
             },
           ],
-          "consumerForwardingRules": [ # [Output Only] An array of forwarding rules for all the consumers connected to this service attachment.
-            { # [Output Only] A consumer forwarding rule connected to this service attachment. [Deprecated] Do not use.
-              "forwardingRule": "A String", # The url of a consumer forwarding rule.
-              "pscConnectionId": "A String", # The PSC connection id of the PSC Forwarding Rule.
-              "status": "A String", # The status of the forwarding rule.
-            },
-          ],
           "consumerRejectLists": [ # Projects that are not allowed to connect to this service attachment. The project can be specified using its id or number.
             "A String",
           ],
@@ -316,7 +308,6 @@
   "connectedEndpoints": [ # [Output Only] An array of connections for all the consumers connected to this service attachment.
     { # [Output Only] A connection connected to this service attachment.
       "endpoint": "A String", # The url of a connected endpoint.
-      "forwardingRule": "A String", # The url of a consumer forwarding rule. [Deprecated] Do not use.
       "pscConnectionId": "A String", # The PSC connection id of the connected endpoint.
       "status": "A String", # The status of a connected endpoint to this service attachment.
     },
@@ -328,13 +319,6 @@
       "projectIdOrNum": "A String", # The project id or number for the project to set the limit for.
     },
   ],
-  "consumerForwardingRules": [ # [Output Only] An array of forwarding rules for all the consumers connected to this service attachment.
-    { # [Output Only] A consumer forwarding rule connected to this service attachment. [Deprecated] Do not use.
-      "forwardingRule": "A String", # The url of a consumer forwarding rule.
-      "pscConnectionId": "A String", # The PSC connection id of the PSC Forwarding Rule.
-      "status": "A String", # The status of the forwarding rule.
-    },
-  ],
   "consumerRejectLists": [ # Projects that are not allowed to connect to this service attachment. The project can be specified using its id or number.
     "A String",
   ],
@@ -478,7 +462,6 @@
   "connectedEndpoints": [ # [Output Only] An array of connections for all the consumers connected to this service attachment.
     { # [Output Only] A connection connected to this service attachment.
       "endpoint": "A String", # The url of a connected endpoint.
-      "forwardingRule": "A String", # The url of a consumer forwarding rule. [Deprecated] Do not use.
       "pscConnectionId": "A String", # The PSC connection id of the connected endpoint.
       "status": "A String", # The status of a connected endpoint to this service attachment.
     },
@@ -490,13 +473,6 @@
       "projectIdOrNum": "A String", # The project id or number for the project to set the limit for.
     },
   ],
-  "consumerForwardingRules": [ # [Output Only] An array of forwarding rules for all the consumers connected to this service attachment.
-    { # [Output Only] A consumer forwarding rule connected to this service attachment. [Deprecated] Do not use.
-      "forwardingRule": "A String", # The url of a consumer forwarding rule.
-      "pscConnectionId": "A String", # The PSC connection id of the PSC Forwarding Rule.
-      "status": "A String", # The status of the forwarding rule.
-    },
-  ],
   "consumerRejectLists": [ # Projects that are not allowed to connect to this service attachment. The project can be specified using its id or number.
     "A String",
   ],
@@ -603,7 +579,6 @@
       "connectedEndpoints": [ # [Output Only] An array of connections for all the consumers connected to this service attachment.
         { # [Output Only] A connection connected to this service attachment.
           "endpoint": "A String", # The url of a connected endpoint.
-          "forwardingRule": "A String", # The url of a consumer forwarding rule. [Deprecated] Do not use.
           "pscConnectionId": "A String", # The PSC connection id of the connected endpoint.
           "status": "A String", # The status of a connected endpoint to this service attachment.
         },
@@ -615,13 +590,6 @@
           "projectIdOrNum": "A String", # The project id or number for the project to set the limit for.
         },
       ],
-      "consumerForwardingRules": [ # [Output Only] An array of forwarding rules for all the consumers connected to this service attachment.
-        { # [Output Only] A consumer forwarding rule connected to this service attachment. [Deprecated] Do not use.
-          "forwardingRule": "A String", # The url of a consumer forwarding rule.
-          "pscConnectionId": "A String", # The PSC connection id of the PSC Forwarding Rule.
-          "status": "A String", # The status of the forwarding rule.
-        },
-      ],
       "consumerRejectLists": [ # Projects that are not allowed to connect to this service attachment. The project can be specified using its id or number.
         "A String",
       ],
@@ -690,7 +658,6 @@
   "connectedEndpoints": [ # [Output Only] An array of connections for all the consumers connected to this service attachment.
     { # [Output Only] A connection connected to this service attachment.
       "endpoint": "A String", # The url of a connected endpoint.
-      "forwardingRule": "A String", # The url of a consumer forwarding rule. [Deprecated] Do not use.
       "pscConnectionId": "A String", # The PSC connection id of the connected endpoint.
       "status": "A String", # The status of a connected endpoint to this service attachment.
     },
@@ -702,13 +669,6 @@
       "projectIdOrNum": "A String", # The project id or number for the project to set the limit for.
     },
   ],
-  "consumerForwardingRules": [ # [Output Only] An array of forwarding rules for all the consumers connected to this service attachment.
-    { # [Output Only] A consumer forwarding rule connected to this service attachment. [Deprecated] Do not use.
-      "forwardingRule": "A String", # The url of a consumer forwarding rule.
-      "pscConnectionId": "A String", # The PSC connection id of the PSC Forwarding Rule.
-      "status": "A String", # The status of the forwarding rule.
-    },
-  ],
   "consumerRejectLists": [ # Projects that are not allowed to connect to this service attachment. The project can be specified using its id or number.
     "A String",
   ],

docs/dyn/compute_beta.subnetworks.html

diff --git a/docs/dyn/compute_beta.subnetworks.html b/docs/dyn/compute_beta.subnetworks.html
index 31ed28f..3de59bc 100644
--- a/docs/dyn/compute_beta.subnetworks.html
+++ b/docs/dyn/compute_beta.subnetworks.html
@@ -102,7 +102,7 @@
   <code><a href="#list">list(project, region, filter=None, maxResults=None, orderBy=None, pageToken=None, returnPartialSuccess=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Retrieves a list of subnetworks available to the specified project.</p>
 <p class="toc_element">
-  <code><a href="#listUsable">listUsable(project, filter=None, maxResults=None, orderBy=None, pageToken=None, returnPartialSuccess=None, x__xgafv=None)</a></code></p>
+  <code><a href="#listUsable">listUsable(project, filter=None, maxResults=None, orderBy=None, pageToken=None, returnPartialSuccess=None, serviceProject=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Retrieves an aggregated list of all usable subnetworks in the project.</p>
 <p class="toc_element">
   <code><a href="#listUsable_next">listUsable_next(previous_request, previous_response)</a></code></p>
@@ -725,7 +725,7 @@
 </div>
 
 <div class="method">
-    <code class="details" id="listUsable">listUsable(project, filter=None, maxResults=None, orderBy=None, pageToken=None, returnPartialSuccess=None, x__xgafv=None)</code>
+    <code class="details" id="listUsable">listUsable(project, filter=None, maxResults=None, orderBy=None, pageToken=None, returnPartialSuccess=None, serviceProject=None, x__xgafv=None)</code>
   <pre>Retrieves an aggregated list of all usable subnetworks in the project.
 
 Args:
@@ -735,6 +735,7 @@
   orderBy: string, Sorts list results by a certain order. By default, results are returned in alphanumerical order based on the resource name. You can also sort results in descending order based on the creation timestamp using `orderBy=&quot;creationTimestamp desc&quot;`. This sorts results based on the `creationTimestamp` field in reverse chronological order (newest result first). Use this to sort resources like operations so that the newest operation is returned first. Currently, only sorting by `name` or `creationTimestamp desc` is supported.
   pageToken: string, Specifies a page token to use. Set `pageToken` to the `nextPageToken` returned by a previous list request to get the next page of results.
   returnPartialSuccess: boolean, Opt-in for partial success behavior which provides partial results in case of failure. The default value is false.
+  serviceProject: string, The project id or project number in which the subnetwork is intended to be used. Only applied for Shared VPC. See [Shared VPC documentation](https://cloud.google.com/vpc/docs/shared-vpc/)
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format

docs/dyn/compute_beta.targetHttpsProxies.html

diff --git a/docs/dyn/compute_beta.targetHttpsProxies.html b/docs/dyn/compute_beta.targetHttpsProxies.html
index 85d5b31..3a7ed2a 100644
--- a/docs/dyn/compute_beta.targetHttpsProxies.html
+++ b/docs/dyn/compute_beta.targetHttpsProxies.html
@@ -102,6 +102,9 @@
   <code><a href="#patch">patch(project, targetHttpsProxy, body=None, requestId=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Patches the specified TargetHttpsProxy resource with the data included in the request. This method supports PATCH semantics and uses JSON merge patch format and processing rules.</p>
 <p class="toc_element">
+  <code><a href="#setCertificateMap">setCertificateMap(project, targetHttpsProxy, body=None, requestId=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Changes the Certificate Map for TargetHttpsProxy.</p>
+<p class="toc_element">
   <code><a href="#setQuicOverride">setQuicOverride(project, targetHttpsProxy, body=None, requestId=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Sets the QUIC override policy for TargetHttpsProxy.</p>
 <p class="toc_element">
@@ -146,6 +149,7 @@
           &quot;authentication&quot;: &quot;A String&quot;, # [Deprecated] Use serverTlsPolicy instead.
           &quot;authorization&quot;: &quot;A String&quot;, # [Deprecated] Use authorizationPolicy instead.
           &quot;authorizationPolicy&quot;: &quot;A String&quot;, # Optional. A URL referring to a networksecurity.AuthorizationPolicy resource that describes how the proxy should authorize inbound traffic. If left blank, access will not be restricted by an authorization policy. Refer to the AuthorizationPolicy resource for additional details. authorizationPolicy only applies to a global TargetHttpsProxy attached to globalForwardingRules with the loadBalancingScheme set to INTERNAL_SELF_MANAGED. Note: This field currently has no impact.
+          &quot;certificateMap&quot;: &quot;A String&quot;, # URL of a certificate map that identifies a certificate map associated with the given target proxy. This field can only be set for global target proxies. If set, sslCertificates will be ignored.
           &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
           &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
           &quot;fingerprint&quot;: &quot;A String&quot;, # Fingerprint of this resource. A hash of the contents stored in this object. This field is used in optimistic locking. This field will be ignored when inserting a TargetHttpsProxy. An up-to-date fingerprint must be provided in order to patch the TargetHttpsProxy; otherwise, the request will fail with error 412 conditionNotMet. To see the latest fingerprint, make a get() request to retrieve the TargetHttpsProxy.
@@ -299,6 +303,7 @@
   &quot;authentication&quot;: &quot;A String&quot;, # [Deprecated] Use serverTlsPolicy instead.
   &quot;authorization&quot;: &quot;A String&quot;, # [Deprecated] Use authorizationPolicy instead.
   &quot;authorizationPolicy&quot;: &quot;A String&quot;, # Optional. A URL referring to a networksecurity.AuthorizationPolicy resource that describes how the proxy should authorize inbound traffic. If left blank, access will not be restricted by an authorization policy. Refer to the AuthorizationPolicy resource for additional details. authorizationPolicy only applies to a global TargetHttpsProxy attached to globalForwardingRules with the loadBalancingScheme set to INTERNAL_SELF_MANAGED. Note: This field currently has no impact.
+  &quot;certificateMap&quot;: &quot;A String&quot;, # URL of a certificate map that identifies a certificate map associated with the given target proxy. This field can only be set for global target proxies. If set, sslCertificates will be ignored.
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
   &quot;fingerprint&quot;: &quot;A String&quot;, # Fingerprint of this resource. A hash of the contents stored in this object. This field is used in optimistic locking. This field will be ignored when inserting a TargetHttpsProxy. An up-to-date fingerprint must be provided in order to patch the TargetHttpsProxy; otherwise, the request will fail with error 412 conditionNotMet. To see the latest fingerprint, make a get() request to retrieve the TargetHttpsProxy.
@@ -334,6 +339,7 @@
   &quot;authentication&quot;: &quot;A String&quot;, # [Deprecated] Use serverTlsPolicy instead.
   &quot;authorization&quot;: &quot;A String&quot;, # [Deprecated] Use authorizationPolicy instead.
   &quot;authorizationPolicy&quot;: &quot;A String&quot;, # Optional. A URL referring to a networksecurity.AuthorizationPolicy resource that describes how the proxy should authorize inbound traffic. If left blank, access will not be restricted by an authorization policy. Refer to the AuthorizationPolicy resource for additional details. authorizationPolicy only applies to a global TargetHttpsProxy attached to globalForwardingRules with the loadBalancingScheme set to INTERNAL_SELF_MANAGED. Note: This field currently has no impact.
+  &quot;certificateMap&quot;: &quot;A String&quot;, # URL of a certificate map that identifies a certificate map associated with the given target proxy. This field can only be set for global target proxies. If set, sslCertificates will be ignored.
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
   &quot;fingerprint&quot;: &quot;A String&quot;, # Fingerprint of this resource. A hash of the contents stored in this object. This field is used in optimistic locking. This field will be ignored when inserting a TargetHttpsProxy. An up-to-date fingerprint must be provided in order to patch the TargetHttpsProxy; otherwise, the request will fail with error 412 conditionNotMet. To see the latest fingerprint, make a get() request to retrieve the TargetHttpsProxy.
@@ -437,6 +443,7 @@
       &quot;authentication&quot;: &quot;A String&quot;, # [Deprecated] Use serverTlsPolicy instead.
       &quot;authorization&quot;: &quot;A String&quot;, # [Deprecated] Use authorizationPolicy instead.
       &quot;authorizationPolicy&quot;: &quot;A String&quot;, # Optional. A URL referring to a networksecurity.AuthorizationPolicy resource that describes how the proxy should authorize inbound traffic. If left blank, access will not be restricted by an authorization policy. Refer to the AuthorizationPolicy resource for additional details. authorizationPolicy only applies to a global TargetHttpsProxy attached to globalForwardingRules with the loadBalancingScheme set to INTERNAL_SELF_MANAGED. Note: This field currently has no impact.
+      &quot;certificateMap&quot;: &quot;A String&quot;, # URL of a certificate map that identifies a certificate map associated with the given target proxy. This field can only be set for global target proxies. If set, sslCertificates will be ignored.
       &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
       &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
       &quot;fingerprint&quot;: &quot;A String&quot;, # Fingerprint of this resource. A hash of the contents stored in this object. This field is used in optimistic locking. This field will be ignored when inserting a TargetHttpsProxy. An up-to-date fingerprint must be provided in order to patch the TargetHttpsProxy; otherwise, the request will fail with error 412 conditionNotMet. To see the latest fingerprint, make a get() request to retrieve the TargetHttpsProxy.
@@ -502,6 +509,7 @@
   &quot;authentication&quot;: &quot;A String&quot;, # [Deprecated] Use serverTlsPolicy instead.
   &quot;authorization&quot;: &quot;A String&quot;, # [Deprecated] Use authorizationPolicy instead.
   &quot;authorizationPolicy&quot;: &quot;A String&quot;, # Optional. A URL referring to a networksecurity.AuthorizationPolicy resource that describes how the proxy should authorize inbound traffic. If left blank, access will not be restricted by an authorization policy. Refer to the AuthorizationPolicy resource for additional details. authorizationPolicy only applies to a global TargetHttpsProxy attached to globalForwardingRules with the loadBalancingScheme set to INTERNAL_SELF_MANAGED. Note: This field currently has no impact.
+  &quot;certificateMap&quot;: &quot;A String&quot;, # URL of a certificate map that identifies a certificate map associated with the given target proxy. This field can only be set for global target proxies. If set, sslCertificates will be ignored.
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
   &quot;fingerprint&quot;: &quot;A String&quot;, # Fingerprint of this resource. A hash of the contents stored in this object. This field is used in optimistic locking. This field will be ignored when inserting a TargetHttpsProxy. An up-to-date fingerprint must be provided in order to patch the TargetHttpsProxy; otherwise, the request will fail with error 412 conditionNotMet. To see the latest fingerprint, make a get() request to retrieve the TargetHttpsProxy.
@@ -580,6 +588,76 @@
 </div>
 
 <div class="method">
+    <code class="details" id="setCertificateMap">setCertificateMap(project, targetHttpsProxy, body=None, requestId=None, x__xgafv=None)</code>
+  <pre>Changes the Certificate Map for TargetHttpsProxy.
+
+Args:
+  project: string, Project ID for this request. (required)
+  targetHttpsProxy: string, Name of the TargetHttpsProxy resource whose CertificateMap is to be set. The name must be 1-63 characters long, and comply with RFC1035. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{
+  &quot;certificateMap&quot;: &quot;A String&quot;, # URL of the Certificate Map to associate with this TargetHttpsProxy.
+}
+
+  requestId: string, An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported ( 00000000-0000-0000-0000-000000000000).
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Represents an Operation resource. Google Compute Engine has three Operation resources: * [Global](/compute/docs/reference/rest/beta/globalOperations) * [Regional](/compute/docs/reference/rest/beta/regionOperations) * [Zonal](/compute/docs/reference/rest/beta/zoneOperations) You can use an operation resource to manage asynchronous API requests. For more information, read Handling API responses. Operations can be global, regional or zonal. - For global operations, use the `globalOperations` resource. - For regional operations, use the `regionOperations` resource. - For zonal operations, use the `zonalOperations` resource. For more information, read Global, Regional, and Zonal Resources.
+  &quot;clientOperationId&quot;: &quot;A String&quot;, # [Output Only] The value of `requestId` if you provided it in the request. Not present otherwise.
+  &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Deprecated] This field is deprecated.
+  &quot;description&quot;: &quot;A String&quot;, # [Output Only] A textual description of the operation, which is set when the operation is created.
+  &quot;endTime&quot;: &quot;A String&quot;, # [Output Only] The time that this operation was completed. This value is in RFC3339 text format.
+  &quot;error&quot;: { # [Output Only] If errors are generated during processing of the operation, this field will be populated.
+    &quot;errors&quot;: [ # [Output Only] The array of errors encountered while processing this operation.
+      {
+        &quot;code&quot;: &quot;A String&quot;, # [Output Only] The error type identifier for this error.
+        &quot;location&quot;: &quot;A String&quot;, # [Output Only] Indicates the field in the request that caused the error. This property is optional.
+        &quot;message&quot;: &quot;A String&quot;, # [Output Only] An optional, human-readable error message.
+      },
+    ],
+  },
+  &quot;httpErrorMessage&quot;: &quot;A String&quot;, # [Output Only] If the operation fails, this field contains the HTTP error message that was returned, such as `NOT FOUND`.
+  &quot;httpErrorStatusCode&quot;: 42, # [Output Only] If the operation fails, this field contains the HTTP error status code that was returned. For example, a `404` means the resource was not found.
+  &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the operation. This identifier is defined by the server.
+  &quot;insertTime&quot;: &quot;A String&quot;, # [Output Only] The time that this operation was requested. This value is in RFC3339 text format.
+  &quot;kind&quot;: &quot;compute#operation&quot;, # [Output Only] Type of the resource. Always `compute#operation` for Operation resources.
+  &quot;name&quot;: &quot;A String&quot;, # [Output Only] Name of the operation.
+  &quot;operationGroupId&quot;: &quot;A String&quot;, # [Output Only] An ID that represents a group of operations, such as when a group of operations results from a `bulkInsert` API request.
+  &quot;operationType&quot;: &quot;A String&quot;, # [Output Only] The type of operation, such as `insert`, `update`, or `delete`, and so on.
+  &quot;progress&quot;: 42, # [Output Only] An optional progress indicator that ranges from 0 to 100. There is no requirement that this be linear or support any granularity of operations. This should not be used to guess when the operation will be complete. This number should monotonically increase as the operation progresses.
+  &quot;region&quot;: &quot;A String&quot;, # [Output Only] The URL of the region where the operation resides. Only applicable when performing regional operations.
+  &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
+  &quot;startTime&quot;: &quot;A String&quot;, # [Output Only] The time that this operation was started by the server. This value is in RFC3339 text format.
+  &quot;status&quot;: &quot;A String&quot;, # [Output Only] The status of the operation, which can be one of the following: `PENDING`, `RUNNING`, or `DONE`.
+  &quot;statusMessage&quot;: &quot;A String&quot;, # [Output Only] An optional textual description of the current status of the operation.
+  &quot;targetId&quot;: &quot;A String&quot;, # [Output Only] The unique target ID, which identifies a specific incarnation of the target resource.
+  &quot;targetLink&quot;: &quot;A String&quot;, # [Output Only] The URL of the resource that the operation modifies. For operations related to creating a snapshot, this points to the persistent disk that the snapshot was created from.
+  &quot;user&quot;: &quot;A String&quot;, # [Output Only] User who requested the operation, for example: `user@example.com`.
+  &quot;warnings&quot;: [ # [Output Only] If warning messages are generated during processing of the operation, this field will be populated.
+    {
+      &quot;code&quot;: &quot;A String&quot;, # [Output Only] A warning code, if applicable. For example, Compute Engine returns NO_RESULTS_ON_PAGE if there are no results in the response.
+      &quot;data&quot;: [ # [Output Only] Metadata about this warning in key: value format. For example: &quot;data&quot;: [ { &quot;key&quot;: &quot;scope&quot;, &quot;value&quot;: &quot;zones/us-east1-d&quot; }
+        {
+          &quot;key&quot;: &quot;A String&quot;, # [Output Only] A key that provides more detail on the warning being returned. For example, for warnings where there are no results in a list request for a particular zone, this key might be scope and the key value might be the zone name. Other examples might be a key indicating a deprecated resource and a suggested replacement, or a warning about invalid network settings (for example, if an instance attempts to perform IP forwarding but is not enabled for IP forwarding).
+          &quot;value&quot;: &quot;A String&quot;, # [Output Only] A warning data value corresponding to the key.
+        },
+      ],
+      &quot;message&quot;: &quot;A String&quot;, # [Output Only] A human-readable description of the warning code.
+    },
+  ],
+  &quot;zone&quot;: &quot;A String&quot;, # [Output Only] The URL of the zone where the operation resides. Only applicable when performing per-zone operations.
+}</pre>
+</div>
+
+<div class="method">
     <code class="details" id="setQuicOverride">setQuicOverride(project, targetHttpsProxy, body=None, requestId=None, x__xgafv=None)</code>
   <pre>Sets the QUIC override policy for TargetHttpsProxy.
 

docs/dyn/compute_beta.targetSslProxies.html

diff --git a/docs/dyn/compute_beta.targetSslProxies.html b/docs/dyn/compute_beta.targetSslProxies.html
index d20d11e..bd11697 100644
--- a/docs/dyn/compute_beta.targetSslProxies.html
+++ b/docs/dyn/compute_beta.targetSslProxies.html
@@ -96,6 +96,9 @@
   <code><a href="#setBackendService">setBackendService(project, targetSslProxy, body=None, requestId=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Changes the BackendService for TargetSslProxy.</p>
 <p class="toc_element">
+  <code><a href="#setCertificateMap">setCertificateMap(project, targetSslProxy, body=None, requestId=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Changes the Certificate Map for TargetSslProxy.</p>
+<p class="toc_element">
   <code><a href="#setProxyHeader">setProxyHeader(project, targetSslProxy, body=None, requestId=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Changes the ProxyHeaderType for TargetSslProxy.</p>
 <p class="toc_element">
@@ -192,6 +195,7 @@
   An object of the form:
 
     { # Represents a Target SSL Proxy resource. A target SSL proxy is a component of a SSL Proxy load balancer. Global forwarding rules reference a target SSL proxy, and the target proxy then references an external backend service. For more information, read Using Target Proxies.
+  &quot;certificateMap&quot;: &quot;A String&quot;, # URL of a certificate map that identifies a certificate map associated with the given target proxy. This field can only be set for global target proxies. If set, sslCertificates will be ignored.
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
@@ -217,6 +221,7 @@
     The object takes the form of:
 
 { # Represents a Target SSL Proxy resource. A target SSL proxy is a component of a SSL Proxy load balancer. Global forwarding rules reference a target SSL proxy, and the target proxy then references an external backend service. For more information, read Using Target Proxies.
+  &quot;certificateMap&quot;: &quot;A String&quot;, # URL of a certificate map that identifies a certificate map associated with the given target proxy. This field can only be set for global target proxies. If set, sslCertificates will be ignored.
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
@@ -310,6 +315,7 @@
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] Unique identifier for the resource; defined by the server.
   &quot;items&quot;: [ # A list of TargetSslProxy resources.
     { # Represents a Target SSL Proxy resource. A target SSL proxy is a component of a SSL Proxy load balancer. Global forwarding rules reference a target SSL proxy, and the target proxy then references an external backend service. For more information, read Using Target Proxies.
+      &quot;certificateMap&quot;: &quot;A String&quot;, # URL of a certificate map that identifies a certificate map associated with the given target proxy. This field can only be set for global target proxies. If set, sslCertificates will be ignored.
       &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
       &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
       &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
@@ -425,6 +431,76 @@
 </div>
 
 <div class="method">
+    <code class="details" id="setCertificateMap">setCertificateMap(project, targetSslProxy, body=None, requestId=None, x__xgafv=None)</code>
+  <pre>Changes the Certificate Map for TargetSslProxy.
+
+Args:
+  project: string, Project ID for this request. (required)
+  targetSslProxy: string, Name of the TargetSslProxy resource whose CertificateMap is to be set. The name must be 1-63 characters long, and comply with RFC1035. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{
+  &quot;certificateMap&quot;: &quot;A String&quot;, # URL of the Certificate Map to associate with this TargetSslProxy.
+}
+
+  requestId: string, An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported ( 00000000-0000-0000-0000-000000000000).
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Represents an Operation resource. Google Compute Engine has three Operation resources: * [Global](/compute/docs/reference/rest/beta/globalOperations) * [Regional](/compute/docs/reference/rest/beta/regionOperations) * [Zonal](/compute/docs/reference/rest/beta/zoneOperations) You can use an operation resource to manage asynchronous API requests. For more information, read Handling API responses. Operations can be global, regional or zonal. - For global operations, use the `globalOperations` resource. - For regional operations, use the `regionOperations` resource. - For zonal operations, use the `zonalOperations` resource. For more information, read Global, Regional, and Zonal Resources.
+  &quot;clientOperationId&quot;: &quot;A String&quot;, # [Output Only] The value of `requestId` if you provided it in the request. Not present otherwise.
+  &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Deprecated] This field is deprecated.
+  &quot;description&quot;: &quot;A String&quot;, # [Output Only] A textual description of the operation, which is set when the operation is created.
+  &quot;endTime&quot;: &quot;A String&quot;, # [Output Only] The time that this operation was completed. This value is in RFC3339 text format.
+  &quot;error&quot;: { # [Output Only] If errors are generated during processing of the operation, this field will be populated.
+    &quot;errors&quot;: [ # [Output Only] The array of errors encountered while processing this operation.
+      {
+        &quot;code&quot;: &quot;A String&quot;, # [Output Only] The error type identifier for this error.
+        &quot;location&quot;: &quot;A String&quot;, # [Output Only] Indicates the field in the request that caused the error. This property is optional.
+        &quot;message&quot;: &quot;A String&quot;, # [Output Only] An optional, human-readable error message.
+      },
+    ],
+  },
+  &quot;httpErrorMessage&quot;: &quot;A String&quot;, # [Output Only] If the operation fails, this field contains the HTTP error message that was returned, such as `NOT FOUND`.
+  &quot;httpErrorStatusCode&quot;: 42, # [Output Only] If the operation fails, this field contains the HTTP error status code that was returned. For example, a `404` means the resource was not found.
+  &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the operation. This identifier is defined by the server.
+  &quot;insertTime&quot;: &quot;A String&quot;, # [Output Only] The time that this operation was requested. This value is in RFC3339 text format.
+  &quot;kind&quot;: &quot;compute#operation&quot;, # [Output Only] Type of the resource. Always `compute#operation` for Operation resources.
+  &quot;name&quot;: &quot;A String&quot;, # [Output Only] Name of the operation.
+  &quot;operationGroupId&quot;: &quot;A String&quot;, # [Output Only] An ID that represents a group of operations, such as when a group of operations results from a `bulkInsert` API request.
+  &quot;operationType&quot;: &quot;A String&quot;, # [Output Only] The type of operation, such as `insert`, `update`, or `delete`, and so on.
+  &quot;progress&quot;: 42, # [Output Only] An optional progress indicator that ranges from 0 to 100. There is no requirement that this be linear or support any granularity of operations. This should not be used to guess when the operation will be complete. This number should monotonically increase as the operation progresses.
+  &quot;region&quot;: &quot;A String&quot;, # [Output Only] The URL of the region where the operation resides. Only applicable when performing regional operations.
+  &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
+  &quot;startTime&quot;: &quot;A String&quot;, # [Output Only] The time that this operation was started by the server. This value is in RFC3339 text format.
+  &quot;status&quot;: &quot;A String&quot;, # [Output Only] The status of the operation, which can be one of the following: `PENDING`, `RUNNING`, or `DONE`.
+  &quot;statusMessage&quot;: &quot;A String&quot;, # [Output Only] An optional textual description of the current status of the operation.
+  &quot;targetId&quot;: &quot;A String&quot;, # [Output Only] The unique target ID, which identifies a specific incarnation of the target resource.
+  &quot;targetLink&quot;: &quot;A String&quot;, # [Output Only] The URL of the resource that the operation modifies. For operations related to creating a snapshot, this points to the persistent disk that the snapshot was created from.
+  &quot;user&quot;: &quot;A String&quot;, # [Output Only] User who requested the operation, for example: `user@example.com`.
+  &quot;warnings&quot;: [ # [Output Only] If warning messages are generated during processing of the operation, this field will be populated.
+    {
+      &quot;code&quot;: &quot;A String&quot;, # [Output Only] A warning code, if applicable. For example, Compute Engine returns NO_RESULTS_ON_PAGE if there are no results in the response.
+      &quot;data&quot;: [ # [Output Only] Metadata about this warning in key: value format. For example: &quot;data&quot;: [ { &quot;key&quot;: &quot;scope&quot;, &quot;value&quot;: &quot;zones/us-east1-d&quot; }
+        {
+          &quot;key&quot;: &quot;A String&quot;, # [Output Only] A key that provides more detail on the warning being returned. For example, for warnings where there are no results in a list request for a particular zone, this key might be scope and the key value might be the zone name. Other examples might be a key indicating a deprecated resource and a suggested replacement, or a warning about invalid network settings (for example, if an instance attempts to perform IP forwarding but is not enabled for IP forwarding).
+          &quot;value&quot;: &quot;A String&quot;, # [Output Only] A warning data value corresponding to the key.
+        },
+      ],
+      &quot;message&quot;: &quot;A String&quot;, # [Output Only] A human-readable description of the warning code.
+    },
+  ],
+  &quot;zone&quot;: &quot;A String&quot;, # [Output Only] The URL of the zone where the operation resides. Only applicable when performing per-zone operations.
+}</pre>
+</div>
+
+<div class="method">
     <code class="details" id="setProxyHeader">setProxyHeader(project, targetSslProxy, body=None, requestId=None, x__xgafv=None)</code>
   <pre>Changes the ProxyHeaderType for TargetSslProxy.
 

docs/dyn/compute_v1.addresses.html

diff --git a/docs/dyn/compute_v1.addresses.html b/docs/dyn/compute_v1.addresses.html
index 2c7b66e..d7440c3 100644
--- a/docs/dyn/compute_v1.addresses.html
+++ b/docs/dyn/compute_v1.addresses.html
@@ -124,7 +124,7 @@
   "items": { # A list of AddressesScopedList resources.
     "a_key": { # [Output Only] Name of the scope containing this set of addresses.
       "addresses": [ # [Output Only] A list of addresses contained in this scope.
-        { # Use global external addresses for GFE-based external HTTP(S) load balancers in Premium Tier. Use global internal addresses for reserved peering network range. Use regional external addresses for the following resources: - External IP addresses for VM instances - Regional external forwarding rules - Cloud NAT external IP addresses - GFE based LBs in Standard Tier - Network LBs in Premium or Standard Tier - Cloud VPN gateways (both Classic and HA) Use regional internal IP addresses for subnet IP ranges (primary and secondary). This includes: - Internal IP addresses for VM instances - Alias IP ranges of VM instances (/32 only) - Regional internal forwarding rules - Internal TCP/UDP load balancer addresses - Internal HTTP(S) load balancer addresses - Cloud DNS inbound forwarding IP addresses For more information, see Reserving a static external IP address.
+        { # Represents an IP Address resource. Google Compute Engine has two IP Address resources: * [Global (external and internal)](https://cloud.google.com/compute/docs/reference/rest/v1/globalAddresses) * [Regional (external and internal)](https://cloud.google.com/compute/docs/reference/rest/v1/addresses) For more information, see Reserving a static external IP address.
           "address": "A String", # The static IP address represented by this resource.
           "addressType": "A String", # The type of address to reserve, either INTERNAL or EXTERNAL. If unspecified, defaults to EXTERNAL.
           "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
@@ -132,11 +132,11 @@
           "id": "A String", # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
           "ipVersion": "A String", # The IP version that will be used by this address. Valid options are IPV4 or IPV6. This can only be specified for a global address.
           "kind": "compute#address", # [Output Only] Type of the resource. Always compute#address for addresses.
-          "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+          "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
           "network": "A String", # The URL of the network in which to reserve the address. This field can only be used with INTERNAL type with the VPC_PEERING purpose.
-          "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Global forwarding rules can only be Premium Tier. Regional forwarding rules can be either Premium or Standard Tier. Standard Tier addresses applied to regional forwarding rules can be used with any external load balancer. Regional forwarding rules in Premium Tier can only be used with a network load balancer. If this field is not specified, it is assumed to be PREMIUM.
+          "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Internal IP addresses are always Premium Tier; global external IP addresses are always Premium Tier; regional external IP addresses can be either Standard or Premium Tier. If this field is not specified, it is assumed to be PREMIUM.
           "prefixLength": 42, # The prefix length if the resource represents an IP range.
-          "purpose": "A String", # The purpose of this resource, which can be one of the following values: - `GCE_ENDPOINT` for addresses that are used by VM instances, alias IP ranges, internal load balancers, and similar resources. - `DNS_RESOLVER` for a DNS resolver address in a subnetwork - `VPC_PEERING` for addresses that are reserved for VPC peer networks. - `NAT_AUTO` for addresses that are external IP addresses automatically reserved for Cloud NAT. - `IPSEC_INTERCONNECT` for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
+          "purpose": "A String", # The purpose of this resource, which can be one of the following values: - GCE_ENDPOINT for addresses that are used by VM instances, alias IP ranges, load balancers, and similar resources. - DNS_RESOLVER for a DNS resolver address in a subnetwork for a Cloud DNS inbound forwarder IP addresses (regional internal IP address in a subnet of a VPC network) - VPC_PEERING for global internal IP addresses used for private services access allocated ranges. - NAT_AUTO for the regional external IP addresses used by Cloud NAT when allocating addresses using . - IPSEC_INTERCONNECT for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
           "region": "A String", # [Output Only] The URL of the region where a regional address resides. For regional addresses, you must specify the region as a path parameter in the HTTP request URL. *This field is not applicable to global addresses.*
           "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
           "status": "A String", # [Output Only] The status of the address, which can be one of RESERVING, RESERVED, or IN_USE. An address that is RESERVING is currently in the process of being reserved. A RESERVED address is currently reserved and available to use. An IN_USE address is currently being used by another resource and is not available.
@@ -276,7 +276,7 @@
 Returns:
   An object of the form:
 
-    { # Use global external addresses for GFE-based external HTTP(S) load balancers in Premium Tier. Use global internal addresses for reserved peering network range. Use regional external addresses for the following resources: - External IP addresses for VM instances - Regional external forwarding rules - Cloud NAT external IP addresses - GFE based LBs in Standard Tier - Network LBs in Premium or Standard Tier - Cloud VPN gateways (both Classic and HA) Use regional internal IP addresses for subnet IP ranges (primary and secondary). This includes: - Internal IP addresses for VM instances - Alias IP ranges of VM instances (/32 only) - Regional internal forwarding rules - Internal TCP/UDP load balancer addresses - Internal HTTP(S) load balancer addresses - Cloud DNS inbound forwarding IP addresses For more information, see Reserving a static external IP address.
+    { # Represents an IP Address resource. Google Compute Engine has two IP Address resources: * [Global (external and internal)](https://cloud.google.com/compute/docs/reference/rest/v1/globalAddresses) * [Regional (external and internal)](https://cloud.google.com/compute/docs/reference/rest/v1/addresses) For more information, see Reserving a static external IP address.
   "address": "A String", # The static IP address represented by this resource.
   "addressType": "A String", # The type of address to reserve, either INTERNAL or EXTERNAL. If unspecified, defaults to EXTERNAL.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
@@ -284,11 +284,11 @@
   "id": "A String", # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
   "ipVersion": "A String", # The IP version that will be used by this address. Valid options are IPV4 or IPV6. This can only be specified for a global address.
   "kind": "compute#address", # [Output Only] Type of the resource. Always compute#address for addresses.
-  "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
   "network": "A String", # The URL of the network in which to reserve the address. This field can only be used with INTERNAL type with the VPC_PEERING purpose.
-  "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Global forwarding rules can only be Premium Tier. Regional forwarding rules can be either Premium or Standard Tier. Standard Tier addresses applied to regional forwarding rules can be used with any external load balancer. Regional forwarding rules in Premium Tier can only be used with a network load balancer. If this field is not specified, it is assumed to be PREMIUM.
+  "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Internal IP addresses are always Premium Tier; global external IP addresses are always Premium Tier; regional external IP addresses can be either Standard or Premium Tier. If this field is not specified, it is assumed to be PREMIUM.
   "prefixLength": 42, # The prefix length if the resource represents an IP range.
-  "purpose": "A String", # The purpose of this resource, which can be one of the following values: - `GCE_ENDPOINT` for addresses that are used by VM instances, alias IP ranges, internal load balancers, and similar resources. - `DNS_RESOLVER` for a DNS resolver address in a subnetwork - `VPC_PEERING` for addresses that are reserved for VPC peer networks. - `NAT_AUTO` for addresses that are external IP addresses automatically reserved for Cloud NAT. - `IPSEC_INTERCONNECT` for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
+  "purpose": "A String", # The purpose of this resource, which can be one of the following values: - GCE_ENDPOINT for addresses that are used by VM instances, alias IP ranges, load balancers, and similar resources. - DNS_RESOLVER for a DNS resolver address in a subnetwork for a Cloud DNS inbound forwarder IP addresses (regional internal IP address in a subnet of a VPC network) - VPC_PEERING for global internal IP addresses used for private services access allocated ranges. - NAT_AUTO for the regional external IP addresses used by Cloud NAT when allocating addresses using . - IPSEC_INTERCONNECT for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
   "region": "A String", # [Output Only] The URL of the region where a regional address resides. For regional addresses, you must specify the region as a path parameter in the HTTP request URL. *This field is not applicable to global addresses.*
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "status": "A String", # [Output Only] The status of the address, which can be one of RESERVING, RESERVED, or IN_USE. An address that is RESERVING is currently in the process of being reserved. A RESERVED address is currently reserved and available to use. An IN_USE address is currently being used by another resource and is not available.
@@ -309,7 +309,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Use global external addresses for GFE-based external HTTP(S) load balancers in Premium Tier. Use global internal addresses for reserved peering network range. Use regional external addresses for the following resources: - External IP addresses for VM instances - Regional external forwarding rules - Cloud NAT external IP addresses - GFE based LBs in Standard Tier - Network LBs in Premium or Standard Tier - Cloud VPN gateways (both Classic and HA) Use regional internal IP addresses for subnet IP ranges (primary and secondary). This includes: - Internal IP addresses for VM instances - Alias IP ranges of VM instances (/32 only) - Regional internal forwarding rules - Internal TCP/UDP load balancer addresses - Internal HTTP(S) load balancer addresses - Cloud DNS inbound forwarding IP addresses For more information, see Reserving a static external IP address.
+{ # Represents an IP Address resource. Google Compute Engine has two IP Address resources: * [Global (external and internal)](https://cloud.google.com/compute/docs/reference/rest/v1/globalAddresses) * [Regional (external and internal)](https://cloud.google.com/compute/docs/reference/rest/v1/addresses) For more information, see Reserving a static external IP address.
   "address": "A String", # The static IP address represented by this resource.
   "addressType": "A String", # The type of address to reserve, either INTERNAL or EXTERNAL. If unspecified, defaults to EXTERNAL.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
@@ -317,11 +317,11 @@
   "id": "A String", # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
   "ipVersion": "A String", # The IP version that will be used by this address. Valid options are IPV4 or IPV6. This can only be specified for a global address.
   "kind": "compute#address", # [Output Only] Type of the resource. Always compute#address for addresses.
-  "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
   "network": "A String", # The URL of the network in which to reserve the address. This field can only be used with INTERNAL type with the VPC_PEERING purpose.
-  "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Global forwarding rules can only be Premium Tier. Regional forwarding rules can be either Premium or Standard Tier. Standard Tier addresses applied to regional forwarding rules can be used with any external load balancer. Regional forwarding rules in Premium Tier can only be used with a network load balancer. If this field is not specified, it is assumed to be PREMIUM.
+  "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Internal IP addresses are always Premium Tier; global external IP addresses are always Premium Tier; regional external IP addresses can be either Standard or Premium Tier. If this field is not specified, it is assumed to be PREMIUM.
   "prefixLength": 42, # The prefix length if the resource represents an IP range.
-  "purpose": "A String", # The purpose of this resource, which can be one of the following values: - `GCE_ENDPOINT` for addresses that are used by VM instances, alias IP ranges, internal load balancers, and similar resources. - `DNS_RESOLVER` for a DNS resolver address in a subnetwork - `VPC_PEERING` for addresses that are reserved for VPC peer networks. - `NAT_AUTO` for addresses that are external IP addresses automatically reserved for Cloud NAT. - `IPSEC_INTERCONNECT` for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
+  "purpose": "A String", # The purpose of this resource, which can be one of the following values: - GCE_ENDPOINT for addresses that are used by VM instances, alias IP ranges, load balancers, and similar resources. - DNS_RESOLVER for a DNS resolver address in a subnetwork for a Cloud DNS inbound forwarder IP addresses (regional internal IP address in a subnet of a VPC network) - VPC_PEERING for global internal IP addresses used for private services access allocated ranges. - NAT_AUTO for the regional external IP addresses used by Cloud NAT when allocating addresses using . - IPSEC_INTERCONNECT for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
   "region": "A String", # [Output Only] The URL of the region where a regional address resides. For regional addresses, you must specify the region as a path parameter in the HTTP request URL. *This field is not applicable to global addresses.*
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "status": "A String", # [Output Only] The status of the address, which can be one of RESERVING, RESERVED, or IN_USE. An address that is RESERVING is currently in the process of being reserved. A RESERVED address is currently reserved and available to use. An IN_USE address is currently being used by another resource and is not available.
@@ -410,7 +410,7 @@
     { # Contains a list of addresses.
   "id": "A String", # [Output Only] Unique identifier for the resource; defined by the server.
   "items": [ # A list of Address resources.
-    { # Use global external addresses for GFE-based external HTTP(S) load balancers in Premium Tier. Use global internal addresses for reserved peering network range. Use regional external addresses for the following resources: - External IP addresses for VM instances - Regional external forwarding rules - Cloud NAT external IP addresses - GFE based LBs in Standard Tier - Network LBs in Premium or Standard Tier - Cloud VPN gateways (both Classic and HA) Use regional internal IP addresses for subnet IP ranges (primary and secondary). This includes: - Internal IP addresses for VM instances - Alias IP ranges of VM instances (/32 only) - Regional internal forwarding rules - Internal TCP/UDP load balancer addresses - Internal HTTP(S) load balancer addresses - Cloud DNS inbound forwarding IP addresses For more information, see Reserving a static external IP address.
+    { # Represents an IP Address resource. Google Compute Engine has two IP Address resources: * [Global (external and internal)](https://cloud.google.com/compute/docs/reference/rest/v1/globalAddresses) * [Regional (external and internal)](https://cloud.google.com/compute/docs/reference/rest/v1/addresses) For more information, see Reserving a static external IP address.
       "address": "A String", # The static IP address represented by this resource.
       "addressType": "A String", # The type of address to reserve, either INTERNAL or EXTERNAL. If unspecified, defaults to EXTERNAL.
       "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
@@ -418,11 +418,11 @@
       "id": "A String", # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
       "ipVersion": "A String", # The IP version that will be used by this address. Valid options are IPV4 or IPV6. This can only be specified for a global address.
       "kind": "compute#address", # [Output Only] Type of the resource. Always compute#address for addresses.
-      "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+      "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
       "network": "A String", # The URL of the network in which to reserve the address. This field can only be used with INTERNAL type with the VPC_PEERING purpose.
-      "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Global forwarding rules can only be Premium Tier. Regional forwarding rules can be either Premium or Standard Tier. Standard Tier addresses applied to regional forwarding rules can be used with any external load balancer. Regional forwarding rules in Premium Tier can only be used with a network load balancer. If this field is not specified, it is assumed to be PREMIUM.
+      "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Internal IP addresses are always Premium Tier; global external IP addresses are always Premium Tier; regional external IP addresses can be either Standard or Premium Tier. If this field is not specified, it is assumed to be PREMIUM.
       "prefixLength": 42, # The prefix length if the resource represents an IP range.
-      "purpose": "A String", # The purpose of this resource, which can be one of the following values: - `GCE_ENDPOINT` for addresses that are used by VM instances, alias IP ranges, internal load balancers, and similar resources. - `DNS_RESOLVER` for a DNS resolver address in a subnetwork - `VPC_PEERING` for addresses that are reserved for VPC peer networks. - `NAT_AUTO` for addresses that are external IP addresses automatically reserved for Cloud NAT. - `IPSEC_INTERCONNECT` for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
+      "purpose": "A String", # The purpose of this resource, which can be one of the following values: - GCE_ENDPOINT for addresses that are used by VM instances, alias IP ranges, load balancers, and similar resources. - DNS_RESOLVER for a DNS resolver address in a subnetwork for a Cloud DNS inbound forwarder IP addresses (regional internal IP address in a subnet of a VPC network) - VPC_PEERING for global internal IP addresses used for private services access allocated ranges. - NAT_AUTO for the regional external IP addresses used by Cloud NAT when allocating addresses using . - IPSEC_INTERCONNECT for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
       "region": "A String", # [Output Only] The URL of the region where a regional address resides. For regional addresses, you must specify the region as a path parameter in the HTTP request URL. *This field is not applicable to global addresses.*
       "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
       "status": "A String", # [Output Only] The status of the address, which can be one of RESERVING, RESERVED, or IN_USE. An address that is RESERVING is currently in the process of being reserved. A RESERVED address is currently reserved and available to use. An IN_USE address is currently being used by another resource and is not available.

docs/dyn/compute_v1.backendServices.html

diff --git a/docs/dyn/compute_v1.backendServices.html b/docs/dyn/compute_v1.backendServices.html
index 0b678c3..c4acfcf 100644
--- a/docs/dyn/compute_v1.backendServices.html
+++ b/docs/dyn/compute_v1.backendServices.html
@@ -217,7 +217,7 @@
           "affinityCookieTtlSec": 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
           "backends": [ # The list of backends that serve this BackendService.
             { # Message containing information of one individual backend.
-              "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+              "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
               "capacityScaler": 3.14, # A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
               "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
               "failover": True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -228,7 +228,7 @@
               "maxRate": 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
               "maxRatePerEndpoint": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
               "maxRatePerInstance": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
-              "maxUtilization": 3.14,
+              "maxUtilization": 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
             },
           ],
           "cdnPolicy": { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -557,7 +557,7 @@
   "affinityCookieTtlSec": 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   "backends": [ # The list of backends that serve this BackendService.
     { # Message containing information of one individual backend.
-      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
       "capacityScaler": 3.14, # A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
       "failover": True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -568,7 +568,7 @@
       "maxRate": 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerEndpoint": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerInstance": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
-      "maxUtilization": 3.14,
+      "maxUtilization": 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
     },
   ],
   "cdnPolicy": { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -760,7 +760,7 @@
   "affinityCookieTtlSec": 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   "backends": [ # The list of backends that serve this BackendService.
     { # Message containing information of one individual backend.
-      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
       "capacityScaler": 3.14, # A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
       "failover": True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -771,7 +771,7 @@
       "maxRate": 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerEndpoint": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerInstance": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
-      "maxUtilization": 3.14,
+      "maxUtilization": 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
     },
   ],
   "cdnPolicy": { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -986,7 +986,7 @@
       "affinityCookieTtlSec": 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
       "backends": [ # The list of backends that serve this BackendService.
         { # Message containing information of one individual backend.
-          "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+          "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
           "capacityScaler": 3.14, # A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
           "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
           "failover": True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -997,7 +997,7 @@
           "maxRate": 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
           "maxRatePerEndpoint": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
           "maxRatePerInstance": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
-          "maxUtilization": 3.14,
+          "maxUtilization": 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
         },
       ],
       "cdnPolicy": { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -1174,7 +1174,7 @@
   "affinityCookieTtlSec": 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   "backends": [ # The list of backends that serve this BackendService.
     { # Message containing information of one individual backend.
-      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
       "capacityScaler": 3.14, # A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
       "failover": True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -1185,7 +1185,7 @@
       "maxRate": 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerEndpoint": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerInstance": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
-      "maxUtilization": 3.14,
+      "maxUtilization": 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
     },
   ],
   "cdnPolicy": { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -1458,7 +1458,7 @@
   "affinityCookieTtlSec": 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   "backends": [ # The list of backends that serve this BackendService.
     { # Message containing information of one individual backend.
-      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
       "capacityScaler": 3.14, # A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
       "failover": True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -1469,7 +1469,7 @@
       "maxRate": 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerEndpoint": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerInstance": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
-      "maxUtilization": 3.14,
+      "maxUtilization": 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
     },
   ],
   "cdnPolicy": { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.

docs/dyn/compute_v1.disks.html

diff --git a/docs/dyn/compute_v1.disks.html b/docs/dyn/compute_v1.disks.html
index 7e0a495..37913b3 100644
--- a/docs/dyn/compute_v1.disks.html
+++ b/docs/dyn/compute_v1.disks.html
@@ -228,6 +228,7 @@
             "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
             "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
             "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+            "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           "guestOsFeatures": [ # A list of features to enable on the guest operating system. Applicable only for bootable images. Read Enabling guest operating system features to see a list of available options.
@@ -271,6 +272,7 @@
             "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
             "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
             "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+            "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           "sourceImageId": "A String", # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
@@ -279,6 +281,7 @@
             "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
             "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
             "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+            "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           "sourceSnapshotId": "A String", # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
@@ -379,6 +382,7 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceDisk": "A String", # The source disk used to create this snapshot.
@@ -386,6 +390,7 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceDiskId": "A String", # [Output Only] The ID value of the disk used to create this snapshot. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given disk name.
@@ -541,6 +546,7 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "guestOsFeatures": [ # A list of features to enable on the guest operating system. Applicable only for bootable images. Read Enabling guest operating system features to see a list of available options.
@@ -584,6 +590,7 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceImageId": "A String", # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
@@ -592,6 +599,7 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceSnapshotId": "A String", # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
@@ -727,6 +735,7 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "guestOsFeatures": [ # A list of features to enable on the guest operating system. Applicable only for bootable images. Read Enabling guest operating system features to see a list of available options.
@@ -770,6 +779,7 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceImageId": "A String", # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
@@ -778,6 +788,7 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceSnapshotId": "A String", # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
@@ -877,6 +888,7 @@
         "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
         "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
         "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+        "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       "guestOsFeatures": [ # A list of features to enable on the guest operating system. Applicable only for bootable images. Read Enabling guest operating system features to see a list of available options.
@@ -920,6 +932,7 @@
         "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
         "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
         "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+        "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       "sourceImageId": "A String", # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
@@ -928,6 +941,7 @@
         "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
         "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
         "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+        "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       "sourceSnapshotId": "A String", # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.

docs/dyn/compute_v1.firewallPolicies.html

diff --git a/docs/dyn/compute_v1.firewallPolicies.html b/docs/dyn/compute_v1.firewallPolicies.html
index 6a8d7e5..da11d7a 100644
--- a/docs/dyn/compute_v1.firewallPolicies.html
+++ b/docs/dyn/compute_v1.firewallPolicies.html
@@ -226,7 +226,7 @@
   "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
   "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
   "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
       "A String",
     ],
     "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -237,7 +237,7 @@
         ],
       },
     ],
-    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
       "A String",
     ],
   },
@@ -479,7 +479,7 @@
       "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
       "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
       "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
           "A String",
         ],
         "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -490,7 +490,7 @@
             ],
           },
         ],
-        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
           "A String",
         ],
       },
@@ -660,7 +660,7 @@
   "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
   "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
   "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
       "A String",
     ],
     "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -671,7 +671,7 @@
         ],
       },
     ],
-    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
       "A String",
     ],
   },
@@ -722,7 +722,7 @@
       "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
       "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
       "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
           "A String",
         ],
         "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -733,7 +733,7 @@
             ],
           },
         ],
-        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
           "A String",
         ],
       },
@@ -859,7 +859,7 @@
           "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
           "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
           "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-            "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+            "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
               "A String",
             ],
             "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -870,7 +870,7 @@
                 ],
               },
             ],
-            "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+            "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
               "A String",
             ],
           },
@@ -1046,7 +1046,7 @@
       "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
       "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
       "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+        "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
           "A String",
         ],
         "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -1057,7 +1057,7 @@
             ],
           },
         ],
-        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+        "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
           "A String",
         ],
       },
@@ -1149,7 +1149,7 @@
   "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
   "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
   "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+    "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
       "A String",
     ],
     "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -1160,7 +1160,7 @@
         ],
       },
     ],
-    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+    "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
       "A String",
     ],
   },

docs/dyn/compute_v1.firewalls.html

diff --git a/docs/dyn/compute_v1.firewalls.html b/docs/dyn/compute_v1.firewalls.html
index 13f335d..0776eb6 100644
--- a/docs/dyn/compute_v1.firewalls.html
+++ b/docs/dyn/compute_v1.firewalls.html
@@ -201,7 +201,7 @@
     },
   ],
   "description": "A String", # An optional description of this resource. Provide this field when you create the resource.
-  "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Only IPv4 is supported.
+  "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Both IPv4 and IPv6 are supported.
     "A String",
   ],
   "direction": "A String", # Direction of traffic to which this firewall applies, either `INGRESS` or `EGRESS`. The default is `INGRESS`. For `INGRESS` traffic, you cannot specify the destinationRanges field, and for `EGRESS` traffic, you cannot specify the sourceRanges or sourceTags fields.
@@ -216,7 +216,7 @@
   "network": "A String", # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
   "priority": 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
-  "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Only IPv4 is supported.
+  "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Both IPv4 and IPv6 are supported.
     "A String",
   ],
   "sourceServiceAccounts": [ # If source service accounts are specified, the firewall rules apply only to traffic originating from an instance with a service account in this list. Source service accounts cannot be used to control traffic to an instance's external IP address because service accounts are associated with an instance, not an IP address. sourceRanges can be set at the same time as sourceServiceAccounts. If both are set, the firewall applies to traffic that has a source IP address within the sourceRanges OR a source IP that belongs to an instance with service account listed in sourceServiceAccount. The connection does not need to match both fields for the firewall to apply. sourceServiceAccounts cannot be used at the same time as sourceTags or targetTags.
@@ -262,7 +262,7 @@
     },
   ],
   "description": "A String", # An optional description of this resource. Provide this field when you create the resource.
-  "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Only IPv4 is supported.
+  "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Both IPv4 and IPv6 are supported.
     "A String",
   ],
   "direction": "A String", # Direction of traffic to which this firewall applies, either `INGRESS` or `EGRESS`. The default is `INGRESS`. For `INGRESS` traffic, you cannot specify the destinationRanges field, and for `EGRESS` traffic, you cannot specify the sourceRanges or sourceTags fields.
@@ -277,7 +277,7 @@
   "network": "A String", # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
   "priority": 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
-  "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Only IPv4 is supported.
+  "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Both IPv4 and IPv6 are supported.
     "A String",
   ],
   "sourceServiceAccounts": [ # If source service accounts are specified, the firewall rules apply only to traffic originating from an instance with a service account in this list. Source service accounts cannot be used to control traffic to an instance's external IP address because service accounts are associated with an instance, not an IP address. sourceRanges can be set at the same time as sourceServiceAccounts. If both are set, the firewall applies to traffic that has a source IP address within the sourceRanges OR a source IP that belongs to an instance with service account listed in sourceServiceAccount. The connection does not need to match both fields for the firewall to apply. sourceServiceAccounts cannot be used at the same time as sourceTags or targetTags.
@@ -391,7 +391,7 @@
         },
       ],
       "description": "A String", # An optional description of this resource. Provide this field when you create the resource.
-      "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Only IPv4 is supported.
+      "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Both IPv4 and IPv6 are supported.
         "A String",
       ],
       "direction": "A String", # Direction of traffic to which this firewall applies, either `INGRESS` or `EGRESS`. The default is `INGRESS`. For `INGRESS` traffic, you cannot specify the destinationRanges field, and for `EGRESS` traffic, you cannot specify the sourceRanges or sourceTags fields.
@@ -406,7 +406,7 @@
       "network": "A String", # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
       "priority": 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
       "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
-      "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Only IPv4 is supported.
+      "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Both IPv4 and IPv6 are supported.
         "A String",
       ],
       "sourceServiceAccounts": [ # If source service accounts are specified, the firewall rules apply only to traffic originating from an instance with a service account in this list. Source service accounts cannot be used to control traffic to an instance's external IP address because service accounts are associated with an instance, not an IP address. sourceRanges can be set at the same time as sourceServiceAccounts. If both are set, the firewall applies to traffic that has a source IP address within the sourceRanges OR a source IP that belongs to an instance with service account listed in sourceServiceAccount. The connection does not need to match both fields for the firewall to apply. sourceServiceAccounts cannot be used at the same time as sourceTags or targetTags.
@@ -482,7 +482,7 @@
     },
   ],
   "description": "A String", # An optional description of this resource. Provide this field when you create the resource.
-  "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Only IPv4 is supported.
+  "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Both IPv4 and IPv6 are supported.
     "A String",
   ],
   "direction": "A String", # Direction of traffic to which this firewall applies, either `INGRESS` or `EGRESS`. The default is `INGRESS`. For `INGRESS` traffic, you cannot specify the destinationRanges field, and for `EGRESS` traffic, you cannot specify the sourceRanges or sourceTags fields.
@@ -497,7 +497,7 @@
   "network": "A String", # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
   "priority": 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
-  "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Only IPv4 is supported.
+  "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Both IPv4 and IPv6 are supported.
     "A String",
   ],
   "sourceServiceAccounts": [ # If source service accounts are specified, the firewall rules apply only to traffic originating from an instance with a service account in this list. Source service accounts cannot be used to control traffic to an instance's external IP address because service accounts are associated with an instance, not an IP address. sourceRanges can be set at the same time as sourceServiceAccounts. If both are set, the firewall applies to traffic that has a source IP address within the sourceRanges OR a source IP that belongs to an instance with service account listed in sourceServiceAccount. The connection does not need to match both fields for the firewall to apply. sourceServiceAccounts cannot be used at the same time as sourceTags or targetTags.
@@ -599,7 +599,7 @@
     },
   ],
   "description": "A String", # An optional description of this resource. Provide this field when you create the resource.
-  "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Only IPv4 is supported.
+  "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Both IPv4 and IPv6 are supported.
     "A String",
   ],
   "direction": "A String", # Direction of traffic to which this firewall applies, either `INGRESS` or `EGRESS`. The default is `INGRESS`. For `INGRESS` traffic, you cannot specify the destinationRanges field, and for `EGRESS` traffic, you cannot specify the sourceRanges or sourceTags fields.
@@ -614,7 +614,7 @@
   "network": "A String", # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
   "priority": 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
-  "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Only IPv4 is supported.
+  "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Both IPv4 and IPv6 are supported.
     "A String",
   ],
   "sourceServiceAccounts": [ # If source service accounts are specified, the firewall rules apply only to traffic originating from an instance with a service account in this list. Source service accounts cannot be used to control traffic to an instance's external IP address because service accounts are associated with an instance, not an IP address. sourceRanges can be set at the same time as sourceServiceAccounts. If both are set, the firewall applies to traffic that has a source IP address within the sourceRanges OR a source IP that belongs to an instance with service account listed in sourceServiceAccount. The connection does not need to match both fields for the firewall to apply. sourceServiceAccounts cannot be used at the same time as sourceTags or targetTags.

docs/dyn/compute_v1.globalAddresses.html

diff --git a/docs/dyn/compute_v1.globalAddresses.html b/docs/dyn/compute_v1.globalAddresses.html
index 08bf6ef..4a8a841 100644
--- a/docs/dyn/compute_v1.globalAddresses.html
+++ b/docs/dyn/compute_v1.globalAddresses.html
@@ -176,7 +176,7 @@
 Returns:
   An object of the form:
 
-    { # Use global external addresses for GFE-based external HTTP(S) load balancers in Premium Tier. Use global internal addresses for reserved peering network range. Use regional external addresses for the following resources: - External IP addresses for VM instances - Regional external forwarding rules - Cloud NAT external IP addresses - GFE based LBs in Standard Tier - Network LBs in Premium or Standard Tier - Cloud VPN gateways (both Classic and HA) Use regional internal IP addresses for subnet IP ranges (primary and secondary). This includes: - Internal IP addresses for VM instances - Alias IP ranges of VM instances (/32 only) - Regional internal forwarding rules - Internal TCP/UDP load balancer addresses - Internal HTTP(S) load balancer addresses - Cloud DNS inbound forwarding IP addresses For more information, see Reserving a static external IP address.
+    { # Represents an IP Address resource. Google Compute Engine has two IP Address resources: * [Global (external and internal)](https://cloud.google.com/compute/docs/reference/rest/v1/globalAddresses) * [Regional (external and internal)](https://cloud.google.com/compute/docs/reference/rest/v1/addresses) For more information, see Reserving a static external IP address.
   "address": "A String", # The static IP address represented by this resource.
   "addressType": "A String", # The type of address to reserve, either INTERNAL or EXTERNAL. If unspecified, defaults to EXTERNAL.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
@@ -184,11 +184,11 @@
   "id": "A String", # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
   "ipVersion": "A String", # The IP version that will be used by this address. Valid options are IPV4 or IPV6. This can only be specified for a global address.
   "kind": "compute#address", # [Output Only] Type of the resource. Always compute#address for addresses.
-  "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
   "network": "A String", # The URL of the network in which to reserve the address. This field can only be used with INTERNAL type with the VPC_PEERING purpose.
-  "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Global forwarding rules can only be Premium Tier. Regional forwarding rules can be either Premium or Standard Tier. Standard Tier addresses applied to regional forwarding rules can be used with any external load balancer. Regional forwarding rules in Premium Tier can only be used with a network load balancer. If this field is not specified, it is assumed to be PREMIUM.
+  "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Internal IP addresses are always Premium Tier; global external IP addresses are always Premium Tier; regional external IP addresses can be either Standard or Premium Tier. If this field is not specified, it is assumed to be PREMIUM.
   "prefixLength": 42, # The prefix length if the resource represents an IP range.
-  "purpose": "A String", # The purpose of this resource, which can be one of the following values: - `GCE_ENDPOINT` for addresses that are used by VM instances, alias IP ranges, internal load balancers, and similar resources. - `DNS_RESOLVER` for a DNS resolver address in a subnetwork - `VPC_PEERING` for addresses that are reserved for VPC peer networks. - `NAT_AUTO` for addresses that are external IP addresses automatically reserved for Cloud NAT. - `IPSEC_INTERCONNECT` for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
+  "purpose": "A String", # The purpose of this resource, which can be one of the following values: - GCE_ENDPOINT for addresses that are used by VM instances, alias IP ranges, load balancers, and similar resources. - DNS_RESOLVER for a DNS resolver address in a subnetwork for a Cloud DNS inbound forwarder IP addresses (regional internal IP address in a subnet of a VPC network) - VPC_PEERING for global internal IP addresses used for private services access allocated ranges. - NAT_AUTO for the regional external IP addresses used by Cloud NAT when allocating addresses using . - IPSEC_INTERCONNECT for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
   "region": "A String", # [Output Only] The URL of the region where a regional address resides. For regional addresses, you must specify the region as a path parameter in the HTTP request URL. *This field is not applicable to global addresses.*
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "status": "A String", # [Output Only] The status of the address, which can be one of RESERVING, RESERVED, or IN_USE. An address that is RESERVING is currently in the process of being reserved. A RESERVED address is currently reserved and available to use. An IN_USE address is currently being used by another resource and is not available.
@@ -208,7 +208,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Use global external addresses for GFE-based external HTTP(S) load balancers in Premium Tier. Use global internal addresses for reserved peering network range. Use regional external addresses for the following resources: - External IP addresses for VM instances - Regional external forwarding rules - Cloud NAT external IP addresses - GFE based LBs in Standard Tier - Network LBs in Premium or Standard Tier - Cloud VPN gateways (both Classic and HA) Use regional internal IP addresses for subnet IP ranges (primary and secondary). This includes: - Internal IP addresses for VM instances - Alias IP ranges of VM instances (/32 only) - Regional internal forwarding rules - Internal TCP/UDP load balancer addresses - Internal HTTP(S) load balancer addresses - Cloud DNS inbound forwarding IP addresses For more information, see Reserving a static external IP address.
+{ # Represents an IP Address resource. Google Compute Engine has two IP Address resources: * [Global (external and internal)](https://cloud.google.com/compute/docs/reference/rest/v1/globalAddresses) * [Regional (external and internal)](https://cloud.google.com/compute/docs/reference/rest/v1/addresses) For more information, see Reserving a static external IP address.
   "address": "A String", # The static IP address represented by this resource.
   "addressType": "A String", # The type of address to reserve, either INTERNAL or EXTERNAL. If unspecified, defaults to EXTERNAL.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
@@ -216,11 +216,11 @@
   "id": "A String", # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
   "ipVersion": "A String", # The IP version that will be used by this address. Valid options are IPV4 or IPV6. This can only be specified for a global address.
   "kind": "compute#address", # [Output Only] Type of the resource. Always compute#address for addresses.
-  "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
   "network": "A String", # The URL of the network in which to reserve the address. This field can only be used with INTERNAL type with the VPC_PEERING purpose.
-  "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Global forwarding rules can only be Premium Tier. Regional forwarding rules can be either Premium or Standard Tier. Standard Tier addresses applied to regional forwarding rules can be used with any external load balancer. Regional forwarding rules in Premium Tier can only be used with a network load balancer. If this field is not specified, it is assumed to be PREMIUM.
+  "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Internal IP addresses are always Premium Tier; global external IP addresses are always Premium Tier; regional external IP addresses can be either Standard or Premium Tier. If this field is not specified, it is assumed to be PREMIUM.
   "prefixLength": 42, # The prefix length if the resource represents an IP range.
-  "purpose": "A String", # The purpose of this resource, which can be one of the following values: - `GCE_ENDPOINT` for addresses that are used by VM instances, alias IP ranges, internal load balancers, and similar resources. - `DNS_RESOLVER` for a DNS resolver address in a subnetwork - `VPC_PEERING` for addresses that are reserved for VPC peer networks. - `NAT_AUTO` for addresses that are external IP addresses automatically reserved for Cloud NAT. - `IPSEC_INTERCONNECT` for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
+  "purpose": "A String", # The purpose of this resource, which can be one of the following values: - GCE_ENDPOINT for addresses that are used by VM instances, alias IP ranges, load balancers, and similar resources. - DNS_RESOLVER for a DNS resolver address in a subnetwork for a Cloud DNS inbound forwarder IP addresses (regional internal IP address in a subnet of a VPC network) - VPC_PEERING for global internal IP addresses used for private services access allocated ranges. - NAT_AUTO for the regional external IP addresses used by Cloud NAT when allocating addresses using . - IPSEC_INTERCONNECT for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
   "region": "A String", # [Output Only] The URL of the region where a regional address resides. For regional addresses, you must specify the region as a path parameter in the HTTP request URL. *This field is not applicable to global addresses.*
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "status": "A String", # [Output Only] The status of the address, which can be one of RESERVING, RESERVED, or IN_USE. An address that is RESERVING is currently in the process of being reserved. A RESERVED address is currently reserved and available to use. An IN_USE address is currently being used by another resource and is not available.
@@ -308,7 +308,7 @@
     { # Contains a list of addresses.
   "id": "A String", # [Output Only] Unique identifier for the resource; defined by the server.
   "items": [ # A list of Address resources.
-    { # Use global external addresses for GFE-based external HTTP(S) load balancers in Premium Tier. Use global internal addresses for reserved peering network range. Use regional external addresses for the following resources: - External IP addresses for VM instances - Regional external forwarding rules - Cloud NAT external IP addresses - GFE based LBs in Standard Tier - Network LBs in Premium or Standard Tier - Cloud VPN gateways (both Classic and HA) Use regional internal IP addresses for subnet IP ranges (primary and secondary). This includes: - Internal IP addresses for VM instances - Alias IP ranges of VM instances (/32 only) - Regional internal forwarding rules - Internal TCP/UDP load balancer addresses - Internal HTTP(S) load balancer addresses - Cloud DNS inbound forwarding IP addresses For more information, see Reserving a static external IP address.
+    { # Represents an IP Address resource. Google Compute Engine has two IP Address resources: * [Global (external and internal)](https://cloud.google.com/compute/docs/reference/rest/v1/globalAddresses) * [Regional (external and internal)](https://cloud.google.com/compute/docs/reference/rest/v1/addresses) For more information, see Reserving a static external IP address.
       "address": "A String", # The static IP address represented by this resource.
       "addressType": "A String", # The type of address to reserve, either INTERNAL or EXTERNAL. If unspecified, defaults to EXTERNAL.
       "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
@@ -316,11 +316,11 @@
       "id": "A String", # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
       "ipVersion": "A String", # The IP version that will be used by this address. Valid options are IPV4 or IPV6. This can only be specified for a global address.
       "kind": "compute#address", # [Output Only] Type of the resource. Always compute#address for addresses.
-      "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+      "name": "A String", # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
       "network": "A String", # The URL of the network in which to reserve the address. This field can only be used with INTERNAL type with the VPC_PEERING purpose.
-      "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Global forwarding rules can only be Premium Tier. Regional forwarding rules can be either Premium or Standard Tier. Standard Tier addresses applied to regional forwarding rules can be used with any external load balancer. Regional forwarding rules in Premium Tier can only be used with a network load balancer. If this field is not specified, it is assumed to be PREMIUM.
+      "networkTier": "A String", # This signifies the networking tier used for configuring this address and can only take the following values: PREMIUM or STANDARD. Internal IP addresses are always Premium Tier; global external IP addresses are always Premium Tier; regional external IP addresses can be either Standard or Premium Tier. If this field is not specified, it is assumed to be PREMIUM.
       "prefixLength": 42, # The prefix length if the resource represents an IP range.
-      "purpose": "A String", # The purpose of this resource, which can be one of the following values: - `GCE_ENDPOINT` for addresses that are used by VM instances, alias IP ranges, internal load balancers, and similar resources. - `DNS_RESOLVER` for a DNS resolver address in a subnetwork - `VPC_PEERING` for addresses that are reserved for VPC peer networks. - `NAT_AUTO` for addresses that are external IP addresses automatically reserved for Cloud NAT. - `IPSEC_INTERCONNECT` for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
+      "purpose": "A String", # The purpose of this resource, which can be one of the following values: - GCE_ENDPOINT for addresses that are used by VM instances, alias IP ranges, load balancers, and similar resources. - DNS_RESOLVER for a DNS resolver address in a subnetwork for a Cloud DNS inbound forwarder IP addresses (regional internal IP address in a subnet of a VPC network) - VPC_PEERING for global internal IP addresses used for private services access allocated ranges. - NAT_AUTO for the regional external IP addresses used by Cloud NAT when allocating addresses using . - IPSEC_INTERCONNECT for addresses created from a private IP range that are reserved for a VLAN attachment in an *IPsec-encrypted Cloud Interconnect* configuration. These addresses are regional resources. Not currently available publicly. - `SHARED_LOADBALANCER_VIP` for an internal IP address that is assigned to multiple internal forwarding rules. - `PRIVATE_SERVICE_CONNECT` for a private network address that is used to configure Private Service Connect. Only global internal addresses can use this purpose.
       "region": "A String", # [Output Only] The URL of the region where a regional address resides. For regional addresses, you must specify the region as a path parameter in the HTTP request URL. *This field is not applicable to global addresses.*
       "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
       "status": "A String", # [Output Only] The status of the address, which can be one of RESERVING, RESERVED, or IN_USE. An address that is RESERVING is currently in the process of being reserved. A RESERVED address is currently reserved and available to use. An IN_USE address is currently being used by another resource and is not available.

docs/dyn/compute_v1.healthChecks.html

diff --git a/docs/dyn/compute_v1.healthChecks.html b/docs/dyn/compute_v1.healthChecks.html
index 98a7a7d..784100e 100644
--- a/docs/dyn/compute_v1.healthChecks.html
+++ b/docs/dyn/compute_v1.healthChecks.html
@@ -130,7 +130,7 @@
   "items": { # A list of HealthChecksScopedList resources.
     "a_key": { # Name of the scope containing this set of HealthChecks.
       "healthChecks": [ # A list of HealthChecks contained in this scope.
-        { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/v1/healthChecks) * [Regional](/compute/docs/reference/rest/v1/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+        { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/v1/healthChecks) * [Regional](/compute/docs/reference/rest/v1/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
           "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
           "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
           "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -325,7 +325,7 @@
 Returns:
   An object of the form:
 
-    { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/v1/healthChecks) * [Regional](/compute/docs/reference/rest/v1/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+    { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/v1/healthChecks) * [Regional](/compute/docs/reference/rest/v1/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -402,7 +402,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/v1/healthChecks) * [Regional](/compute/docs/reference/rest/v1/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/v1/healthChecks) * [Regional](/compute/docs/reference/rest/v1/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -547,7 +547,7 @@
     { # Contains a list of HealthCheck resources.
   "id": "A String", # [Output Only] Unique identifier for the resource; defined by the server.
   "items": [ # A list of HealthCheck resources.
-    { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/v1/healthChecks) * [Regional](/compute/docs/reference/rest/v1/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+    { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/v1/healthChecks) * [Regional](/compute/docs/reference/rest/v1/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
       "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
       "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -654,7 +654,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/v1/healthChecks) * [Regional](/compute/docs/reference/rest/v1/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/v1/healthChecks) * [Regional](/compute/docs/reference/rest/v1/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -787,7 +787,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/v1/healthChecks) * [Regional](/compute/docs/reference/rest/v1/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/v1/healthChecks) * [Regional](/compute/docs/reference/rest/v1/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.

docs/dyn/compute_v1.html

diff --git a/docs/dyn/compute_v1.html b/docs/dyn/compute_v1.html
index 2c48460..365e5a2 100644
--- a/docs/dyn/compute_v1.html
+++ b/docs/dyn/compute_v1.html
@@ -175,6 +175,11 @@
 <p class="firstline">Returns the httpsHealthChecks Resource.</p>
 
 <p class="toc_element">
+  <code><a href="compute_v1.imageFamilyViews.html">imageFamilyViews()</a></code>
+</p>
+<p class="firstline">Returns the imageFamilyViews Resource.</p>
+
+<p class="toc_element">
   <code><a href="compute_v1.images.html">images()</a></code>
 </p>
 <p class="firstline">Returns the images Resource.</p>

docs/dyn/compute_v1.httpHealthChecks.html

diff --git a/docs/dyn/compute_v1.httpHealthChecks.html b/docs/dyn/compute_v1.httpHealthChecks.html
index d0bc77c..9a566fe 100644
--- a/docs/dyn/compute_v1.httpHealthChecks.html
+++ b/docs/dyn/compute_v1.httpHealthChecks.html
@@ -182,7 +182,7 @@
 Returns:
   An object of the form:
 
-    { # Represents a legacy HTTP Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+    { # Represents a legacy HTTP Health Check resource. Legacy HTTP health checks are now only required by target pool-based network load balancers. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -208,7 +208,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a legacy HTTP Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+{ # Represents a legacy HTTP Health Check resource. Legacy HTTP health checks are now only required by target pool-based network load balancers. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -302,7 +302,7 @@
     { # Contains a list of HttpHealthCheck resources.
   "id": "A String", # [Output Only] Unique identifier for the resource; defined by the server.
   "items": [ # A list of HttpHealthCheck resources.
-    { # Represents a legacy HTTP Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+    { # Represents a legacy HTTP Health Check resource. Legacy HTTP health checks are now only required by target pool-based network load balancers. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
       "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
       "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -358,7 +358,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a legacy HTTP Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+{ # Represents a legacy HTTP Health Check resource. Legacy HTTP health checks are now only required by target pool-based network load balancers. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -440,7 +440,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a legacy HTTP Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+{ # Represents a legacy HTTP Health Check resource. Legacy HTTP health checks are now only required by target pool-based network load balancers. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.

docs/dyn/compute_v1.httpsHealthChecks.html

diff --git a/docs/dyn/compute_v1.httpsHealthChecks.html b/docs/dyn/compute_v1.httpsHealthChecks.html
index 9457475..4b423fd 100644
--- a/docs/dyn/compute_v1.httpsHealthChecks.html
+++ b/docs/dyn/compute_v1.httpsHealthChecks.html
@@ -182,7 +182,7 @@
 Returns:
   An object of the form:
 
-    { # Represents a legacy HTTPS Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+    { # Represents a legacy HTTPS Health Check resource. Legacy HTTPS health checks have been deprecated. If you are using a target pool-based network load balancer, you must use a legacy HTTP (not HTTPS) health check. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -208,7 +208,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a legacy HTTPS Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+{ # Represents a legacy HTTPS Health Check resource. Legacy HTTPS health checks have been deprecated. If you are using a target pool-based network load balancer, you must use a legacy HTTP (not HTTPS) health check. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -302,7 +302,7 @@
     { # Contains a list of HttpsHealthCheck resources.
   "id": "A String", # [Output Only] Unique identifier for the resource; defined by the server.
   "items": [ # A list of HttpsHealthCheck resources.
-    { # Represents a legacy HTTPS Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+    { # Represents a legacy HTTPS Health Check resource. Legacy HTTPS health checks have been deprecated. If you are using a target pool-based network load balancer, you must use a legacy HTTP (not HTTPS) health check. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
       "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
       "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -358,7 +358,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a legacy HTTPS Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+{ # Represents a legacy HTTPS Health Check resource. Legacy HTTPS health checks have been deprecated. If you are using a target pool-based network load balancer, you must use a legacy HTTP (not HTTPS) health check. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -440,7 +440,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a legacy HTTPS Health Check resource. Legacy health checks are required by network load balancers. For more information, read Health Check Concepts.
+{ # Represents a legacy HTTPS Health Check resource. Legacy HTTPS health checks have been deprecated. If you are using a target pool-based network load balancer, you must use a legacy HTTP (not HTTPS) health check. For all other load balancers, including backend service-based network load balancers, and for managed instance group auto-healing, you must use modern (non-legacy) health checks. For more information, see Health checks overview .
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in RFC3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.

docs/dyn/compute_v1.imageFamilyViews.html

diff --git a/docs/dyn/compute_v1.imageFamilyViews.html b/docs/dyn/compute_v1.imageFamilyViews.html
new file mode 100644
index 0000000..f1a8006
--- /dev/null
+++ b/docs/dyn/compute_v1.imageFamilyViews.html
@@ -0,0 +1,211 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="compute_v1.html">Compute Engine API</a> . <a href="compute_v1.imageFamilyViews.html">imageFamilyViews</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#get">get(project, zone, family, x__xgafv=None)</a></code></p>
+<p class="firstline">Returns the latest image that is part of an image family, is not deprecated and is rolled out in the specified zone.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="get">get(project, zone, family, x__xgafv=None)</code>
+  <pre>Returns the latest image that is part of an image family, is not deprecated and is rolled out in the specified zone.
+
+Args:
+  project: string, Project ID for this request. (required)
+  zone: string, The name of the zone for this request. (required)
+  family: string, Name of the image family to search for. (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    {
+  &quot;image&quot;: { # Represents an Image resource. You can use images to create boot disks for your VM instances. For more information, read Images. # The latest image that is part of the specified image family in the requested location, and that is not deprecated.
+    &quot;archiveSizeBytes&quot;: &quot;A String&quot;, # Size of the image tar.gz archive stored in Google Cloud Storage (in bytes).
+    &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
+    &quot;deprecated&quot;: { # Deprecation status for a public resource. # The deprecation status associated with this image.
+      &quot;deleted&quot;: &quot;A String&quot;, # An optional RFC3339 timestamp on or after which the state of this resource is intended to change to DELETED. This is only informational and the status will not change unless the client explicitly changes it.
+      &quot;deprecated&quot;: &quot;A String&quot;, # An optional RFC3339 timestamp on or after which the state of this resource is intended to change to DEPRECATED. This is only informational and the status will not change unless the client explicitly changes it.
+      &quot;obsolete&quot;: &quot;A String&quot;, # An optional RFC3339 timestamp on or after which the state of this resource is intended to change to OBSOLETE. This is only informational and the status will not change unless the client explicitly changes it.
+      &quot;replacement&quot;: &quot;A String&quot;, # The URL of the suggested replacement for a deprecated resource. The suggested replacement resource must be the same kind of resource as the deprecated resource.
+      &quot;state&quot;: &quot;A String&quot;, # The deprecation state of this resource. This can be ACTIVE, DEPRECATED, OBSOLETE, or DELETED. Operations which communicate the end of life date for an image, can use ACTIVE. Operations which create a new resource using a DEPRECATED resource will return successfully, but with a warning indicating the deprecated resource and recommending its replacement. Operations which use OBSOLETE or DELETED resources will be rejected and result in an error.
+    },
+    &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
+    &quot;diskSizeGb&quot;: &quot;A String&quot;, # Size of the image when restored onto a persistent disk (in GB).
+    &quot;family&quot;: &quot;A String&quot;, # The name of the image family to which this image belongs. You can create disks by specifying an image family instead of a specific image name. The image family always returns its latest image that is not deprecated. The name of the image family must comply with RFC1035.
+    &quot;guestOsFeatures&quot;: [ # A list of features to enable on the guest operating system. Applicable only for bootable images. Read Enabling guest operating system features to see a list of available options.
+      { # Guest OS features.
+        &quot;type&quot;: &quot;A String&quot;, # The ID of a supported feature. Read Enabling guest operating system features to see a list of available options.
+      },
+    ],
+    &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
+    &quot;imageEncryptionKey&quot;: { # Encrypts the image using a customer-supplied encryption key. After you encrypt an image with a customer-supplied key, you must provide the same key if you use the image later (e.g. to create a disk from the image). Customer-supplied encryption keys do not protect access to metadata of the disk. If you do not provide an encryption key when creating the image, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the image later.
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
+    },
+    &quot;kind&quot;: &quot;compute#image&quot;, # [Output Only] Type of the resource. Always compute#image for images.
+    &quot;labelFingerprint&quot;: &quot;A String&quot;, # A fingerprint for the labels being applied to this image, which is essentially a hash of the labels used for optimistic locking. The fingerprint is initially generated by Compute Engine and changes after every request to modify or update labels. You must always provide an up-to-date fingerprint hash in order to update or change labels, otherwise the request will fail with error 412 conditionNotMet. To see the latest fingerprint, make a get() request to retrieve an image.
+    &quot;labels&quot;: { # Labels to apply to this image. These can be later modified by the setLabels method.
+      &quot;a_key&quot;: &quot;A String&quot;,
+    },
+    &quot;licenseCodes&quot;: [ # Integer license codes indicating which licenses are attached to this image.
+      &quot;A String&quot;,
+    ],
+    &quot;licenses&quot;: [ # Any applicable license URI.
+      &quot;A String&quot;,
+    ],
+    &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
+    &quot;rawDisk&quot;: { # The parameters of the raw disk image.
+      &quot;containerType&quot;: &quot;A String&quot;, # The format used to encode and transmit the block device, which should be TAR. This is just a container and transmission format and not a runtime format. Provided by the client when the disk image is created.
+      &quot;sha1Checksum&quot;: &quot;A String&quot;, # [Deprecated] This field is deprecated. An optional SHA1 checksum of the disk image before unpackaging provided by the client when the disk image is created.
+      &quot;source&quot;: &quot;A String&quot;, # The full Google Cloud Storage URL where the raw disk image archive is stored. The following are valid formats for the URL: - https://storage.googleapis.com/bucket_name/image_archive_name - https://storage.googleapis.com/bucket_name/folder_name/ image_archive_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+    },
+    &quot;satisfiesPzs&quot;: True or False, # [Output Only] Reserved for future use.
+    &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
+    &quot;shieldedInstanceInitialState&quot;: { # Initial State for shielded instance, these are public keys which are safe to store in public # Set the secure boot keys of shielded instance.
+      &quot;dbs&quot;: [ # The Key Database (db).
+        {
+          &quot;content&quot;: &quot;A String&quot;, # The raw content in the secure keys file.
+          &quot;fileType&quot;: &quot;A String&quot;, # The file type of source file.
+        },
+      ],
+      &quot;dbxs&quot;: [ # The forbidden key database (dbx).
+        {
+          &quot;content&quot;: &quot;A String&quot;, # The raw content in the secure keys file.
+          &quot;fileType&quot;: &quot;A String&quot;, # The file type of source file.
+        },
+      ],
+      &quot;keks&quot;: [ # The Key Exchange Key (KEK).
+        {
+          &quot;content&quot;: &quot;A String&quot;, # The raw content in the secure keys file.
+          &quot;fileType&quot;: &quot;A String&quot;, # The file type of source file.
+        },
+      ],
+      &quot;pk&quot;: { # The Platform Key (PK).
+        &quot;content&quot;: &quot;A String&quot;, # The raw content in the secure keys file.
+        &quot;fileType&quot;: &quot;A String&quot;, # The file type of source file.
+      },
+    },
+    &quot;sourceDisk&quot;: &quot;A String&quot;, # URL of the source disk used to create this image. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /disks/disk - projects/project/zones/zone/disks/disk - zones/zone/disks/disk In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+    &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
+    },
+    &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
+    &quot;sourceImage&quot;: &quot;A String&quot;, # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+    &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
+    },
+    &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
+    &quot;sourceSnapshot&quot;: &quot;A String&quot;, # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+    &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
+    },
+    &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the snapshot used to create this image. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given snapshot name.
+    &quot;sourceType&quot;: &quot;RAW&quot;, # The type of the image used to create this disk. The default and only value is RAW
+    &quot;status&quot;: &quot;A String&quot;, # [Output Only] The status of the image. An image can be used to create other resources, such as instances, only after the image has been successfully created and the status is set to READY. Possible values are FAILED, PENDING, or READY.
+    &quot;storageLocations&quot;: [ # Cloud Storage bucket storage location of the image (regional or multi-regional).
+      &quot;A String&quot;,
+    ],
+  },
+}</pre>
+</div>
+
+</body></html>
\ No newline at end of file

docs/dyn/compute_v1.images.html

diff --git a/docs/dyn/compute_v1.images.html b/docs/dyn/compute_v1.images.html
index 0a2eb14..8062fc9 100644
--- a/docs/dyn/compute_v1.images.html
+++ b/docs/dyn/compute_v1.images.html
@@ -294,6 +294,7 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "kind": "compute#image", # [Output Only] Type of the resource. Always compute#image for images.
@@ -311,7 +312,7 @@
   "rawDisk": { # The parameters of the raw disk image.
     "containerType": "A String", # The format used to encode and transmit the block device, which should be TAR. This is just a container and transmission format and not a runtime format. Provided by the client when the disk image is created.
     "sha1Checksum": "A String", # [Deprecated] This field is deprecated. An optional SHA1 checksum of the disk image before unpackaging provided by the client when the disk image is created.
-    "source": "A String", # The full Google Cloud Storage URL where the disk image is stored. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+    "source": "A String", # The full Google Cloud Storage URL where the raw disk image archive is stored. The following are valid formats for the URL: - https://storage.googleapis.com/bucket_name/image_archive_name - https://storage.googleapis.com/bucket_name/folder_name/ image_archive_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   },
   "satisfiesPzs": True or False, # [Output Only] Reserved for future use.
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
@@ -344,22 +345,25 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceDiskId": "A String", # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
-  "sourceImage": "A String", # URL of the source image used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+  "sourceImage": "A String", # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   "sourceImageEncryptionKey": { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceImageId": "A String", # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
-  "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+  "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   "sourceSnapshotEncryptionKey": { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceSnapshotId": "A String", # [Output Only] The ID value of the snapshot used to create this image. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given snapshot name.
@@ -409,6 +413,7 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "kind": "compute#image", # [Output Only] Type of the resource. Always compute#image for images.
@@ -426,7 +431,7 @@
   "rawDisk": { # The parameters of the raw disk image.
     "containerType": "A String", # The format used to encode and transmit the block device, which should be TAR. This is just a container and transmission format and not a runtime format. Provided by the client when the disk image is created.
     "sha1Checksum": "A String", # [Deprecated] This field is deprecated. An optional SHA1 checksum of the disk image before unpackaging provided by the client when the disk image is created.
-    "source": "A String", # The full Google Cloud Storage URL where the disk image is stored. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+    "source": "A String", # The full Google Cloud Storage URL where the raw disk image archive is stored. The following are valid formats for the URL: - https://storage.googleapis.com/bucket_name/image_archive_name - https://storage.googleapis.com/bucket_name/folder_name/ image_archive_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   },
   "satisfiesPzs": True or False, # [Output Only] Reserved for future use.
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
@@ -459,22 +464,25 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceDiskId": "A String", # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
-  "sourceImage": "A String", # URL of the source image used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+  "sourceImage": "A String", # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   "sourceImageEncryptionKey": { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceImageId": "A String", # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
-  "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+  "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   "sourceSnapshotEncryptionKey": { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceSnapshotId": "A String", # [Output Only] The ID value of the snapshot used to create this image. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given snapshot name.
@@ -622,6 +630,7 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "kind": "compute#image", # [Output Only] Type of the resource. Always compute#image for images.
@@ -639,7 +648,7 @@
   "rawDisk": { # The parameters of the raw disk image.
     "containerType": "A String", # The format used to encode and transmit the block device, which should be TAR. This is just a container and transmission format and not a runtime format. Provided by the client when the disk image is created.
     "sha1Checksum": "A String", # [Deprecated] This field is deprecated. An optional SHA1 checksum of the disk image before unpackaging provided by the client when the disk image is created.
-    "source": "A String", # The full Google Cloud Storage URL where the disk image is stored. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+    "source": "A String", # The full Google Cloud Storage URL where the raw disk image archive is stored. The following are valid formats for the URL: - https://storage.googleapis.com/bucket_name/image_archive_name - https://storage.googleapis.com/bucket_name/folder_name/ image_archive_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   },
   "satisfiesPzs": True or False, # [Output Only] Reserved for future use.
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
@@ -672,22 +681,25 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceDiskId": "A String", # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
-  "sourceImage": "A String", # URL of the source image used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+  "sourceImage": "A String", # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   "sourceImageEncryptionKey": { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceImageId": "A String", # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
-  "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+  "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   "sourceSnapshotEncryptionKey": { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceSnapshotId": "A String", # [Output Only] The ID value of the snapshot used to create this image. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given snapshot name.
@@ -800,6 +812,7 @@
         "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
         "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
         "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+        "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       "kind": "compute#image", # [Output Only] Type of the resource. Always compute#image for images.
@@ -817,7 +830,7 @@
       "rawDisk": { # The parameters of the raw disk image.
         "containerType": "A String", # The format used to encode and transmit the block device, which should be TAR. This is just a container and transmission format and not a runtime format. Provided by the client when the disk image is created.
         "sha1Checksum": "A String", # [Deprecated] This field is deprecated. An optional SHA1 checksum of the disk image before unpackaging provided by the client when the disk image is created.
-        "source": "A String", # The full Google Cloud Storage URL where the disk image is stored. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+        "source": "A String", # The full Google Cloud Storage URL where the raw disk image archive is stored. The following are valid formats for the URL: - https://storage.googleapis.com/bucket_name/image_archive_name - https://storage.googleapis.com/bucket_name/folder_name/ image_archive_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
       },
       "satisfiesPzs": True or False, # [Output Only] Reserved for future use.
       "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
@@ -850,22 +863,25 @@
         "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
         "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
         "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+        "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       "sourceDiskId": "A String", # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
-      "sourceImage": "A String", # URL of the source image used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+      "sourceImage": "A String", # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
       "sourceImageEncryptionKey": { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
         "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
         "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
         "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+        "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       "sourceImageId": "A String", # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
-      "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+      "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
       "sourceSnapshotEncryptionKey": { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
         "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
         "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
         "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+        "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       "sourceSnapshotId": "A String", # [Output Only] The ID value of the snapshot used to create this image. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given snapshot name.
@@ -939,6 +955,7 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "kind": "compute#image", # [Output Only] Type of the resource. Always compute#image for images.
@@ -956,7 +973,7 @@
   "rawDisk": { # The parameters of the raw disk image.
     "containerType": "A String", # The format used to encode and transmit the block device, which should be TAR. This is just a container and transmission format and not a runtime format. Provided by the client when the disk image is created.
     "sha1Checksum": "A String", # [Deprecated] This field is deprecated. An optional SHA1 checksum of the disk image before unpackaging provided by the client when the disk image is created.
-    "source": "A String", # The full Google Cloud Storage URL where the disk image is stored. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+    "source": "A String", # The full Google Cloud Storage URL where the raw disk image archive is stored. The following are valid formats for the URL: - https://storage.googleapis.com/bucket_name/image_archive_name - https://storage.googleapis.com/bucket_name/folder_name/ image_archive_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   },
   "satisfiesPzs": True or False, # [Output Only] Reserved for future use.
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
@@ -989,22 +1006,25 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceDiskId": "A String", # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
-  "sourceImage": "A String", # URL of the source image used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+  "sourceImage": "A String", # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   "sourceImageEncryptionKey": { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceImageId": "A String", # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
-  "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
+  "sourceSnapshot": "A String", # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   "sourceSnapshotEncryptionKey": { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceSnapshotId": "A String", # [Output Only] The ID value of the snapshot used to create this image. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given snapshot name.

docs/dyn/compute_v1.instanceGroupManagers.html

diff --git a/docs/dyn/compute_v1.instanceGroupManagers.html b/docs/dyn/compute_v1.instanceGroupManagers.html
index b591be5..6cd356b 100644
--- a/docs/dyn/compute_v1.instanceGroupManagers.html
+++ b/docs/dyn/compute_v1.instanceGroupManagers.html
@@ -271,7 +271,7 @@
             "restarting": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be restarted or are currently being restarted.
             "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
           },
-          "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+          "description": "A String", # An optional description of this resource.
           "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
             "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
             "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -643,6 +643,7 @@
   "instances": [ # The URLs of one or more instances to delete. This can be a full URL or a partial URL, such as zones/[ZONE]/instances/[INSTANCE_NAME].
     "A String",
   ],
+  "skipInstancesOnValidationError": True or False, # Specifies whether the request should proceed despite the inclusion of instances that are not members of the group or that are already in the process of being deleted or abandoned. If this field is set to `false` and such an instance is specified in the request, the operation fails. The operation always fails if the request contains a malformed instance URL or a reference to an instance that exists in a zone or region other than the group's zone or region.
 }
 
   requestId: string, An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported ( 00000000-0000-0000-0000-000000000000).
@@ -809,7 +810,7 @@
     "restarting": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be restarted or are currently being restarted.
     "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
   },
-  "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+  "description": "A String", # An optional description of this resource.
   "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
     "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
     "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -919,7 +920,7 @@
     "restarting": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be restarted or are currently being restarted.
     "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
   },
-  "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+  "description": "A String", # An optional description of this resource.
   "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
     "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
     "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -1097,7 +1098,7 @@
         "restarting": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be restarted or are currently being restarted.
         "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
       },
-      "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+      "description": "A String", # An optional description of this resource.
       "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
         "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
         "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -1456,7 +1457,7 @@
     "restarting": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be restarted or are currently being restarted.
     "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
   },
-  "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+  "description": "A String", # An optional description of this resource.
   "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
     "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
     "zones": [ # Zones where the regional managed instance group will create and manage its instances.

docs/dyn/compute_v1.instanceTemplates.html

diff --git a/docs/dyn/compute_v1.instanceTemplates.html b/docs/dyn/compute_v1.instanceTemplates.html
index f32a45b..99dc9d8 100644
--- a/docs/dyn/compute_v1.instanceTemplates.html
+++ b/docs/dyn/compute_v1.instanceTemplates.html
@@ -210,6 +210,7 @@
           "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
           "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
           "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+          "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         "diskSizeGb": "A String", # The size of the disk in GB.
@@ -237,6 +238,7 @@
             "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
             "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
             "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+            "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           "sourceSnapshot": "A String", # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
@@ -244,6 +246,7 @@
             "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
             "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
             "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+            "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
         },
@@ -549,6 +552,7 @@
           "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
           "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
           "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+          "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         "diskSizeGb": "A String", # The size of the disk in GB.
@@ -576,6 +580,7 @@
             "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
             "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
             "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+            "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           "sourceSnapshot": "A String", # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
@@ -583,6 +588,7 @@
             "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
             "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
             "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+            "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
         },
@@ -852,6 +858,7 @@
               "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
               "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
               "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+              "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
               "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
             },
             "diskSizeGb": "A String", # The size of the disk in GB.
@@ -879,6 +886,7 @@
                 "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
                 "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
                 "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+                "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
                 "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
               },
               "sourceSnapshot": "A String", # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
@@ -886,6 +894,7 @@
                 "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
                 "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
                 "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+                "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
                 "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
               },
             },

docs/dyn/compute_v1.instances.html

diff --git a/docs/dyn/compute_v1.instances.html b/docs/dyn/compute_v1.instances.html
index 4f4f38b..dc0bcf2 100644
--- a/docs/dyn/compute_v1.instances.html
+++ b/docs/dyn/compute_v1.instances.html
@@ -416,6 +416,7 @@
                 "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
                 "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
                 "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+                "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
                 "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
               },
               "diskSizeGb": "A String", # The size of the disk in GB.
@@ -443,6 +444,7 @@
                   "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
                   "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
                   "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+                  "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
                   "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
                 },
                 "sourceSnapshot": "A String", # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
@@ -450,6 +452,7 @@
                   "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
                   "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
                   "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+                  "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
                   "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
                 },
               },
@@ -688,6 +691,7 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "diskSizeGb": "A String", # The size of the disk in GB.
@@ -715,6 +719,7 @@
       "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
       "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
       "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+      "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     "sourceSnapshot": "A String", # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
@@ -722,6 +727,7 @@
       "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
       "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
       "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+      "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
   },
@@ -847,6 +853,7 @@
           "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
           "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
           "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+          "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         "diskSizeGb": "A String", # The size of the disk in GB.
@@ -874,6 +881,7 @@
             "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
             "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
             "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+            "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           "sourceSnapshot": "A String", # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
@@ -881,6 +889,7 @@
             "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
             "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
             "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+            "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
         },
@@ -1344,6 +1353,7 @@
         "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
         "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
         "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+        "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       "diskSizeGb": "A String", # The size of the disk in GB.
@@ -1371,6 +1381,7 @@
           "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
           "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
           "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+          "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         "sourceSnapshot": "A String", # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
@@ -1378,6 +1389,7 @@
           "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
           "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
           "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+          "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
       },
@@ -1584,7 +1596,7 @@
           "enableLogging": True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
           "kind": "compute#firewallPolicyRule", # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
           "match": { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
-            "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+            "destIpRanges": [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
               "A String",
             ],
             "layer4Configs": [ # Pairs of IP protocols and ports that the rule should match.
@@ -1595,7 +1607,7 @@
                 ],
               },
             ],
-            "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+            "srcIpRanges": [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
               "A String",
             ],
           },
@@ -1633,7 +1645,7 @@
         },
       ],
       "description": "A String", # An optional description of this resource. Provide this field when you create the resource.
-      "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Only IPv4 is supported.
+      "destinationRanges": [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Both IPv4 and IPv6 are supported.
         "A String",
       ],
       "direction": "A String", # Direction of traffic to which this firewall applies, either `INGRESS` or `EGRESS`. The default is `INGRESS`. For `INGRESS` traffic, you cannot specify the destinationRanges field, and for `EGRESS` traffic, you cannot specify the sourceRanges or sourceTags fields.
@@ -1648,7 +1660,7 @@
       "network": "A String", # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
       "priority": 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
       "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
-      "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Only IPv4 is supported.
+      "sourceRanges": [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Both IPv4 and IPv6 are supported.
         "A String",
       ],
       "sourceServiceAccounts": [ # If source service accounts are specified, the firewall rules apply only to traffic originating from an instance with a service account in this list. Source service accounts cannot be used to control traffic to an instance's external IP address because service accounts are associated with an instance, not an IP address. sourceRanges can be set at the same time as sourceServiceAccounts. If both are set, the firewall applies to traffic that has a source IP address within the sourceRanges OR a source IP that belongs to an instance with service account listed in sourceServiceAccount. The connection does not need to match both fields for the firewall to apply. sourceServiceAccounts cannot be used at the same time as sourceTags or targetTags.
@@ -1919,6 +1931,7 @@
         "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
         "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
         "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+        "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       "diskSizeGb": "A String", # The size of the disk in GB.
@@ -1946,6 +1959,7 @@
           "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
           "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
           "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+          "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         "sourceSnapshot": "A String", # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
@@ -1953,6 +1967,7 @@
           "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
           "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
           "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+          "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
       },
@@ -2229,6 +2244,7 @@
             "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
             "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
             "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+            "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           "diskSizeGb": "A String", # The size of the disk in GB.
@@ -2256,6 +2272,7 @@
               "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
               "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
               "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+              "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
               "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
             },
             "sourceSnapshot": "A String", # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
@@ -2263,6 +2280,7 @@
               "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
               "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
               "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+              "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
               "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
             },
           },
@@ -3841,6 +3859,7 @@
         "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
         "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
         "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+        "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       "source": "A String", # Specifies a valid partial or full URL to an existing Persistent Disk resource. This field is only applicable for persistent disks.
@@ -4033,6 +4052,7 @@
         "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
         "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
         "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+        "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       "diskSizeGb": "A String", # The size of the disk in GB.
@@ -4060,6 +4080,7 @@
           "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
           "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
           "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+          "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         "sourceSnapshot": "A String", # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
@@ -4067,6 +4088,7 @@
           "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
           "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
           "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+          "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
       },

docs/dyn/compute_v1.networks.html

diff --git a/docs/dyn/compute_v1.networks.html b/docs/dyn/compute_v1.networks.html
index f47dac8..32086ab 100644
--- a/docs/dyn/compute_v1.networks.html
+++ b/docs/dyn/compute_v1.networks.html
@@ -115,7 +115,7 @@
 <p class="firstline">Switches the network mode from auto subnet mode to custom subnet mode.</p>
 <p class="toc_element">
   <code><a href="#updatePeering">updatePeering(project, network, body=None, requestId=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Updates the specified network peering with the data included in the request Only the following fields can be modified: NetworkPeering.export_custom_routes, and NetworkPeering.import_custom_routes</p>
+<p class="firstline">Updates the specified network peering with the data included in the request. You can only modify the NetworkPeering.export_custom_routes field and the NetworkPeering.import_custom_routes field.</p>
 <h3>Method Details</h3>
 <div class="method">
     <code class="details" id="addPeering">addPeering(project, network, body=None, requestId=None, x__xgafv=None)</code>
@@ -134,9 +134,9 @@
     &quot;autoCreateRoutes&quot;: True or False, # This field will be deprecated soon. Use the exchange_subnet_routes field instead. Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
     &quot;exchangeSubnetRoutes&quot;: True or False, # Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
     &quot;exportCustomRoutes&quot;: True or False, # Whether to export the custom routes to peer network.
-    &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always exported to peers and are not controlled by this field.
+    &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. IPv4 special-use ranges are always exported to peers and are not controlled by this field.
     &quot;importCustomRoutes&quot;: True or False, # Whether to import the custom routes from peer network.
-    &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always imported from peers and are not controlled by this field.
+    &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. IPv4 special-use ranges are always imported from peers and are not controlled by this field.
     &quot;name&quot;: &quot;A String&quot;, # Name of this peering. Provided by the client when the peering is created. The name must comply with RFC1035. Specifically, the name must be 1-63 characters long and match regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all the following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
     &quot;network&quot;: &quot;A String&quot;, # The URL of the peer network. It can be either full URL or partial URL. The peer network may belong to a different project. If the partial URL does not contain project, it is assumed that the peer network is in the same project as the current network.
     &quot;peerMtu&quot;: 42, # Maximum Transmission Unit in bytes.
@@ -300,9 +300,9 @@
       &quot;autoCreateRoutes&quot;: True or False, # This field will be deprecated soon. Use the exchange_subnet_routes field instead. Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
       &quot;exchangeSubnetRoutes&quot;: True or False, # Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
       &quot;exportCustomRoutes&quot;: True or False, # Whether to export the custom routes to peer network.
-      &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always exported to peers and are not controlled by this field.
+      &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. IPv4 special-use ranges are always exported to peers and are not controlled by this field.
       &quot;importCustomRoutes&quot;: True or False, # Whether to import the custom routes from peer network.
-      &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always imported from peers and are not controlled by this field.
+      &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. IPv4 special-use ranges are always imported from peers and are not controlled by this field.
       &quot;name&quot;: &quot;A String&quot;, # Name of this peering. Provided by the client when the peering is created. The name must comply with RFC1035. Specifically, the name must be 1-63 characters long and match regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all the following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
       &quot;network&quot;: &quot;A String&quot;, # The URL of the peer network. It can be either full URL or partial URL. The peer network may belong to a different project. If the partial URL does not contain project, it is assumed that the peer network is in the same project as the current network.
       &quot;peerMtu&quot;: 42, # Maximum Transmission Unit in bytes.
@@ -349,7 +349,7 @@
           &quot;enableLogging&quot;: True or False, # Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on &quot;goto_next&quot; rules.
           &quot;kind&quot;: &quot;compute#firewallPolicyRule&quot;, # [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
           &quot;match&quot;: { # Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified. # A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding &#x27;action&#x27; is enforced.
-            &quot;destIpRanges&quot;: [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
+            &quot;destIpRanges&quot;: [ # CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
               &quot;A String&quot;,
             ],
             &quot;layer4Configs&quot;: [ # Pairs of IP protocols and ports that the rule should match.
@@ -360,7 +360,7 @@
                 ],
               },
             ],
-            &quot;srcIpRanges&quot;: [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
+            &quot;srcIpRanges&quot;: [ # CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
               &quot;A String&quot;,
             ],
           },
@@ -398,7 +398,7 @@
         },
       ],
       &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
-      &quot;destinationRanges&quot;: [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Only IPv4 is supported.
+      &quot;destinationRanges&quot;: [ # If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Both IPv4 and IPv6 are supported.
         &quot;A String&quot;,
       ],
       &quot;direction&quot;: &quot;A String&quot;, # Direction of traffic to which this firewall applies, either `INGRESS` or `EGRESS`. The default is `INGRESS`. For `INGRESS` traffic, you cannot specify the destinationRanges field, and for `EGRESS` traffic, you cannot specify the sourceRanges or sourceTags fields.
@@ -413,7 +413,7 @@
       &quot;network&quot;: &quot;A String&quot;, # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
       &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
-      &quot;sourceRanges&quot;: [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Only IPv4 is supported.
+      &quot;sourceRanges&quot;: [ # If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the rule to apply. Both IPv4 and IPv6 are supported.
         &quot;A String&quot;,
       ],
       &quot;sourceServiceAccounts&quot;: [ # If source service accounts are specified, the firewall rules apply only to traffic originating from an instance with a service account in this list. Source service accounts cannot be used to control traffic to an instance&#x27;s external IP address because service accounts are associated with an instance, not an IP address. sourceRanges can be set at the same time as sourceServiceAccounts. If both are set, the firewall applies to traffic that has a source IP address within the sourceRanges OR a source IP that belongs to an instance with service account listed in sourceServiceAccount. The connection does not need to match both fields for the firewall to apply. sourceServiceAccounts cannot be used at the same time as sourceTags or targetTags.
@@ -457,9 +457,9 @@
       &quot;autoCreateRoutes&quot;: True or False, # This field will be deprecated soon. Use the exchange_subnet_routes field instead. Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
       &quot;exchangeSubnetRoutes&quot;: True or False, # Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
       &quot;exportCustomRoutes&quot;: True or False, # Whether to export the custom routes to peer network.
-      &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always exported to peers and are not controlled by this field.
+      &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. IPv4 special-use ranges are always exported to peers and are not controlled by this field.
       &quot;importCustomRoutes&quot;: True or False, # Whether to import the custom routes from peer network.
-      &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always imported from peers and are not controlled by this field.
+      &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. IPv4 special-use ranges are always imported from peers and are not controlled by this field.
       &quot;name&quot;: &quot;A String&quot;, # Name of this peering. Provided by the client when the peering is created. The name must comply with RFC1035. Specifically, the name must be 1-63 characters long and match regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all the following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
       &quot;network&quot;: &quot;A String&quot;, # The URL of the peer network. It can be either full URL or partial URL. The peer network may belong to a different project. If the partial URL does not contain project, it is assumed that the peer network is in the same project as the current network.
       &quot;peerMtu&quot;: 42, # Maximum Transmission Unit in bytes.
@@ -569,9 +569,9 @@
           &quot;autoCreateRoutes&quot;: True or False, # This field will be deprecated soon. Use the exchange_subnet_routes field instead. Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
           &quot;exchangeSubnetRoutes&quot;: True or False, # Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
           &quot;exportCustomRoutes&quot;: True or False, # Whether to export the custom routes to peer network.
-          &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always exported to peers and are not controlled by this field.
+          &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. IPv4 special-use ranges are always exported to peers and are not controlled by this field.
           &quot;importCustomRoutes&quot;: True or False, # Whether to import the custom routes from peer network.
-          &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always imported from peers and are not controlled by this field.
+          &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. IPv4 special-use ranges are always imported from peers and are not controlled by this field.
           &quot;name&quot;: &quot;A String&quot;, # Name of this peering. Provided by the client when the peering is created. The name must comply with RFC1035. Specifically, the name must be 1-63 characters long and match regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all the following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
           &quot;network&quot;: &quot;A String&quot;, # The URL of the peer network. It can be either full URL or partial URL. The peer network may belong to a different project. If the partial URL does not contain project, it is assumed that the peer network is in the same project as the current network.
           &quot;peerMtu&quot;: 42, # Maximum Transmission Unit in bytes.
@@ -710,9 +710,9 @@
       &quot;autoCreateRoutes&quot;: True or False, # This field will be deprecated soon. Use the exchange_subnet_routes field instead. Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
       &quot;exchangeSubnetRoutes&quot;: True or False, # Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
       &quot;exportCustomRoutes&quot;: True or False, # Whether to export the custom routes to peer network.
-      &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always exported to peers and are not controlled by this field.
+      &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. IPv4 special-use ranges are always exported to peers and are not controlled by this field.
       &quot;importCustomRoutes&quot;: True or False, # Whether to import the custom routes from peer network.
-      &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always imported from peers and are not controlled by this field.
+      &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. IPv4 special-use ranges are always imported from peers and are not controlled by this field.
       &quot;name&quot;: &quot;A String&quot;, # Name of this peering. Provided by the client when the peering is created. The name must comply with RFC1035. Specifically, the name must be 1-63 characters long and match regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all the following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
       &quot;network&quot;: &quot;A String&quot;, # The URL of the peer network. It can be either full URL or partial URL. The peer network may belong to a different project. If the partial URL does not contain project, it is assumed that the peer network is in the same project as the current network.
       &quot;peerMtu&quot;: 42, # Maximum Transmission Unit in bytes.
@@ -920,7 +920,7 @@
 
 <div class="method">
     <code class="details" id="updatePeering">updatePeering(project, network, body=None, requestId=None, x__xgafv=None)</code>
-  <pre>Updates the specified network peering with the data included in the request Only the following fields can be modified: NetworkPeering.export_custom_routes, and NetworkPeering.import_custom_routes
+  <pre>Updates the specified network peering with the data included in the request. You can only modify the NetworkPeering.export_custom_routes field and the NetworkPeering.import_custom_routes field.
 
 Args:
   project: string, Project ID for this request. (required)
@@ -933,9 +933,9 @@
     &quot;autoCreateRoutes&quot;: True or False, # This field will be deprecated soon. Use the exchange_subnet_routes field instead. Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
     &quot;exchangeSubnetRoutes&quot;: True or False, # Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
     &quot;exportCustomRoutes&quot;: True or False, # Whether to export the custom routes to peer network.
-    &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always exported to peers and are not controlled by this field.
+    &quot;exportSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. IPv4 special-use ranges are always exported to peers and are not controlled by this field.
     &quot;importCustomRoutes&quot;: True or False, # Whether to import the custom routes from peer network.
-    &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always imported from peers and are not controlled by this field.
+    &quot;importSubnetRoutesWithPublicIp&quot;: True or False, # Whether subnet routes with public IP range are imported. The default value is false. IPv4 special-use ranges are always imported from peers and are not controlled by this field.
     &quot;name&quot;: &quot;A String&quot;, # Name of this peering. Provided by the client when the peering is created. The name must comply with RFC1035. Specifically, the name must be 1-63 characters long and match regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all the following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
     &quot;network&quot;: &quot;A String&quot;, # The URL of the peer network. It can be either full URL or partial URL. The peer network may belong to a different project. If the partial URL does not contain project, it is assumed that the peer network is in the same project as the current network.
     &quot;peerMtu&quot;: 42, # Maximum Transmission Unit in bytes.

docs/dyn/compute_v1.nodeGroups.html

diff --git a/docs/dyn/compute_v1.nodeGroups.html b/docs/dyn/compute_v1.nodeGroups.html
index e9a17c5..c0c9eca 100644
--- a/docs/dyn/compute_v1.nodeGroups.html
+++ b/docs/dyn/compute_v1.nodeGroups.html
@@ -222,7 +222,7 @@
   "items": { # A list of NodeGroupsScopedList resources.
     "a_key": { # [Output Only] Name of the scope containing this set of node groups.
       "nodeGroups": [ # [Output Only] A list of node groups contained in this scope.
-        { # Represent a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
+        { # Represents a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
           "autoscalingPolicy": { # Specifies how autoscaling should behave.
             "maxNodes": 42, # The maximum number of nodes that the group should have. Must be set if autoscaling is enabled. Maximum value allowed is 100.
             "minNodes": 42, # The minimum number of nodes that the group should have.
@@ -453,7 +453,7 @@
 Returns:
   An object of the form:
 
-    { # Represent a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
+    { # Represents a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
   "autoscalingPolicy": { # Specifies how autoscaling should behave.
     "maxNodes": 42, # The maximum number of nodes that the group should have. Must be set if autoscaling is enabled. Maximum value allowed is 100.
     "minNodes": 42, # The minimum number of nodes that the group should have.
@@ -598,7 +598,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represent a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
+{ # Represents a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
   "autoscalingPolicy": { # Specifies how autoscaling should behave.
     "maxNodes": 42, # The maximum number of nodes that the group should have. Must be set if autoscaling is enabled. Maximum value allowed is 100.
     "minNodes": 42, # The minimum number of nodes that the group should have.
@@ -705,7 +705,7 @@
     { # Contains a list of nodeGroups.
   "id": "A String", # [Output Only] Unique identifier for the resource; defined by the server.
   "items": [ # A list of NodeGroup resources.
-    { # Represent a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
+    { # Represents a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
       "autoscalingPolicy": { # Specifies how autoscaling should behave.
         "maxNodes": 42, # The maximum number of nodes that the group should have. Must be set if autoscaling is enabled. Maximum value allowed is 100.
         "minNodes": 42, # The minimum number of nodes that the group should have.
@@ -856,7 +856,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represent a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
+{ # Represents a sole-tenant Node Group resource. A sole-tenant node is a physical server that is dedicated to hosting VM instances only for your specific project. Use sole-tenant nodes to keep your instances physically separated from instances in other projects, or to group your instances together on the same host hardware. For more information, read Sole-tenant nodes.
   "autoscalingPolicy": { # Specifies how autoscaling should behave.
     "maxNodes": 42, # The maximum number of nodes that the group should have. Must be set if autoscaling is enabled. Maximum value allowed is 100.
     "minNodes": 42, # The minimum number of nodes that the group should have.

docs/dyn/compute_v1.projects.html

diff --git a/docs/dyn/compute_v1.projects.html b/docs/dyn/compute_v1.projects.html
index 384194e..31ecbfd 100644
--- a/docs/dyn/compute_v1.projects.html
+++ b/docs/dyn/compute_v1.projects.html
@@ -442,7 +442,7 @@
   "selfLink": "A String", # [Output Only] Server-defined URL for the resource.
   "usageExportLocation": { # The location in Cloud Storage and naming method of the daily usage report. Contains bucket_name and report_name prefix. # The naming prefix for daily usage reports and the Google Cloud Storage bucket where they are stored.
     "bucketName": "A String", # The name of an existing bucket in Cloud Storage where the usage report object is stored. The Google Service Account is granted write access to this bucket. This can either be the bucket name by itself, such as example-bucket, or the bucket name with gs:// or https://storage.googleapis.com/ in front of it, such as gs://example-bucket.
-    "reportNamePrefix": "A String", # An optional prefix for the name of the usage report object stored in bucketName. If not supplied, defaults to usage. The report is stored as a CSV file named report_name_prefix_gce_YYYYMMDD.csv where YYYYMMDD is the day of the usage according to Pacific Time. If you supply a prefix, it should conform to Cloud Storage object naming conventions.
+    "reportNamePrefix": "A String", # An optional prefix for the name of the usage report object stored in bucketName. If not supplied, defaults to usage_gce. The report is stored as a CSV file named report_name_prefix_gce_YYYYMMDD.csv where YYYYMMDD is the day of the usage according to Pacific Time. If you supply a prefix, it should conform to Cloud Storage object naming conventions.
   },
   "xpnProjectStatus": "A String", # [Output Only] The role this project has in a shared VPC configuration. Currently, only projects with the host role, which is specified by the value HOST, are differentiated.
 }</pre>
@@ -494,7 +494,7 @@
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;usageExportLocation&quot;: { # The location in Cloud Storage and naming method of the daily usage report. Contains bucket_name and report_name prefix. # The naming prefix for daily usage reports and the Google Cloud Storage bucket where they are stored.
     &quot;bucketName&quot;: &quot;A String&quot;, # The name of an existing bucket in Cloud Storage where the usage report object is stored. The Google Service Account is granted write access to this bucket. This can either be the bucket name by itself, such as example-bucket, or the bucket name with gs:// or https://storage.googleapis.com/ in front of it, such as gs://example-bucket.
-    &quot;reportNamePrefix&quot;: &quot;A String&quot;, # An optional prefix for the name of the usage report object stored in bucketName. If not supplied, defaults to usage. The report is stored as a CSV file named report_name_prefix_gce_YYYYMMDD.csv where YYYYMMDD is the day of the usage according to Pacific Time. If you supply a prefix, it should conform to Cloud Storage object naming conventions.
+    &quot;reportNamePrefix&quot;: &quot;A String&quot;, # An optional prefix for the name of the usage report object stored in bucketName. If not supplied, defaults to usage_gce. The report is stored as a CSV file named report_name_prefix_gce_YYYYMMDD.csv where YYYYMMDD is the day of the usage according to Pacific Time. If you supply a prefix, it should conform to Cloud Storage object naming conventions.
   },
   &quot;xpnProjectStatus&quot;: &quot;A String&quot;, # [Output Only] The role this project has in a shared VPC configuration. Currently, only projects with the host role, which is specified by the value HOST, are differentiated.
 }</pre>
@@ -606,7 +606,7 @@
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
       &quot;usageExportLocation&quot;: { # The location in Cloud Storage and naming method of the daily usage report. Contains bucket_name and report_name prefix. # The naming prefix for daily usage reports and the Google Cloud Storage bucket where they are stored.
         &quot;bucketName&quot;: &quot;A String&quot;, # The name of an existing bucket in Cloud Storage where the usage report object is stored. The Google Service Account is granted write access to this bucket. This can either be the bucket name by itself, such as example-bucket, or the bucket name with gs:// or https://storage.googleapis.com/ in front of it, such as gs://example-bucket.
-        &quot;reportNamePrefix&quot;: &quot;A String&quot;, # An optional prefix for the name of the usage report object stored in bucketName. If not supplied, defaults to usage. The report is stored as a CSV file named report_name_prefix_gce_YYYYMMDD.csv where YYYYMMDD is the day of the usage according to Pacific Time. If you supply a prefix, it should conform to Cloud Storage object naming conventions.
+        &quot;reportNamePrefix&quot;: &quot;A String&quot;, # An optional prefix for the name of the usage report object stored in bucketName. If not supplied, defaults to usage_gce. The report is stored as a CSV file named report_name_prefix_gce_YYYYMMDD.csv where YYYYMMDD is the day of the usage according to Pacific Time. If you supply a prefix, it should conform to Cloud Storage object naming conventions.
       },
       &quot;xpnProjectStatus&quot;: &quot;A String&quot;, # [Output Only] The role this project has in a shared VPC configuration. Currently, only projects with the host role, which is specified by the value HOST, are differentiated.
     },
@@ -937,7 +937,7 @@
 
 { # The location in Cloud Storage and naming method of the daily usage report. Contains bucket_name and report_name prefix.
   &quot;bucketName&quot;: &quot;A String&quot;, # The name of an existing bucket in Cloud Storage where the usage report object is stored. The Google Service Account is granted write access to this bucket. This can either be the bucket name by itself, such as example-bucket, or the bucket name with gs:// or https://storage.googleapis.com/ in front of it, such as gs://example-bucket.
-  &quot;reportNamePrefix&quot;: &quot;A String&quot;, # An optional prefix for the name of the usage report object stored in bucketName. If not supplied, defaults to usage. The report is stored as a CSV file named report_name_prefix_gce_YYYYMMDD.csv where YYYYMMDD is the day of the usage according to Pacific Time. If you supply a prefix, it should conform to Cloud Storage object naming conventions.
+  &quot;reportNamePrefix&quot;: &quot;A String&quot;, # An optional prefix for the name of the usage report object stored in bucketName. If not supplied, defaults to usage_gce. The report is stored as a CSV file named report_name_prefix_gce_YYYYMMDD.csv where YYYYMMDD is the day of the usage according to Pacific Time. If you supply a prefix, it should conform to Cloud Storage object naming conventions.
 }
 
   requestId: string, An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported ( 00000000-0000-0000-0000-000000000000).

docs/dyn/compute_v1.regionBackendServices.html

diff --git a/docs/dyn/compute_v1.regionBackendServices.html b/docs/dyn/compute_v1.regionBackendServices.html
index 2214313..ee27196 100644
--- a/docs/dyn/compute_v1.regionBackendServices.html
+++ b/docs/dyn/compute_v1.regionBackendServices.html
@@ -191,7 +191,7 @@
   "affinityCookieTtlSec": 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   "backends": [ # The list of backends that serve this BackendService.
     { # Message containing information of one individual backend.
-      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
       "capacityScaler": 3.14, # A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
       "failover": True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -202,7 +202,7 @@
       "maxRate": 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerEndpoint": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerInstance": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
-      "maxUtilization": 3.14,
+      "maxUtilization": 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
     },
   ],
   "cdnPolicy": { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -396,7 +396,7 @@
   "affinityCookieTtlSec": 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   "backends": [ # The list of backends that serve this BackendService.
     { # Message containing information of one individual backend.
-      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
       "capacityScaler": 3.14, # A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
       "failover": True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -407,7 +407,7 @@
       "maxRate": 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerEndpoint": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerInstance": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
-      "maxUtilization": 3.14,
+      "maxUtilization": 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
     },
   ],
   "cdnPolicy": { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -623,7 +623,7 @@
       "affinityCookieTtlSec": 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
       "backends": [ # The list of backends that serve this BackendService.
         { # Message containing information of one individual backend.
-          "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+          "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
           "capacityScaler": 3.14, # A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
           "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
           "failover": True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -634,7 +634,7 @@
           "maxRate": 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
           "maxRatePerEndpoint": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
           "maxRatePerInstance": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
-          "maxUtilization": 3.14,
+          "maxUtilization": 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
         },
       ],
       "cdnPolicy": { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -812,7 +812,7 @@
   "affinityCookieTtlSec": 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   "backends": [ # The list of backends that serve this BackendService.
     { # Message containing information of one individual backend.
-      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
       "capacityScaler": 3.14, # A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
       "failover": True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -823,7 +823,7 @@
       "maxRate": 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerEndpoint": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerInstance": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
-      "maxUtilization": 3.14,
+      "maxUtilization": 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
     },
   ],
   "cdnPolicy": { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.
@@ -1027,7 +1027,7 @@
   "affinityCookieTtlSec": 42, # Lifetime of cookies in seconds. This setting is applicable to external and internal HTTP(S) load balancers and Traffic Director and requires GENERATED_COOKIE or HTTP_COOKIE session affinity. If set to 0, the cookie is non-persistent and lasts only until the end of the browser session (or equivalent). The maximum allowed value is one day (86,400). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
   "backends": [ # The list of backends that serve this BackendService.
     { # Message containing information of one individual backend.
-      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode.
+      "balancingMode": "A String", # Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see Connection balancing mode. Backends must use compatible balancing modes. For more information, see Restrictions and guidelines. Note: Currently, if you use the API to configure incompatible balancing modes, the configuration might be accepted even though it has no impact and will be ignored. Specifically, Backend.maxUtilization is ignored when Backend.balancingMode is RATE. In the future, this incompatible combination will be rejected.
       "capacityScaler": 3.14, # A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
       "failover": True or False, # This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
@@ -1038,7 +1038,7 @@
       "maxRate": 42, # Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerEndpoint": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
       "maxRatePerInstance": 3.14, # Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is CONNECTION.
-      "maxUtilization": 3.14,
+      "maxUtilization": 3.14, # Optional parameter to define a target capacity for the UTILIZATIONbalancing mode. The valid range is [0.0, 1.0]. For usage guidelines, see Utilization balancing mode.
     },
   ],
   "cdnPolicy": { # Message containing Cloud CDN configuration for a backend service. # Cloud CDN configuration for this BackendService. Only available for specified load balancer types.

docs/dyn/compute_v1.regionCommitments.html

diff --git a/docs/dyn/compute_v1.regionCommitments.html b/docs/dyn/compute_v1.regionCommitments.html
index 4a47f3b..2b4105b 100644
--- a/docs/dyn/compute_v1.regionCommitments.html
+++ b/docs/dyn/compute_v1.regionCommitments.html
@@ -183,6 +183,7 @@
           "startTimestamp": "A String", # [Output Only] Commitment start time in RFC3339 text format.
           "status": "A String", # [Output Only] Status of the commitment with regards to eventual expiration (each commitment has an end date defined). One of the following values: NOT_YET_ACTIVE, ACTIVE, EXPIRED.
           "statusMessage": "A String", # [Output Only] An optional, human-readable explanation of the status.
+          "type": "A String", # The type of commitment, which affects the discount rate and the eligible resources. Type MEMORY_OPTIMIZED specifies a commitment that will only apply to memory optimized machines. Type ACCELERATOR_OPTIMIZED specifies a commitment that will only apply to accelerator optimized machines.
         },
       ],
       "warning": { # [Output Only] Informational warning which replaces the list of commitments when the list is empty.
@@ -313,6 +314,7 @@
   "startTimestamp": "A String", # [Output Only] Commitment start time in RFC3339 text format.
   "status": "A String", # [Output Only] Status of the commitment with regards to eventual expiration (each commitment has an end date defined). One of the following values: NOT_YET_ACTIVE, ACTIVE, EXPIRED.
   "statusMessage": "A String", # [Output Only] An optional, human-readable explanation of the status.
+  "type": "A String", # The type of commitment, which affects the discount rate and the eligible resources. Type MEMORY_OPTIMIZED specifies a commitment that will only apply to memory optimized machines. Type ACCELERATOR_OPTIMIZED specifies a commitment that will only apply to accelerator optimized machines.
 }</pre>
 </div>
 
@@ -388,6 +390,7 @@
   &quot;startTimestamp&quot;: &quot;A String&quot;, # [Output Only] Commitment start time in RFC3339 text format.
   &quot;status&quot;: &quot;A String&quot;, # [Output Only] Status of the commitment with regards to eventual expiration (each commitment has an end date defined). One of the following values: NOT_YET_ACTIVE, ACTIVE, EXPIRED.
   &quot;statusMessage&quot;: &quot;A String&quot;, # [Output Only] An optional, human-readable explanation of the status.
+  &quot;type&quot;: &quot;A String&quot;, # The type of commitment, which affects the discount rate and the eligible resources. Type MEMORY_OPTIMIZED specifies a commitment that will only apply to memory optimized machines. Type ACCELERATOR_OPTIMIZED specifies a commitment that will only apply to accelerator optimized machines.
 }
 
   requestId: string, An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported ( 00000000-0000-0000-0000-000000000000).
@@ -531,6 +534,7 @@
       &quot;startTimestamp&quot;: &quot;A String&quot;, # [Output Only] Commitment start time in RFC3339 text format.
       &quot;status&quot;: &quot;A String&quot;, # [Output Only] Status of the commitment with regards to eventual expiration (each commitment has an end date defined). One of the following values: NOT_YET_ACTIVE, ACTIVE, EXPIRED.
       &quot;statusMessage&quot;: &quot;A String&quot;, # [Output Only] An optional, human-readable explanation of the status.
+      &quot;type&quot;: &quot;A String&quot;, # The type of commitment, which affects the discount rate and the eligible resources. Type MEMORY_OPTIMIZED specifies a commitment that will only apply to memory optimized machines. Type ACCELERATOR_OPTIMIZED specifies a commitment that will only apply to accelerator optimized machines.
     },
   ],
   &quot;kind&quot;: &quot;compute#commitmentList&quot;, # [Output Only] Type of resource. Always compute#commitmentList for lists of commitments.

docs/dyn/compute_v1.regionDisks.html

diff --git a/docs/dyn/compute_v1.regionDisks.html b/docs/dyn/compute_v1.regionDisks.html
index ff11b5a..6ed816d 100644
--- a/docs/dyn/compute_v1.regionDisks.html
+++ b/docs/dyn/compute_v1.regionDisks.html
@@ -233,6 +233,7 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceDisk": "A String", # The source disk used to create this snapshot.
@@ -240,6 +241,7 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceDiskId": "A String", # [Output Only] The ID value of the disk used to create this snapshot. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given disk name.
@@ -394,6 +396,7 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "guestOsFeatures": [ # A list of features to enable on the guest operating system. Applicable only for bootable images. Read Enabling guest operating system features to see a list of available options.
@@ -437,6 +440,7 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceImageId": "A String", # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
@@ -445,6 +449,7 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceSnapshotId": "A String", # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
@@ -580,6 +585,7 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "guestOsFeatures": [ # A list of features to enable on the guest operating system. Applicable only for bootable images. Read Enabling guest operating system features to see a list of available options.
@@ -623,6 +629,7 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceImageId": "A String", # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
@@ -631,6 +638,7 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceSnapshotId": "A String", # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
@@ -730,6 +738,7 @@
         "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
         "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
         "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+        "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       "guestOsFeatures": [ # A list of features to enable on the guest operating system. Applicable only for bootable images. Read Enabling guest operating system features to see a list of available options.
@@ -773,6 +782,7 @@
         "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
         "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
         "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+        "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       "sourceImageId": "A String", # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
@@ -781,6 +791,7 @@
         "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
         "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
         "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+        "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       "sourceSnapshotId": "A String", # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.

docs/dyn/compute_v1.regionHealthChecks.html

diff --git a/docs/dyn/compute_v1.regionHealthChecks.html b/docs/dyn/compute_v1.regionHealthChecks.html
index 3aea017..3a0421a 100644
--- a/docs/dyn/compute_v1.regionHealthChecks.html
+++ b/docs/dyn/compute_v1.regionHealthChecks.html
@@ -184,7 +184,7 @@
 Returns:
   An object of the form:
 
-    { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/v1/healthChecks) * [Regional](/compute/docs/reference/rest/v1/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+    { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/v1/healthChecks) * [Regional](/compute/docs/reference/rest/v1/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -262,7 +262,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/v1/healthChecks) * [Regional](/compute/docs/reference/rest/v1/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/v1/healthChecks) * [Regional](/compute/docs/reference/rest/v1/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -408,7 +408,7 @@
     { # Contains a list of HealthCheck resources.
   "id": "A String", # [Output Only] Unique identifier for the resource; defined by the server.
   "items": [ # A list of HealthCheck resources.
-    { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/v1/healthChecks) * [Regional](/compute/docs/reference/rest/v1/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+    { # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/v1/healthChecks) * [Regional](/compute/docs/reference/rest/v1/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
       "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
       "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
       "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -516,7 +516,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/v1/healthChecks) * [Regional](/compute/docs/reference/rest/v1/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/v1/healthChecks) * [Regional](/compute/docs/reference/rest/v1/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
@@ -650,7 +650,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/v1/healthChecks) * [Regional](/compute/docs/reference/rest/v1/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Network load balancers must use legacy HTTP health checks (httpHealthChecks). For more information, see Health checks overview.
+{ # Represents a Health Check resource. Google Compute Engine has two Health Check resources: * [Global](/compute/docs/reference/rest/v1/healthChecks) * [Regional](/compute/docs/reference/rest/v1/regionHealthChecks) Internal HTTP(S) load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Traffic Director must use global health checks (`compute.v1.HealthChecks`). Internal TCP/UDP load balancers can use either regional or global health checks (`compute.v1.regionHealthChecks` or `compute.v1.HealthChecks`). External HTTP(S), TCP proxy, and SSL proxy load balancers as well as managed instance group auto-healing must use global health checks (`compute.v1.HealthChecks`). Backend service-based network load balancers must use regional health checks (`compute.v1.regionHealthChecks`). Target pool-based network load balancers must use legacy HTTP health checks (`compute.v1.httpHealthChecks`). For more information, see Health checks overview.
   "checkIntervalSec": 42, # How often (in seconds) to send a health check. The default value is 5 seconds.
   "creationTimestamp": "A String", # [Output Only] Creation timestamp in 3339 text format.
   "description": "A String", # An optional description of this resource. Provide this property when you create the resource.

docs/dyn/compute_v1.regionInstanceGroupManagers.html

diff --git a/docs/dyn/compute_v1.regionInstanceGroupManagers.html b/docs/dyn/compute_v1.regionInstanceGroupManagers.html
index f4fb94e..57595e2 100644
--- a/docs/dyn/compute_v1.regionInstanceGroupManagers.html
+++ b/docs/dyn/compute_v1.regionInstanceGroupManagers.html
@@ -468,6 +468,7 @@
   "instances": [ # The URLs of one or more instances to delete. This can be a full URL or a partial URL, such as zones/[ZONE]/instances/[INSTANCE_NAME].
     "A String",
   ],
+  "skipInstancesOnValidationError": True or False, # Specifies whether the request should proceed despite the inclusion of instances that are not members of the group or that are already in the process of being deleted or abandoned. If this field is set to `false` and such an instance is specified in the request, the operation fails. The operation always fails if the request contains a malformed instance URL or a reference to an instance that exists in a zone or region other than the group's zone or region.
 }
 
   requestId: string, An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported ( 00000000-0000-0000-0000-000000000000).
@@ -634,7 +635,7 @@
     "restarting": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be restarted or are currently being restarted.
     "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
   },
-  "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+  "description": "A String", # An optional description of this resource.
   "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
     "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
     "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -744,7 +745,7 @@
     "restarting": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be restarted or are currently being restarted.
     "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
   },
-  "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+  "description": "A String", # An optional description of this resource.
   "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
     "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
     "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -922,7 +923,7 @@
         "restarting": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be restarted or are currently being restarted.
         "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
       },
-      "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+      "description": "A String", # An optional description of this resource.
       "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
         "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
         "zones": [ # Zones where the regional managed instance group will create and manage its instances.
@@ -1281,7 +1282,7 @@
     "restarting": 42, # [Output Only] The number of instances in the managed instance group that are scheduled to be restarted or are currently being restarted.
     "verifying": 42, # [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
   },
-  "description": "A String", # An optional description of this resource. Provide this property when you create the resource.
+  "description": "A String", # An optional description of this resource.
   "distributionPolicy": { # Policy specifying the intended distribution of managed instances across zones in a regional managed instance group.
     "targetShape": "A String", # The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
     "zones": [ # Zones where the regional managed instance group will create and manage its instances.

docs/dyn/compute_v1.regionInstances.html

diff --git a/docs/dyn/compute_v1.regionInstances.html b/docs/dyn/compute_v1.regionInstances.html
index 441f5d2..b5a0eed 100644
--- a/docs/dyn/compute_v1.regionInstances.html
+++ b/docs/dyn/compute_v1.regionInstances.html
@@ -112,6 +112,7 @@
           "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
           "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
           "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+          "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         "diskSizeGb": "A String", # The size of the disk in GB.
@@ -139,6 +140,7 @@
             "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
             "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
             "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+            "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           "sourceSnapshot": "A String", # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
@@ -146,6 +148,7 @@
             "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
             "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
             "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+            "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
         },

docs/dyn/compute_v1.snapshots.html

diff --git a/docs/dyn/compute_v1.snapshots.html b/docs/dyn/compute_v1.snapshots.html
index b6156fd..7b38667 100644
--- a/docs/dyn/compute_v1.snapshots.html
+++ b/docs/dyn/compute_v1.snapshots.html
@@ -212,6 +212,7 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceDisk": "A String", # The source disk used to create this snapshot.
@@ -219,6 +220,7 @@
     "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
     "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
     "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+    "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   "sourceDiskId": "A String", # [Output Only] The ID value of the disk used to create this snapshot. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given disk name.
@@ -384,6 +386,7 @@
         "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
         "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
         "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+        "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       "sourceDisk": "A String", # The source disk used to create this snapshot.
@@ -391,6 +394,7 @@
         "kmsKeyName": "A String", # The name of the encryption key that is stored in Google Cloud KMS.
         "kmsKeyServiceAccount": "A String", # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
         "rawKey": "A String", # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
+        "rsaEncryptedKey": "A String", # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         "sha256": "A String", # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       "sourceDiskId": "A String", # [Output Only] The ID value of the disk used to create this snapshot. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given disk name.

docs/dyn/container_v1.projects.locations.clusters.html

diff --git a/docs/dyn/container_v1.projects.locations.clusters.html b/docs/dyn/container_v1.projects.locations.clusters.html
index 3809951..05317a7 100644
--- a/docs/dyn/container_v1.projects.locations.clusters.html
+++ b/docs/dyn/container_v1.projects.locations.clusters.html
@@ -453,6 +453,9 @@
       "bootDiskKmsKey": "A String", #  The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption
       "diskSizeGb": 42, # Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.
       "diskType": "A String", # Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'
+      "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic in the node pool.
+        "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+      },
       "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
       "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
         "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -533,6 +536,9 @@
           "bootDiskKmsKey": "A String", #  The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption
           "diskSizeGb": 42, # Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.
           "diskType": "A String", # Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'
+          "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic in the node pool.
+            "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+          },
           "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
           "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
             "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -1043,6 +1049,9 @@
     "bootDiskKmsKey": "A String", #  The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption
     "diskSizeGb": 42, # Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.
     "diskType": "A String", # Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'
+    "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic in the node pool.
+      "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+    },
     "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
     "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
       "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -1123,6 +1132,9 @@
         "bootDiskKmsKey": "A String", #  The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption
         "diskSizeGb": 42, # Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.
         "diskType": "A String", # Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'
+        "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic in the node pool.
+          "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+        },
         "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
         "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
           "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -1536,6 +1548,9 @@
         "bootDiskKmsKey": "A String", #  The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption
         "diskSizeGb": 42, # Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.
         "diskType": "A String", # Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'
+        "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic in the node pool.
+          "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+        },
         "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
         "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
           "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -1616,6 +1631,9 @@
             "bootDiskKmsKey": "A String", #  The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption
             "diskSizeGb": 42, # Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.
             "diskType": "A String", # Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'
+            "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic in the node pool.
+              "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+            },
             "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
             "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
               "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.

docs/dyn/container_v1.projects.locations.clusters.nodePools.html

diff --git a/docs/dyn/container_v1.projects.locations.clusters.nodePools.html b/docs/dyn/container_v1.projects.locations.clusters.nodePools.html
index 8f137cc..f8a513b 100644
--- a/docs/dyn/container_v1.projects.locations.clusters.nodePools.html
+++ b/docs/dyn/container_v1.projects.locations.clusters.nodePools.html
@@ -145,6 +145,9 @@
       "bootDiskKmsKey": "A String", #  The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption
       "diskSizeGb": 42, # Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.
       "diskType": "A String", # Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'
+      "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic in the node pool.
+        "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+      },
       "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
       "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
         "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -412,6 +415,9 @@
     "bootDiskKmsKey": "A String", #  The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption
     "diskSizeGb": 42, # Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.
     "diskType": "A String", # Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'
+    "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic in the node pool.
+      "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+    },
     "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
     "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
       "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -545,6 +551,9 @@
         "bootDiskKmsKey": "A String", #  The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption
         "diskSizeGb": 42, # Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.
         "diskType": "A String", # Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'
+        "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic in the node pool.
+          "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+        },
         "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
         "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
           "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -975,6 +984,9 @@
 
 { # UpdateNodePoolRequests update a node pool's image and/or version.
   "clusterId": "A String", # Deprecated. The name of the cluster to upgrade. This field has been deprecated and replaced by the name field.
+  "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic on the node pool.
+    "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+  },
   "imageType": "A String", # Required. The desired image type for the node pool.
   "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
     "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.

docs/dyn/container_v1.projects.zones.clusters.html

diff --git a/docs/dyn/container_v1.projects.zones.clusters.html b/docs/dyn/container_v1.projects.zones.clusters.html
index f0ef7f6..f66b72f 100644
--- a/docs/dyn/container_v1.projects.zones.clusters.html
+++ b/docs/dyn/container_v1.projects.zones.clusters.html
@@ -554,6 +554,9 @@
       "bootDiskKmsKey": "A String", #  The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption
       "diskSizeGb": 42, # Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.
       "diskType": "A String", # Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'
+      "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic in the node pool.
+        "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+      },
       "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
       "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
         "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -634,6 +637,9 @@
           "bootDiskKmsKey": "A String", #  The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption
           "diskSizeGb": 42, # Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.
           "diskType": "A String", # Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'
+          "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic in the node pool.
+            "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+          },
           "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
           "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
             "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -1144,6 +1150,9 @@
     "bootDiskKmsKey": "A String", #  The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption
     "diskSizeGb": 42, # Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.
     "diskType": "A String", # Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'
+    "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic in the node pool.
+      "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+    },
     "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
     "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
       "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -1224,6 +1233,9 @@
         "bootDiskKmsKey": "A String", #  The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption
         "diskSizeGb": 42, # Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.
         "diskType": "A String", # Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'
+        "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic in the node pool.
+          "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+        },
         "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
         "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
           "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -1681,6 +1693,9 @@
         "bootDiskKmsKey": "A String", #  The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption
         "diskSizeGb": 42, # Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.
         "diskType": "A String", # Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'
+        "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic in the node pool.
+          "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+        },
         "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
         "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
           "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -1761,6 +1776,9 @@
             "bootDiskKmsKey": "A String", #  The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption
             "diskSizeGb": 42, # Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.
             "diskType": "A String", # Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'
+            "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic in the node pool.
+              "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+            },
             "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
             "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
               "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.

docs/dyn/container_v1.projects.zones.clusters.nodePools.html

diff --git a/docs/dyn/container_v1.projects.zones.clusters.nodePools.html b/docs/dyn/container_v1.projects.zones.clusters.nodePools.html
index 47ba79b..2632b6b 100644
--- a/docs/dyn/container_v1.projects.zones.clusters.nodePools.html
+++ b/docs/dyn/container_v1.projects.zones.clusters.nodePools.html
@@ -234,6 +234,9 @@
       "bootDiskKmsKey": "A String", #  The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption
       "diskSizeGb": 42, # Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.
       "diskType": "A String", # Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'
+      "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic in the node pool.
+        "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+      },
       "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
       "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
         "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -501,6 +504,9 @@
     "bootDiskKmsKey": "A String", #  The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption
     "diskSizeGb": 42, # Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.
     "diskType": "A String", # Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'
+    "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic in the node pool.
+      "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+    },
     "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
     "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
       "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -634,6 +640,9 @@
         "bootDiskKmsKey": "A String", #  The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption
         "diskSizeGb": 42, # Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.
         "diskType": "A String", # Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'
+        "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic in the node pool.
+          "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+        },
         "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
         "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
           "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -992,6 +1001,9 @@
 
 { # UpdateNodePoolRequests update a node pool's image and/or version.
   "clusterId": "A String", # Deprecated. The name of the cluster to upgrade. This field has been deprecated and replaced by the name field.
+  "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic on the node pool.
+    "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+  },
   "imageType": "A String", # Required. The desired image type for the node pool.
   "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
     "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.

docs/dyn/container_v1beta1.projects.locations.clusters.html

diff --git a/docs/dyn/container_v1beta1.projects.locations.clusters.html b/docs/dyn/container_v1beta1.projects.locations.clusters.html
index d1d0d41..3640559 100644
--- a/docs/dyn/container_v1beta1.projects.locations.clusters.html
+++ b/docs/dyn/container_v1beta1.projects.locations.clusters.html
@@ -482,6 +482,9 @@
       "ephemeralStorageConfig": { # EphemeralStorageConfig contains configuration for the ephemeral storage filesystem. # Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk.
         "localSsdCount": 42, # Number of local SSDs to use to back ephemeral storage. Uses NVMe interfaces. Each local SSD is 375 GB in size. If zero, it means to disable using local SSDs as ephemeral storage.
       },
+      "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic on the node pool.
+        "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+      },
       "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
       "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
         "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -572,6 +575,9 @@
           "ephemeralStorageConfig": { # EphemeralStorageConfig contains configuration for the ephemeral storage filesystem. # Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk.
             "localSsdCount": 42, # Number of local SSDs to use to back ephemeral storage. Uses NVMe interfaces. Each local SSD is 375 GB in size. If zero, it means to disable using local SSDs as ephemeral storage.
           },
+          "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic on the node pool.
+            "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+          },
           "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
           "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
             "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -1127,6 +1133,9 @@
     "ephemeralStorageConfig": { # EphemeralStorageConfig contains configuration for the ephemeral storage filesystem. # Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk.
       "localSsdCount": 42, # Number of local SSDs to use to back ephemeral storage. Uses NVMe interfaces. Each local SSD is 375 GB in size. If zero, it means to disable using local SSDs as ephemeral storage.
     },
+    "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic on the node pool.
+      "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+    },
     "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
     "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
       "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -1217,6 +1226,9 @@
         "ephemeralStorageConfig": { # EphemeralStorageConfig contains configuration for the ephemeral storage filesystem. # Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk.
           "localSsdCount": 42, # Number of local SSDs to use to back ephemeral storage. Uses NVMe interfaces. Each local SSD is 375 GB in size. If zero, it means to disable using local SSDs as ephemeral storage.
         },
+        "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic on the node pool.
+          "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+        },
         "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
         "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
           "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -1675,6 +1687,9 @@
         "ephemeralStorageConfig": { # EphemeralStorageConfig contains configuration for the ephemeral storage filesystem. # Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk.
           "localSsdCount": 42, # Number of local SSDs to use to back ephemeral storage. Uses NVMe interfaces. Each local SSD is 375 GB in size. If zero, it means to disable using local SSDs as ephemeral storage.
         },
+        "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic on the node pool.
+          "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+        },
         "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
         "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
           "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -1765,6 +1780,9 @@
             "ephemeralStorageConfig": { # EphemeralStorageConfig contains configuration for the ephemeral storage filesystem. # Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk.
               "localSsdCount": 42, # Number of local SSDs to use to back ephemeral storage. Uses NVMe interfaces. Each local SSD is 375 GB in size. If zero, it means to disable using local SSDs as ephemeral storage.
             },
+            "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic on the node pool.
+              "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+            },
             "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
             "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
               "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.

docs/dyn/container_v1beta1.projects.locations.clusters.nodePools.html

diff --git a/docs/dyn/container_v1beta1.projects.locations.clusters.nodePools.html b/docs/dyn/container_v1beta1.projects.locations.clusters.nodePools.html
index e1b6f76..6de4257 100644
--- a/docs/dyn/container_v1beta1.projects.locations.clusters.nodePools.html
+++ b/docs/dyn/container_v1beta1.projects.locations.clusters.nodePools.html
@@ -149,6 +149,9 @@
       "ephemeralStorageConfig": { # EphemeralStorageConfig contains configuration for the ephemeral storage filesystem. # Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk.
         "localSsdCount": 42, # Number of local SSDs to use to back ephemeral storage. Uses NVMe interfaces. Each local SSD is 375 GB in size. If zero, it means to disable using local SSDs as ephemeral storage.
       },
+      "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic on the node pool.
+        "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+      },
       "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
       "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
         "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -422,6 +425,9 @@
     "ephemeralStorageConfig": { # EphemeralStorageConfig contains configuration for the ephemeral storage filesystem. # Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk.
       "localSsdCount": 42, # Number of local SSDs to use to back ephemeral storage. Uses NVMe interfaces. Each local SSD is 375 GB in size. If zero, it means to disable using local SSDs as ephemeral storage.
     },
+    "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic on the node pool.
+      "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+    },
     "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
     "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
       "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -561,6 +567,9 @@
         "ephemeralStorageConfig": { # EphemeralStorageConfig contains configuration for the ephemeral storage filesystem. # Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk.
           "localSsdCount": 42, # Number of local SSDs to use to back ephemeral storage. Uses NVMe interfaces. Each local SSD is 375 GB in size. If zero, it means to disable using local SSDs as ephemeral storage.
         },
+        "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic on the node pool.
+          "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+        },
         "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
         "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
           "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -993,6 +1002,9 @@
 
 { # SetNodePoolVersionRequest updates the version of a node pool.
   "clusterId": "A String", # Required. Deprecated. The name of the cluster to upgrade. This field has been deprecated and replaced by the name field.
+  "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic on the node pool.
+    "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+  },
   "imageType": "A String", # Required. The desired image type for the node pool.
   "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
     "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.

docs/dyn/container_v1beta1.projects.zones.clusters.html

diff --git a/docs/dyn/container_v1beta1.projects.zones.clusters.html b/docs/dyn/container_v1beta1.projects.zones.clusters.html
index 3169882..2f8a2be 100644
--- a/docs/dyn/container_v1beta1.projects.zones.clusters.html
+++ b/docs/dyn/container_v1beta1.projects.zones.clusters.html
@@ -590,6 +590,9 @@
       "ephemeralStorageConfig": { # EphemeralStorageConfig contains configuration for the ephemeral storage filesystem. # Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk.
         "localSsdCount": 42, # Number of local SSDs to use to back ephemeral storage. Uses NVMe interfaces. Each local SSD is 375 GB in size. If zero, it means to disable using local SSDs as ephemeral storage.
       },
+      "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic on the node pool.
+        "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+      },
       "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
       "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
         "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -680,6 +683,9 @@
           "ephemeralStorageConfig": { # EphemeralStorageConfig contains configuration for the ephemeral storage filesystem. # Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk.
             "localSsdCount": 42, # Number of local SSDs to use to back ephemeral storage. Uses NVMe interfaces. Each local SSD is 375 GB in size. If zero, it means to disable using local SSDs as ephemeral storage.
           },
+          "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic on the node pool.
+            "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+          },
           "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
           "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
             "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -1235,6 +1241,9 @@
     "ephemeralStorageConfig": { # EphemeralStorageConfig contains configuration for the ephemeral storage filesystem. # Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk.
       "localSsdCount": 42, # Number of local SSDs to use to back ephemeral storage. Uses NVMe interfaces. Each local SSD is 375 GB in size. If zero, it means to disable using local SSDs as ephemeral storage.
     },
+    "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic on the node pool.
+      "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+    },
     "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
     "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
       "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -1325,6 +1334,9 @@
         "ephemeralStorageConfig": { # EphemeralStorageConfig contains configuration for the ephemeral storage filesystem. # Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk.
           "localSsdCount": 42, # Number of local SSDs to use to back ephemeral storage. Uses NVMe interfaces. Each local SSD is 375 GB in size. If zero, it means to disable using local SSDs as ephemeral storage.
         },
+        "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic on the node pool.
+          "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+        },
         "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
         "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
           "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -1827,6 +1839,9 @@
         "ephemeralStorageConfig": { # EphemeralStorageConfig contains configuration for the ephemeral storage filesystem. # Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk.
           "localSsdCount": 42, # Number of local SSDs to use to back ephemeral storage. Uses NVMe interfaces. Each local SSD is 375 GB in size. If zero, it means to disable using local SSDs as ephemeral storage.
         },
+        "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic on the node pool.
+          "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+        },
         "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
         "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
           "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -1917,6 +1932,9 @@
             "ephemeralStorageConfig": { # EphemeralStorageConfig contains configuration for the ephemeral storage filesystem. # Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk.
               "localSsdCount": 42, # Number of local SSDs to use to back ephemeral storage. Uses NVMe interfaces. Each local SSD is 375 GB in size. If zero, it means to disable using local SSDs as ephemeral storage.
             },
+            "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic on the node pool.
+              "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+            },
             "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
             "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
               "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.

docs/dyn/container_v1beta1.projects.zones.clusters.nodePools.html

diff --git a/docs/dyn/container_v1beta1.projects.zones.clusters.nodePools.html b/docs/dyn/container_v1beta1.projects.zones.clusters.nodePools.html
index 8531dfd..9305cd2 100644
--- a/docs/dyn/container_v1beta1.projects.zones.clusters.nodePools.html
+++ b/docs/dyn/container_v1beta1.projects.zones.clusters.nodePools.html
@@ -238,6 +238,9 @@
       "ephemeralStorageConfig": { # EphemeralStorageConfig contains configuration for the ephemeral storage filesystem. # Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk.
         "localSsdCount": 42, # Number of local SSDs to use to back ephemeral storage. Uses NVMe interfaces. Each local SSD is 375 GB in size. If zero, it means to disable using local SSDs as ephemeral storage.
       },
+      "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic on the node pool.
+        "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+      },
       "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
       "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
         "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -511,6 +514,9 @@
     "ephemeralStorageConfig": { # EphemeralStorageConfig contains configuration for the ephemeral storage filesystem. # Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk.
       "localSsdCount": 42, # Number of local SSDs to use to back ephemeral storage. Uses NVMe interfaces. Each local SSD is 375 GB in size. If zero, it means to disable using local SSDs as ephemeral storage.
     },
+    "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic on the node pool.
+      "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+    },
     "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
     "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
       "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -650,6 +656,9 @@
         "ephemeralStorageConfig": { # EphemeralStorageConfig contains configuration for the ephemeral storage filesystem. # Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk.
           "localSsdCount": 42, # Number of local SSDs to use to back ephemeral storage. Uses NVMe interfaces. Each local SSD is 375 GB in size. If zero, it means to disable using local SSDs as ephemeral storage.
         },
+        "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic on the node pool.
+          "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+        },
         "imageType": "A String", # The image type to use for this node. Note that for a given image type, the latest version of it will be used.
         "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
           "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
@@ -1010,6 +1019,9 @@
 
 { # SetNodePoolVersionRequest updates the version of a node pool.
   "clusterId": "A String", # Required. Deprecated. The name of the cluster to upgrade. This field has been deprecated and replaced by the name field.
+  "gvnic": { # Configuration of gVNIC feature. # Enable or disable gvnic on the node pool.
+    "enabled": True or False, # Whether gVNIC features are enabled in the node pool.
+  },
   "imageType": "A String", # Required. The desired image type for the node pool.
   "kubeletConfig": { # Node kubelet configs. # Node kubelet configs.
     "cpuCfsQuota": True or False, # Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.

docs/dyn/containeranalysis_v1alpha1.projects.notes.html

diff --git a/docs/dyn/containeranalysis_v1alpha1.projects.notes.html b/docs/dyn/containeranalysis_v1alpha1.projects.notes.html
index 177c2c4..238c0f5 100644
--- a/docs/dyn/containeranalysis_v1alpha1.projects.notes.html
+++ b/docs/dyn/containeranalysis_v1alpha1.projects.notes.html
@@ -761,7 +761,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -1418,7 +1418,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
         "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -1446,7 +1446,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/containeranalysis_v1alpha1.projects.occurrences.html

diff --git a/docs/dyn/containeranalysis_v1alpha1.projects.occurrences.html b/docs/dyn/containeranalysis_v1alpha1.projects.occurrences.html
index 79bfb44..900bd2e 100644
--- a/docs/dyn/containeranalysis_v1alpha1.projects.occurrences.html
+++ b/docs/dyn/containeranalysis_v1alpha1.projects.occurrences.html
@@ -1514,7 +1514,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -3171,7 +3171,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
         "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -3199,7 +3199,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/containeranalysis_v1alpha1.providers.notes.html

diff --git a/docs/dyn/containeranalysis_v1alpha1.providers.notes.html b/docs/dyn/containeranalysis_v1alpha1.providers.notes.html
index 10154d0..fac52d4 100644
--- a/docs/dyn/containeranalysis_v1alpha1.providers.notes.html
+++ b/docs/dyn/containeranalysis_v1alpha1.providers.notes.html
@@ -761,7 +761,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -1418,7 +1418,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
         "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -1446,7 +1446,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/containeranalysis_v1beta1.projects.notes.html

diff --git a/docs/dyn/containeranalysis_v1beta1.projects.notes.html b/docs/dyn/containeranalysis_v1beta1.projects.notes.html
index 531a510..8ea029d 100644
--- a/docs/dyn/containeranalysis_v1beta1.projects.notes.html
+++ b/docs/dyn/containeranalysis_v1beta1.projects.notes.html
@@ -1259,7 +1259,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -1969,7 +1969,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
         "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -1997,7 +1997,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/containeranalysis_v1beta1.projects.notes.occurrences.html

diff --git a/docs/dyn/containeranalysis_v1beta1.projects.notes.occurrences.html b/docs/dyn/containeranalysis_v1beta1.projects.notes.occurrences.html
index 78aae52..c20133b 100644
--- a/docs/dyn/containeranalysis_v1beta1.projects.notes.occurrences.html
+++ b/docs/dyn/containeranalysis_v1beta1.projects.notes.occurrences.html
@@ -417,7 +417,7 @@
       "updateTime": "A String", # Output only. The time this occurrence was last updated.
       "vulnerability": { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
         "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a scale of 0-10 where 0 indicates low severity and 10 indicates high severity.
-        "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is available, and note provider assigned severity when distro has not yet assigned a severity for this vulnerability.
+        "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is available, and note provider assigned severity when distro has not yet assigned a severity for this vulnerability. When there are multiple PackageIssues for this vulnerability, they can have different effective severities because some might be provided by the distro while others are provided by the language ecosystem for a language pack. For this reason, it is advised to use the effective severity on the PackageIssue level. In the case where multiple PackageIssues have differing effective severities, this field should be the highest severity for any of the PackageIssues.
         "longDescription": "A String", # Output only. A detailed description of this vulnerability.
         "packageIssue": [ # Required. The set of affected locations and their fixes (if available) within the associated resource.
           { # This message wraps a location affected by a vulnerability and its associated fix (if one is available).
@@ -432,6 +432,7 @@
                 "revision": "A String", # The iteration of the package build from the above version.
               },
             },
+            "effectiveSeverity": "A String", # Output only. The distro or language system assigned severity for this vulnerability when that is available and note provider assigned severity when it is not available.
             "fixedLocation": { # The location of the vulnerability. # The location of the available fix for vulnerability.
               "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/) format. Examples include distro or storage location for vulnerable jar.
               "package": "A String", # Required. The package being described.
@@ -443,6 +444,7 @@
                 "revision": "A String", # The iteration of the package build from the above version.
               },
             },
+            "packageType": "A String", # The type of package (e.g. OS, MAVEN, GO).
             "severityName": "A String", # Deprecated, use Details.effective_severity instead The severity (e.g., distro assigned severity) for this vulnerability.
           },
         ],

docs/dyn/containeranalysis_v1beta1.projects.occurrences.html

diff --git a/docs/dyn/containeranalysis_v1beta1.projects.occurrences.html b/docs/dyn/containeranalysis_v1beta1.projects.occurrences.html
index 82f6fe0..cb43c4a 100644
--- a/docs/dyn/containeranalysis_v1beta1.projects.occurrences.html
+++ b/docs/dyn/containeranalysis_v1beta1.projects.occurrences.html
@@ -433,7 +433,7 @@
       "updateTime": "A String", # Output only. The time this occurrence was last updated.
       "vulnerability": { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
         "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a scale of 0-10 where 0 indicates low severity and 10 indicates high severity.
-        "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is available, and note provider assigned severity when distro has not yet assigned a severity for this vulnerability.
+        "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is available, and note provider assigned severity when distro has not yet assigned a severity for this vulnerability. When there are multiple PackageIssues for this vulnerability, they can have different effective severities because some might be provided by the distro while others are provided by the language ecosystem for a language pack. For this reason, it is advised to use the effective severity on the PackageIssue level. In the case where multiple PackageIssues have differing effective severities, this field should be the highest severity for any of the PackageIssues.
         "longDescription": "A String", # Output only. A detailed description of this vulnerability.
         "packageIssue": [ # Required. The set of affected locations and their fixes (if available) within the associated resource.
           { # This message wraps a location affected by a vulnerability and its associated fix (if one is available).
@@ -448,6 +448,7 @@
                 "revision": "A String", # The iteration of the package build from the above version.
               },
             },
+            "effectiveSeverity": "A String", # Output only. The distro or language system assigned severity for this vulnerability when that is available and note provider assigned severity when it is not available.
             "fixedLocation": { # The location of the vulnerability. # The location of the available fix for vulnerability.
               "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/) format. Examples include distro or storage location for vulnerable jar.
               "package": "A String", # Required. The package being described.
@@ -459,6 +460,7 @@
                 "revision": "A String", # The iteration of the package build from the above version.
               },
             },
+            "packageType": "A String", # The type of package (e.g. OS, MAVEN, GO).
             "severityName": "A String", # Deprecated, use Details.effective_severity instead The severity (e.g., distro assigned severity) for this vulnerability.
           },
         ],
@@ -794,7 +796,7 @@
       "updateTime": "A String", # Output only. The time this occurrence was last updated.
       "vulnerability": { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
         "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a scale of 0-10 where 0 indicates low severity and 10 indicates high severity.
-        "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is available, and note provider assigned severity when distro has not yet assigned a severity for this vulnerability.
+        "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is available, and note provider assigned severity when distro has not yet assigned a severity for this vulnerability. When there are multiple PackageIssues for this vulnerability, they can have different effective severities because some might be provided by the distro while others are provided by the language ecosystem for a language pack. For this reason, it is advised to use the effective severity on the PackageIssue level. In the case where multiple PackageIssues have differing effective severities, this field should be the highest severity for any of the PackageIssues.
         "longDescription": "A String", # Output only. A detailed description of this vulnerability.
         "packageIssue": [ # Required. The set of affected locations and their fixes (if available) within the associated resource.
           { # This message wraps a location affected by a vulnerability and its associated fix (if one is available).
@@ -809,6 +811,7 @@
                 "revision": "A String", # The iteration of the package build from the above version.
               },
             },
+            "effectiveSeverity": "A String", # Output only. The distro or language system assigned severity for this vulnerability when that is available and note provider assigned severity when it is not available.
             "fixedLocation": { # The location of the vulnerability. # The location of the available fix for vulnerability.
               "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/) format. Examples include distro or storage location for vulnerable jar.
               "package": "A String", # Required. The package being described.
@@ -820,6 +823,7 @@
                 "revision": "A String", # The iteration of the package build from the above version.
               },
             },
+            "packageType": "A String", # The type of package (e.g. OS, MAVEN, GO).
             "severityName": "A String", # Deprecated, use Details.effective_severity instead The severity (e.g., distro assigned severity) for this vulnerability.
           },
         ],
@@ -1160,7 +1164,7 @@
   "updateTime": "A String", # Output only. The time this occurrence was last updated.
   "vulnerability": { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
     "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a scale of 0-10 where 0 indicates low severity and 10 indicates high severity.
-    "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is available, and note provider assigned severity when distro has not yet assigned a severity for this vulnerability.
+    "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is available, and note provider assigned severity when distro has not yet assigned a severity for this vulnerability. When there are multiple PackageIssues for this vulnerability, they can have different effective severities because some might be provided by the distro while others are provided by the language ecosystem for a language pack. For this reason, it is advised to use the effective severity on the PackageIssue level. In the case where multiple PackageIssues have differing effective severities, this field should be the highest severity for any of the PackageIssues.
     "longDescription": "A String", # Output only. A detailed description of this vulnerability.
     "packageIssue": [ # Required. The set of affected locations and their fixes (if available) within the associated resource.
       { # This message wraps a location affected by a vulnerability and its associated fix (if one is available).
@@ -1175,6 +1179,7 @@
             "revision": "A String", # The iteration of the package build from the above version.
           },
         },
+        "effectiveSeverity": "A String", # Output only. The distro or language system assigned severity for this vulnerability when that is available and note provider assigned severity when it is not available.
         "fixedLocation": { # The location of the vulnerability. # The location of the available fix for vulnerability.
           "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/) format. Examples include distro or storage location for vulnerable jar.
           "package": "A String", # Required. The package being described.
@@ -1186,6 +1191,7 @@
             "revision": "A String", # The iteration of the package build from the above version.
           },
         },
+        "packageType": "A String", # The type of package (e.g. OS, MAVEN, GO).
         "severityName": "A String", # Deprecated, use Details.effective_severity instead The severity (e.g., distro assigned severity) for this vulnerability.
       },
     ],
@@ -1517,7 +1523,7 @@
   "updateTime": "A String", # Output only. The time this occurrence was last updated.
   "vulnerability": { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
     "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a scale of 0-10 where 0 indicates low severity and 10 indicates high severity.
-    "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is available, and note provider assigned severity when distro has not yet assigned a severity for this vulnerability.
+    "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is available, and note provider assigned severity when distro has not yet assigned a severity for this vulnerability. When there are multiple PackageIssues for this vulnerability, they can have different effective severities because some might be provided by the distro while others are provided by the language ecosystem for a language pack. For this reason, it is advised to use the effective severity on the PackageIssue level. In the case where multiple PackageIssues have differing effective severities, this field should be the highest severity for any of the PackageIssues.
     "longDescription": "A String", # Output only. A detailed description of this vulnerability.
     "packageIssue": [ # Required. The set of affected locations and their fixes (if available) within the associated resource.
       { # This message wraps a location affected by a vulnerability and its associated fix (if one is available).
@@ -1532,6 +1538,7 @@
             "revision": "A String", # The iteration of the package build from the above version.
           },
         },
+        "effectiveSeverity": "A String", # Output only. The distro or language system assigned severity for this vulnerability when that is available and note provider assigned severity when it is not available.
         "fixedLocation": { # The location of the vulnerability. # The location of the available fix for vulnerability.
           "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/) format. Examples include distro or storage location for vulnerable jar.
           "package": "A String", # Required. The package being described.
@@ -1543,6 +1550,7 @@
             "revision": "A String", # The iteration of the package build from the above version.
           },
         },
+        "packageType": "A String", # The type of package (e.g. OS, MAVEN, GO).
         "severityName": "A String", # Deprecated, use Details.effective_severity instead The severity (e.g., distro assigned severity) for this vulnerability.
       },
     ],
@@ -1899,7 +1907,7 @@
   "updateTime": "A String", # Output only. The time this occurrence was last updated.
   "vulnerability": { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
     "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a scale of 0-10 where 0 indicates low severity and 10 indicates high severity.
-    "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is available, and note provider assigned severity when distro has not yet assigned a severity for this vulnerability.
+    "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is available, and note provider assigned severity when distro has not yet assigned a severity for this vulnerability. When there are multiple PackageIssues for this vulnerability, they can have different effective severities because some might be provided by the distro while others are provided by the language ecosystem for a language pack. For this reason, it is advised to use the effective severity on the PackageIssue level. In the case where multiple PackageIssues have differing effective severities, this field should be the highest severity for any of the PackageIssues.
     "longDescription": "A String", # Output only. A detailed description of this vulnerability.
     "packageIssue": [ # Required. The set of affected locations and their fixes (if available) within the associated resource.
       { # This message wraps a location affected by a vulnerability and its associated fix (if one is available).
@@ -1914,6 +1922,7 @@
             "revision": "A String", # The iteration of the package build from the above version.
           },
         },
+        "effectiveSeverity": "A String", # Output only. The distro or language system assigned severity for this vulnerability when that is available and note provider assigned severity when it is not available.
         "fixedLocation": { # The location of the vulnerability. # The location of the available fix for vulnerability.
           "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/) format. Examples include distro or storage location for vulnerable jar.
           "package": "A String", # Required. The package being described.
@@ -1925,6 +1934,7 @@
             "revision": "A String", # The iteration of the package build from the above version.
           },
         },
+        "packageType": "A String", # The type of package (e.g. OS, MAVEN, GO).
         "severityName": "A String", # Deprecated, use Details.effective_severity instead The severity (e.g., distro assigned severity) for this vulnerability.
       },
     ],
@@ -1964,7 +1974,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -2569,7 +2579,7 @@
       "updateTime": "A String", # Output only. The time this occurrence was last updated.
       "vulnerability": { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
         "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a scale of 0-10 where 0 indicates low severity and 10 indicates high severity.
-        "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is available, and note provider assigned severity when distro has not yet assigned a severity for this vulnerability.
+        "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is available, and note provider assigned severity when distro has not yet assigned a severity for this vulnerability. When there are multiple PackageIssues for this vulnerability, they can have different effective severities because some might be provided by the distro while others are provided by the language ecosystem for a language pack. For this reason, it is advised to use the effective severity on the PackageIssue level. In the case where multiple PackageIssues have differing effective severities, this field should be the highest severity for any of the PackageIssues.
         "longDescription": "A String", # Output only. A detailed description of this vulnerability.
         "packageIssue": [ # Required. The set of affected locations and their fixes (if available) within the associated resource.
           { # This message wraps a location affected by a vulnerability and its associated fix (if one is available).
@@ -2584,6 +2594,7 @@
                 "revision": "A String", # The iteration of the package build from the above version.
               },
             },
+            "effectiveSeverity": "A String", # Output only. The distro or language system assigned severity for this vulnerability when that is available and note provider assigned severity when it is not available.
             "fixedLocation": { # The location of the vulnerability. # The location of the available fix for vulnerability.
               "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/) format. Examples include distro or storage location for vulnerable jar.
               "package": "A String", # Required. The package being described.
@@ -2595,6 +2606,7 @@
                 "revision": "A String", # The iteration of the package build from the above version.
               },
             },
+            "packageType": "A String", # The type of package (e.g. OS, MAVEN, GO).
             "severityName": "A String", # Deprecated, use Details.effective_severity instead The severity (e.g., distro assigned severity) for this vulnerability.
           },
         ],
@@ -2944,7 +2956,7 @@
   "updateTime": "A String", # Output only. The time this occurrence was last updated.
   "vulnerability": { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
     "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a scale of 0-10 where 0 indicates low severity and 10 indicates high severity.
-    "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is available, and note provider assigned severity when distro has not yet assigned a severity for this vulnerability.
+    "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is available, and note provider assigned severity when distro has not yet assigned a severity for this vulnerability. When there are multiple PackageIssues for this vulnerability, they can have different effective severities because some might be provided by the distro while others are provided by the language ecosystem for a language pack. For this reason, it is advised to use the effective severity on the PackageIssue level. In the case where multiple PackageIssues have differing effective severities, this field should be the highest severity for any of the PackageIssues.
     "longDescription": "A String", # Output only. A detailed description of this vulnerability.
     "packageIssue": [ # Required. The set of affected locations and their fixes (if available) within the associated resource.
       { # This message wraps a location affected by a vulnerability and its associated fix (if one is available).
@@ -2959,6 +2971,7 @@
             "revision": "A String", # The iteration of the package build from the above version.
           },
         },
+        "effectiveSeverity": "A String", # Output only. The distro or language system assigned severity for this vulnerability when that is available and note provider assigned severity when it is not available.
         "fixedLocation": { # The location of the vulnerability. # The location of the available fix for vulnerability.
           "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/) format. Examples include distro or storage location for vulnerable jar.
           "package": "A String", # Required. The package being described.
@@ -2970,6 +2983,7 @@
             "revision": "A String", # The iteration of the package build from the above version.
           },
         },
+        "packageType": "A String", # The type of package (e.g. OS, MAVEN, GO).
         "severityName": "A String", # Deprecated, use Details.effective_severity instead The severity (e.g., distro assigned severity) for this vulnerability.
       },
     ],
@@ -3302,7 +3316,7 @@
   "updateTime": "A String", # Output only. The time this occurrence was last updated.
   "vulnerability": { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
     "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a scale of 0-10 where 0 indicates low severity and 10 indicates high severity.
-    "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is available, and note provider assigned severity when distro has not yet assigned a severity for this vulnerability.
+    "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is available, and note provider assigned severity when distro has not yet assigned a severity for this vulnerability. When there are multiple PackageIssues for this vulnerability, they can have different effective severities because some might be provided by the distro while others are provided by the language ecosystem for a language pack. For this reason, it is advised to use the effective severity on the PackageIssue level. In the case where multiple PackageIssues have differing effective severities, this field should be the highest severity for any of the PackageIssues.
     "longDescription": "A String", # Output only. A detailed description of this vulnerability.
     "packageIssue": [ # Required. The set of affected locations and their fixes (if available) within the associated resource.
       { # This message wraps a location affected by a vulnerability and its associated fix (if one is available).
@@ -3317,6 +3331,7 @@
             "revision": "A String", # The iteration of the package build from the above version.
           },
         },
+        "effectiveSeverity": "A String", # Output only. The distro or language system assigned severity for this vulnerability when that is available and note provider assigned severity when it is not available.
         "fixedLocation": { # The location of the vulnerability. # The location of the available fix for vulnerability.
           "cpeUri": "A String", # Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/) format. Examples include distro or storage location for vulnerable jar.
           "package": "A String", # Required. The package being described.
@@ -3328,6 +3343,7 @@
             "revision": "A String", # The iteration of the package build from the above version.
           },
         },
+        "packageType": "A String", # The type of package (e.g. OS, MAVEN, GO).
         "severityName": "A String", # Deprecated, use Details.effective_severity instead The severity (e.g., distro assigned severity) for this vulnerability.
       },
     ],
@@ -3354,7 +3370,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
         "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -3382,7 +3398,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/datacatalog_v1.projects.locations.entryGroups.entries.html

diff --git a/docs/dyn/datacatalog_v1.projects.locations.entryGroups.entries.html b/docs/dyn/datacatalog_v1.projects.locations.entryGroups.entries.html
index 6c060e0..1b7fe52 100644
--- a/docs/dyn/datacatalog_v1.projects.locations.entryGroups.entries.html
+++ b/docs/dyn/datacatalog_v1.projects.locations.entryGroups.entries.html
@@ -517,7 +517,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/datacatalog_v1.projects.locations.entryGroups.html

diff --git a/docs/dyn/datacatalog_v1.projects.locations.entryGroups.html b/docs/dyn/datacatalog_v1.projects.locations.entryGroups.html
index 86961e2..ab51362 100644
--- a/docs/dyn/datacatalog_v1.projects.locations.entryGroups.html
+++ b/docs/dyn/datacatalog_v1.projects.locations.entryGroups.html
@@ -230,7 +230,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -348,7 +348,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
         "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -376,7 +376,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/datacatalog_v1.projects.locations.tagTemplates.html

diff --git a/docs/dyn/datacatalog_v1.projects.locations.tagTemplates.html b/docs/dyn/datacatalog_v1.projects.locations.tagTemplates.html
index 56877bf..6232511 100644
--- a/docs/dyn/datacatalog_v1.projects.locations.tagTemplates.html
+++ b/docs/dyn/datacatalog_v1.projects.locations.tagTemplates.html
@@ -260,7 +260,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -359,7 +359,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
         "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -387,7 +387,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/datacatalog_v1.projects.locations.taxonomies.html

diff --git a/docs/dyn/datacatalog_v1.projects.locations.taxonomies.html b/docs/dyn/datacatalog_v1.projects.locations.taxonomies.html
index 991e11c..86f364a 100644
--- a/docs/dyn/datacatalog_v1.projects.locations.taxonomies.html
+++ b/docs/dyn/datacatalog_v1.projects.locations.taxonomies.html
@@ -282,7 +282,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -529,7 +529,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
         "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -557,7 +557,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/datacatalog_v1.projects.locations.taxonomies.policyTags.html

diff --git a/docs/dyn/datacatalog_v1.projects.locations.taxonomies.policyTags.html b/docs/dyn/datacatalog_v1.projects.locations.taxonomies.policyTags.html
index 0e3a3bc..3e4d134 100644
--- a/docs/dyn/datacatalog_v1.projects.locations.taxonomies.policyTags.html
+++ b/docs/dyn/datacatalog_v1.projects.locations.taxonomies.policyTags.html
@@ -214,7 +214,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -329,7 +329,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
         "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -357,7 +357,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/datacatalog_v1beta1.projects.locations.entryGroups.entries.html

diff --git a/docs/dyn/datacatalog_v1beta1.projects.locations.entryGroups.entries.html b/docs/dyn/datacatalog_v1beta1.projects.locations.entryGroups.entries.html
index 05d65d5..eeeec86 100644
--- a/docs/dyn/datacatalog_v1beta1.projects.locations.entryGroups.entries.html
+++ b/docs/dyn/datacatalog_v1beta1.projects.locations.entryGroups.entries.html
@@ -397,7 +397,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/datacatalog_v1beta1.projects.locations.entryGroups.html

diff --git a/docs/dyn/datacatalog_v1beta1.projects.locations.entryGroups.html b/docs/dyn/datacatalog_v1beta1.projects.locations.entryGroups.html
index c212dc1..4b5ad8a 100644
--- a/docs/dyn/datacatalog_v1beta1.projects.locations.entryGroups.html
+++ b/docs/dyn/datacatalog_v1beta1.projects.locations.entryGroups.html
@@ -230,7 +230,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -348,7 +348,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
         "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -376,7 +376,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/datacatalog_v1beta1.projects.locations.tagTemplates.html

diff --git a/docs/dyn/datacatalog_v1beta1.projects.locations.tagTemplates.html b/docs/dyn/datacatalog_v1beta1.projects.locations.tagTemplates.html
index 20c97f5..fe45c58 100644
--- a/docs/dyn/datacatalog_v1beta1.projects.locations.tagTemplates.html
+++ b/docs/dyn/datacatalog_v1beta1.projects.locations.tagTemplates.html
@@ -257,7 +257,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -354,7 +354,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
         "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -382,7 +382,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/datacatalog_v1beta1.projects.locations.taxonomies.html

diff --git a/docs/dyn/datacatalog_v1beta1.projects.locations.taxonomies.html b/docs/dyn/datacatalog_v1beta1.projects.locations.taxonomies.html
index a9ffe40..d4b3d3d 100644
--- a/docs/dyn/datacatalog_v1beta1.projects.locations.taxonomies.html
+++ b/docs/dyn/datacatalog_v1beta1.projects.locations.taxonomies.html
@@ -279,7 +279,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -470,7 +470,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
         "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -498,7 +498,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/datacatalog_v1beta1.projects.locations.taxonomies.policyTags.html

diff --git a/docs/dyn/datacatalog_v1beta1.projects.locations.taxonomies.policyTags.html b/docs/dyn/datacatalog_v1beta1.projects.locations.taxonomies.policyTags.html
index 16b35ec..4310569 100644
--- a/docs/dyn/datacatalog_v1beta1.projects.locations.taxonomies.policyTags.html
+++ b/docs/dyn/datacatalog_v1beta1.projects.locations.taxonomies.policyTags.html
@@ -214,7 +214,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -329,7 +329,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
         "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -357,7 +357,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/datastore_v1.projects.html

diff --git a/docs/dyn/datastore_v1.projects.html b/docs/dyn/datastore_v1.projects.html
index 4f71a3f..96acf9c 100644
--- a/docs/dyn/datastore_v1.projects.html
+++ b/docs/dyn/datastore_v1.projects.html
@@ -248,7 +248,40 @@
           ],
         },
         "properties": { # The entity's properties. The map's keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `""`.
-          "a_key": # Object with schema name: Value
+          "a_key": { # A message that can hold any of the supported value types and associated metadata.
+            "arrayValue": { # An array value. # An array value. Cannot contain another array value. A `Value` instance that sets field `array_value` must not set fields `meaning` or `exclude_from_indexes`.
+              "values": [ # Values in the array. The order of values in an array is preserved as long as all values have identical settings for 'exclude_from_indexes'.
+                # Object with schema name: Value
+              ],
+            },
+            "blobValue": "A String", # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
+            "booleanValue": True or False, # A boolean value.
+            "doubleValue": 3.14, # A double value.
+            "entityValue": # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
+            "excludeFromIndexes": True or False, # If the value should be excluded from all indexes including those defined explicitly.
+            "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
+              "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
+              "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
+            },
+            "integerValue": "A String", # An integer value.
+            "keyValue": { # A unique identifier for an entity. If a key's partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # A key value.
+              "partitionId": { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `""`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
+                "namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.
+                "projectId": "A String", # The ID of the project to which the entities belong.
+              },
+              "path": [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element's _ancestors_. An entity path is always fully complete: *all* of the entity's ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
+                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
+                  "id": "A String", # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
+                  "kind": "A String", # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
+                  "name": "A String", # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
+                },
+              ],
+            },
+            "meaning": 42, # The `meaning` field should only be populated for backwards compatibility.
+            "nullValue": "A String", # A null value.
+            "stringValue": "A String", # A UTF-8 encoded string value. When `exclude_from_indexes` is false (it is indexed) , may have at most 1500 bytes. Otherwise, may be set to at most 1,000,000 bytes.
+            "timestampValue": "A String", # A timestamp value. When stored in the Datastore, precise only to microseconds; any additional precision is rounded down.
+          },
         },
       },
       "update": { # A Datastore data object. An entity is limited to 1 megabyte when stored. That _roughly_ corresponds to a limit of 1 megabyte for the serialized form of this message. # The entity to update. The entity must already exist. Must have a complete key path.
@@ -266,7 +299,40 @@
           ],
         },
         "properties": { # The entity's properties. The map's keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `""`.
-          "a_key": # Object with schema name: Value
+          "a_key": { # A message that can hold any of the supported value types and associated metadata.
+            "arrayValue": { # An array value. # An array value. Cannot contain another array value. A `Value` instance that sets field `array_value` must not set fields `meaning` or `exclude_from_indexes`.
+              "values": [ # Values in the array. The order of values in an array is preserved as long as all values have identical settings for 'exclude_from_indexes'.
+                # Object with schema name: Value
+              ],
+            },
+            "blobValue": "A String", # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
+            "booleanValue": True or False, # A boolean value.
+            "doubleValue": 3.14, # A double value.
+            "entityValue": # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
+            "excludeFromIndexes": True or False, # If the value should be excluded from all indexes including those defined explicitly.
+            "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
+              "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
+              "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
+            },
+            "integerValue": "A String", # An integer value.
+            "keyValue": { # A unique identifier for an entity. If a key's partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # A key value.
+              "partitionId": { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `""`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
+                "namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.
+                "projectId": "A String", # The ID of the project to which the entities belong.
+              },
+              "path": [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element's _ancestors_. An entity path is always fully complete: *all* of the entity's ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
+                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
+                  "id": "A String", # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
+                  "kind": "A String", # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
+                  "name": "A String", # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
+                },
+              ],
+            },
+            "meaning": 42, # The `meaning` field should only be populated for backwards compatibility.
+            "nullValue": "A String", # A null value.
+            "stringValue": "A String", # A UTF-8 encoded string value. When `exclude_from_indexes` is false (it is indexed) , may have at most 1500 bytes. Otherwise, may be set to at most 1,000,000 bytes.
+            "timestampValue": "A String", # A timestamp value. When stored in the Datastore, precise only to microseconds; any additional precision is rounded down.
+          },
         },
       },
       "upsert": { # A Datastore data object. An entity is limited to 1 megabyte when stored. That _roughly_ corresponds to a limit of 1 megabyte for the serialized form of this message. # The entity to upsert. The entity may or may not already exist. The entity key's final path element may be incomplete.
@@ -284,7 +350,40 @@
           ],
         },
         "properties": { # The entity's properties. The map's keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `""`.
-          "a_key": # Object with schema name: Value
+          "a_key": { # A message that can hold any of the supported value types and associated metadata.
+            "arrayValue": { # An array value. # An array value. Cannot contain another array value. A `Value` instance that sets field `array_value` must not set fields `meaning` or `exclude_from_indexes`.
+              "values": [ # Values in the array. The order of values in an array is preserved as long as all values have identical settings for 'exclude_from_indexes'.
+                # Object with schema name: Value
+              ],
+            },
+            "blobValue": "A String", # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
+            "booleanValue": True or False, # A boolean value.
+            "doubleValue": 3.14, # A double value.
+            "entityValue": # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
+            "excludeFromIndexes": True or False, # If the value should be excluded from all indexes including those defined explicitly.
+            "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
+              "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
+              "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
+            },
+            "integerValue": "A String", # An integer value.
+            "keyValue": { # A unique identifier for an entity. If a key's partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # A key value.
+              "partitionId": { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `""`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
+                "namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.
+                "projectId": "A String", # The ID of the project to which the entities belong.
+              },
+              "path": [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element's _ancestors_. An entity path is always fully complete: *all* of the entity's ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
+                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
+                  "id": "A String", # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
+                  "kind": "A String", # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
+                  "name": "A String", # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
+                },
+              ],
+            },
+            "meaning": 42, # The `meaning` field should only be populated for backwards compatibility.
+            "nullValue": "A String", # A null value.
+            "stringValue": "A String", # A UTF-8 encoded string value. When `exclude_from_indexes` is false (it is indexed) , may have at most 1500 bytes. Otherwise, may be set to at most 1,000,000 bytes.
+            "timestampValue": "A String", # A timestamp value. When stored in the Datastore, precise only to microseconds; any additional precision is rounded down.
+          },
         },
       },
     },
@@ -503,7 +602,40 @@
           ],
         },
         "properties": { # The entity's properties. The map's keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `""`.
-          "a_key": # Object with schema name: Value
+          "a_key": { # A message that can hold any of the supported value types and associated metadata.
+            "arrayValue": { # An array value. # An array value. Cannot contain another array value. A `Value` instance that sets field `array_value` must not set fields `meaning` or `exclude_from_indexes`.
+              "values": [ # Values in the array. The order of values in an array is preserved as long as all values have identical settings for 'exclude_from_indexes'.
+                # Object with schema name: Value
+              ],
+            },
+            "blobValue": "A String", # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
+            "booleanValue": True or False, # A boolean value.
+            "doubleValue": 3.14, # A double value.
+            "entityValue": # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
+            "excludeFromIndexes": True or False, # If the value should be excluded from all indexes including those defined explicitly.
+            "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
+              "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
+              "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
+            },
+            "integerValue": "A String", # An integer value.
+            "keyValue": { # A unique identifier for an entity. If a key's partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # A key value.
+              "partitionId": { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `""`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
+                "namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.
+                "projectId": "A String", # The ID of the project to which the entities belong.
+              },
+              "path": [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element's _ancestors_. An entity path is always fully complete: *all* of the entity's ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
+                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
+                  "id": "A String", # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
+                  "kind": "A String", # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
+                  "name": "A String", # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
+                },
+              ],
+            },
+            "meaning": 42, # The `meaning` field should only be populated for backwards compatibility.
+            "nullValue": "A String", # A null value.
+            "stringValue": "A String", # A UTF-8 encoded string value. When `exclude_from_indexes` is false (it is indexed) , may have at most 1500 bytes. Otherwise, may be set to at most 1,000,000 bytes.
+            "timestampValue": "A String", # A timestamp value. When stored in the Datastore, precise only to microseconds; any additional precision is rounded down.
+          },
         },
       },
       "version": "A String", # The version of the entity, a strictly positive number that monotonically increases with changes to the entity. This field is set for `FULL` entity results. For missing entities in `LookupResponse`, this is the version of the snapshot that was used to look up the entity, and it is always set except for eventually consistent reads.
@@ -527,7 +659,40 @@
           ],
         },
         "properties": { # The entity's properties. The map's keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `""`.
-          "a_key": # Object with schema name: Value
+          "a_key": { # A message that can hold any of the supported value types and associated metadata.
+            "arrayValue": { # An array value. # An array value. Cannot contain another array value. A `Value` instance that sets field `array_value` must not set fields `meaning` or `exclude_from_indexes`.
+              "values": [ # Values in the array. The order of values in an array is preserved as long as all values have identical settings for 'exclude_from_indexes'.
+                # Object with schema name: Value
+              ],
+            },
+            "blobValue": "A String", # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
+            "booleanValue": True or False, # A boolean value.
+            "doubleValue": 3.14, # A double value.
+            "entityValue": # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
+            "excludeFromIndexes": True or False, # If the value should be excluded from all indexes including those defined explicitly.
+            "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
+              "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
+              "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
+            },
+            "integerValue": "A String", # An integer value.
+            "keyValue": { # A unique identifier for an entity. If a key's partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # A key value.
+              "partitionId": { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `""`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
+                "namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.
+                "projectId": "A String", # The ID of the project to which the entities belong.
+              },
+              "path": [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element's _ancestors_. An entity path is always fully complete: *all* of the entity's ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
+                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
+                  "id": "A String", # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
+                  "kind": "A String", # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
+                  "name": "A String", # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
+                },
+              ],
+            },
+            "meaning": 42, # The `meaning` field should only be populated for backwards compatibility.
+            "nullValue": "A String", # A null value.
+            "stringValue": "A String", # A UTF-8 encoded string value. When `exclude_from_indexes` is false (it is indexed) , may have at most 1500 bytes. Otherwise, may be set to at most 1,000,000 bytes.
+            "timestampValue": "A String", # A timestamp value. When stored in the Datastore, precise only to microseconds; any additional precision is rounded down.
+          },
         },
       },
       "version": "A String", # The version of the entity, a strictly positive number that monotonically increases with changes to the entity. This field is set for `FULL` entity results. For missing entities in `LookupResponse`, this is the version of the snapshot that was used to look up the entity, and it is always set except for eventually consistent reads.
@@ -625,24 +790,7 @@
           "blobValue": "A String", # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
           "booleanValue": True or False, # A boolean value.
           "doubleValue": 3.14, # A double value.
-          "entityValue": { # A Datastore data object. An entity is limited to 1 megabyte when stored. That _roughly_ corresponds to a limit of 1 megabyte for the serialized form of this message. # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
-            "key": { # A unique identifier for an entity. If a key's partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # The entity's key. An entity must have a key, unless otherwise documented (for example, an entity in `Value.entity_value` may have no key). An entity's kind is its key path's last element's kind, or null if it has no key.
-              "partitionId": { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `""`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
-                "namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.
-                "projectId": "A String", # The ID of the project to which the entities belong.
-              },
-              "path": [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element's _ancestors_. An entity path is always fully complete: *all* of the entity's ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
-                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
-                  "id": "A String", # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
-                  "kind": "A String", # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
-                  "name": "A String", # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
-                },
-              ],
-            },
-            "properties": { # The entity's properties. The map's keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `""`.
-              "a_key": # Object with schema name: Value
-            },
-          },
+          "entityValue": # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
           "excludeFromIndexes": True or False, # If the value should be excluded from all indexes including those defined explicitly.
           "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
             "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
@@ -681,24 +829,7 @@
           "blobValue": "A String", # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
           "booleanValue": True or False, # A boolean value.
           "doubleValue": 3.14, # A double value.
-          "entityValue": { # A Datastore data object. An entity is limited to 1 megabyte when stored. That _roughly_ corresponds to a limit of 1 megabyte for the serialized form of this message. # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
-            "key": { # A unique identifier for an entity. If a key's partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # The entity's key. An entity must have a key, unless otherwise documented (for example, an entity in `Value.entity_value` may have no key). An entity's kind is its key path's last element's kind, or null if it has no key.
-              "partitionId": { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `""`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
-                "namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.
-                "projectId": "A String", # The ID of the project to which the entities belong.
-              },
-              "path": [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element's _ancestors_. An entity path is always fully complete: *all* of the entity's ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
-                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
-                  "id": "A String", # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
-                  "kind": "A String", # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
-                  "name": "A String", # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
-                },
-              ],
-            },
-            "properties": { # The entity's properties. The map's keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `""`.
-              "a_key": # Object with schema name: Value
-            },
-          },
+          "entityValue": # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
           "excludeFromIndexes": True or False, # If the value should be excluded from all indexes including those defined explicitly.
           "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
             "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
@@ -759,24 +890,7 @@
           "blobValue": "A String", # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
           "booleanValue": True or False, # A boolean value.
           "doubleValue": 3.14, # A double value.
-          "entityValue": { # A Datastore data object. An entity is limited to 1 megabyte when stored. That _roughly_ corresponds to a limit of 1 megabyte for the serialized form of this message. # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
-            "key": { # A unique identifier for an entity. If a key's partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # The entity's key. An entity must have a key, unless otherwise documented (for example, an entity in `Value.entity_value` may have no key). An entity's kind is its key path's last element's kind, or null if it has no key.
-              "partitionId": { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `""`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
-                "namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.
-                "projectId": "A String", # The ID of the project to which the entities belong.
-              },
-              "path": [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element's _ancestors_. An entity path is always fully complete: *all* of the entity's ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
-                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
-                  "id": "A String", # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
-                  "kind": "A String", # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
-                  "name": "A String", # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
-                },
-              ],
-            },
-            "properties": { # The entity's properties. The map's keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `""`.
-              "a_key": # Object with schema name: Value
-            },
-          },
+          "entityValue": # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
           "excludeFromIndexes": True or False, # If the value should be excluded from all indexes including those defined explicitly.
           "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
             "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
@@ -863,7 +977,40 @@
             ],
           },
           "properties": { # The entity's properties. The map's keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `""`.
-            "a_key": # Object with schema name: Value
+            "a_key": { # A message that can hold any of the supported value types and associated metadata.
+              "arrayValue": { # An array value. # An array value. Cannot contain another array value. A `Value` instance that sets field `array_value` must not set fields `meaning` or `exclude_from_indexes`.
+                "values": [ # Values in the array. The order of values in an array is preserved as long as all values have identical settings for 'exclude_from_indexes'.
+                  # Object with schema name: Value
+                ],
+              },
+              "blobValue": "A String", # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
+              "booleanValue": True or False, # A boolean value.
+              "doubleValue": 3.14, # A double value.
+              "entityValue": # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
+              "excludeFromIndexes": True or False, # If the value should be excluded from all indexes including those defined explicitly.
+              "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
+                "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
+                "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
+              },
+              "integerValue": "A String", # An integer value.
+              "keyValue": { # A unique identifier for an entity. If a key's partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # A key value.
+                "partitionId": { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `""`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
+                  "namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.
+                  "projectId": "A String", # The ID of the project to which the entities belong.
+                },
+                "path": [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element's _ancestors_. An entity path is always fully complete: *all* of the entity's ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
+                  { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
+                    "id": "A String", # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
+                    "kind": "A String", # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
+                    "name": "A String", # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
+                  },
+                ],
+              },
+              "meaning": 42, # The `meaning` field should only be populated for backwards compatibility.
+              "nullValue": "A String", # A null value.
+              "stringValue": "A String", # A UTF-8 encoded string value. When `exclude_from_indexes` is false (it is indexed) , may have at most 1500 bytes. Otherwise, may be set to at most 1,000,000 bytes.
+              "timestampValue": "A String", # A timestamp value. When stored in the Datastore, precise only to microseconds; any additional precision is rounded down.
+            },
           },
         },
         "version": "A String", # The version of the entity, a strictly positive number that monotonically increases with changes to the entity. This field is set for `FULL` entity results. For missing entities in `LookupResponse`, this is the version of the snapshot that was used to look up the entity, and it is always set except for eventually consistent reads.
@@ -902,24 +1049,7 @@
           "blobValue": "A String", # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
           "booleanValue": True or False, # A boolean value.
           "doubleValue": 3.14, # A double value.
-          "entityValue": { # A Datastore data object. An entity is limited to 1 megabyte when stored. That _roughly_ corresponds to a limit of 1 megabyte for the serialized form of this message. # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
-            "key": { # A unique identifier for an entity. If a key's partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # The entity's key. An entity must have a key, unless otherwise documented (for example, an entity in `Value.entity_value` may have no key). An entity's kind is its key path's last element's kind, or null if it has no key.
-              "partitionId": { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `""`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
-                "namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.
-                "projectId": "A String", # The ID of the project to which the entities belong.
-              },
-              "path": [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element's _ancestors_. An entity path is always fully complete: *all* of the entity's ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
-                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
-                  "id": "A String", # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
-                  "kind": "A String", # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
-                  "name": "A String", # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
-                },
-              ],
-            },
-            "properties": { # The entity's properties. The map's keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `""`.
-              "a_key": # Object with schema name: Value
-            },
-          },
+          "entityValue": # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
           "excludeFromIndexes": True or False, # If the value should be excluded from all indexes including those defined explicitly.
           "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
             "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].

docs/dyn/datastore_v1beta3.projects.html

diff --git a/docs/dyn/datastore_v1beta3.projects.html b/docs/dyn/datastore_v1beta3.projects.html
index 6813001..5bd9b36 100644
--- a/docs/dyn/datastore_v1beta3.projects.html
+++ b/docs/dyn/datastore_v1beta3.projects.html
@@ -232,40 +232,7 @@
           ],
         },
         "properties": { # The entity's properties. The map's keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `""`.
-          "a_key": { # A message that can hold any of the supported value types and associated metadata.
-            "arrayValue": { # An array value. # An array value. Cannot contain another array value. A `Value` instance that sets field `array_value` must not set fields `meaning` or `exclude_from_indexes`.
-              "values": [ # Values in the array. The order of values in an array is preserved as long as all values have identical settings for 'exclude_from_indexes'.
-                # Object with schema name: Value
-              ],
-            },
-            "blobValue": "A String", # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
-            "booleanValue": True or False, # A boolean value.
-            "doubleValue": 3.14, # A double value.
-            "entityValue": # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
-            "excludeFromIndexes": True or False, # If the value should be excluded from all indexes including those defined explicitly.
-            "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-              "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-              "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-            },
-            "integerValue": "A String", # An integer value.
-            "keyValue": { # A unique identifier for an entity. If a key's partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # A key value.
-              "partitionId": { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `""`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
-                "namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.
-                "projectId": "A String", # The ID of the project to which the entities belong.
-              },
-              "path": [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element's _ancestors_. An entity path is always fully complete: *all* of the entity's ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
-                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
-                  "id": "A String", # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
-                  "kind": "A String", # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
-                  "name": "A String", # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
-                },
-              ],
-            },
-            "meaning": 42, # The `meaning` field should only be populated for backwards compatibility.
-            "nullValue": "A String", # A null value.
-            "stringValue": "A String", # A UTF-8 encoded string value. When `exclude_from_indexes` is false (it is indexed) , may have at most 1500 bytes. Otherwise, may be set to at most 1,000,000 bytes.
-            "timestampValue": "A String", # A timestamp value. When stored in the Datastore, precise only to microseconds; any additional precision is rounded down.
-          },
+          "a_key": # Object with schema name: Value
         },
       },
       "update": { # A Datastore data object. An entity is limited to 1 megabyte when stored. That _roughly_ corresponds to a limit of 1 megabyte for the serialized form of this message. # The entity to update. The entity must already exist. Must have a complete key path.
@@ -283,40 +250,7 @@
           ],
         },
         "properties": { # The entity's properties. The map's keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `""`.
-          "a_key": { # A message that can hold any of the supported value types and associated metadata.
-            "arrayValue": { # An array value. # An array value. Cannot contain another array value. A `Value` instance that sets field `array_value` must not set fields `meaning` or `exclude_from_indexes`.
-              "values": [ # Values in the array. The order of values in an array is preserved as long as all values have identical settings for 'exclude_from_indexes'.
-                # Object with schema name: Value
-              ],
-            },
-            "blobValue": "A String", # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
-            "booleanValue": True or False, # A boolean value.
-            "doubleValue": 3.14, # A double value.
-            "entityValue": # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
-            "excludeFromIndexes": True or False, # If the value should be excluded from all indexes including those defined explicitly.
-            "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-              "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-              "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-            },
-            "integerValue": "A String", # An integer value.
-            "keyValue": { # A unique identifier for an entity. If a key's partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # A key value.
-              "partitionId": { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `""`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
-                "namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.
-                "projectId": "A String", # The ID of the project to which the entities belong.
-              },
-              "path": [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element's _ancestors_. An entity path is always fully complete: *all* of the entity's ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
-                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
-                  "id": "A String", # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
-                  "kind": "A String", # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
-                  "name": "A String", # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
-                },
-              ],
-            },
-            "meaning": 42, # The `meaning` field should only be populated for backwards compatibility.
-            "nullValue": "A String", # A null value.
-            "stringValue": "A String", # A UTF-8 encoded string value. When `exclude_from_indexes` is false (it is indexed) , may have at most 1500 bytes. Otherwise, may be set to at most 1,000,000 bytes.
-            "timestampValue": "A String", # A timestamp value. When stored in the Datastore, precise only to microseconds; any additional precision is rounded down.
-          },
+          "a_key": # Object with schema name: Value
         },
       },
       "upsert": { # A Datastore data object. An entity is limited to 1 megabyte when stored. That _roughly_ corresponds to a limit of 1 megabyte for the serialized form of this message. # The entity to upsert. The entity may or may not already exist. The entity key's final path element may be incomplete.
@@ -334,40 +268,7 @@
           ],
         },
         "properties": { # The entity's properties. The map's keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `""`.
-          "a_key": { # A message that can hold any of the supported value types and associated metadata.
-            "arrayValue": { # An array value. # An array value. Cannot contain another array value. A `Value` instance that sets field `array_value` must not set fields `meaning` or `exclude_from_indexes`.
-              "values": [ # Values in the array. The order of values in an array is preserved as long as all values have identical settings for 'exclude_from_indexes'.
-                # Object with schema name: Value
-              ],
-            },
-            "blobValue": "A String", # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
-            "booleanValue": True or False, # A boolean value.
-            "doubleValue": 3.14, # A double value.
-            "entityValue": # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
-            "excludeFromIndexes": True or False, # If the value should be excluded from all indexes including those defined explicitly.
-            "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-              "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-              "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-            },
-            "integerValue": "A String", # An integer value.
-            "keyValue": { # A unique identifier for an entity. If a key's partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # A key value.
-              "partitionId": { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `""`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
-                "namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.
-                "projectId": "A String", # The ID of the project to which the entities belong.
-              },
-              "path": [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element's _ancestors_. An entity path is always fully complete: *all* of the entity's ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
-                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
-                  "id": "A String", # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
-                  "kind": "A String", # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
-                  "name": "A String", # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
-                },
-              ],
-            },
-            "meaning": 42, # The `meaning` field should only be populated for backwards compatibility.
-            "nullValue": "A String", # A null value.
-            "stringValue": "A String", # A UTF-8 encoded string value. When `exclude_from_indexes` is false (it is indexed) , may have at most 1500 bytes. Otherwise, may be set to at most 1,000,000 bytes.
-            "timestampValue": "A String", # A timestamp value. When stored in the Datastore, precise only to microseconds; any additional precision is rounded down.
-          },
+          "a_key": # Object with schema name: Value
         },
       },
     },
@@ -480,40 +381,7 @@
           ],
         },
         "properties": { # The entity's properties. The map's keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `""`.
-          "a_key": { # A message that can hold any of the supported value types and associated metadata.
-            "arrayValue": { # An array value. # An array value. Cannot contain another array value. A `Value` instance that sets field `array_value` must not set fields `meaning` or `exclude_from_indexes`.
-              "values": [ # Values in the array. The order of values in an array is preserved as long as all values have identical settings for 'exclude_from_indexes'.
-                # Object with schema name: Value
-              ],
-            },
-            "blobValue": "A String", # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
-            "booleanValue": True or False, # A boolean value.
-            "doubleValue": 3.14, # A double value.
-            "entityValue": # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
-            "excludeFromIndexes": True or False, # If the value should be excluded from all indexes including those defined explicitly.
-            "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-              "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-              "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-            },
-            "integerValue": "A String", # An integer value.
-            "keyValue": { # A unique identifier for an entity. If a key's partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # A key value.
-              "partitionId": { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `""`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
-                "namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.
-                "projectId": "A String", # The ID of the project to which the entities belong.
-              },
-              "path": [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element's _ancestors_. An entity path is always fully complete: *all* of the entity's ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
-                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
-                  "id": "A String", # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
-                  "kind": "A String", # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
-                  "name": "A String", # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
-                },
-              ],
-            },
-            "meaning": 42, # The `meaning` field should only be populated for backwards compatibility.
-            "nullValue": "A String", # A null value.
-            "stringValue": "A String", # A UTF-8 encoded string value. When `exclude_from_indexes` is false (it is indexed) , may have at most 1500 bytes. Otherwise, may be set to at most 1,000,000 bytes.
-            "timestampValue": "A String", # A timestamp value. When stored in the Datastore, precise only to microseconds; any additional precision is rounded down.
-          },
+          "a_key": # Object with schema name: Value
         },
       },
       "version": "A String", # The version of the entity, a strictly positive number that monotonically increases with changes to the entity. This field is set for `FULL` entity results. For missing entities in `LookupResponse`, this is the version of the snapshot that was used to look up the entity, and it is always set except for eventually consistent reads.
@@ -537,40 +405,7 @@
           ],
         },
         "properties": { # The entity's properties. The map's keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `""`.
-          "a_key": { # A message that can hold any of the supported value types and associated metadata.
-            "arrayValue": { # An array value. # An array value. Cannot contain another array value. A `Value` instance that sets field `array_value` must not set fields `meaning` or `exclude_from_indexes`.
-              "values": [ # Values in the array. The order of values in an array is preserved as long as all values have identical settings for 'exclude_from_indexes'.
-                # Object with schema name: Value
-              ],
-            },
-            "blobValue": "A String", # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
-            "booleanValue": True or False, # A boolean value.
-            "doubleValue": 3.14, # A double value.
-            "entityValue": # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
-            "excludeFromIndexes": True or False, # If the value should be excluded from all indexes including those defined explicitly.
-            "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-              "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-              "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-            },
-            "integerValue": "A String", # An integer value.
-            "keyValue": { # A unique identifier for an entity. If a key's partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # A key value.
-              "partitionId": { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `""`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
-                "namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.
-                "projectId": "A String", # The ID of the project to which the entities belong.
-              },
-              "path": [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element's _ancestors_. An entity path is always fully complete: *all* of the entity's ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
-                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
-                  "id": "A String", # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
-                  "kind": "A String", # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
-                  "name": "A String", # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
-                },
-              ],
-            },
-            "meaning": 42, # The `meaning` field should only be populated for backwards compatibility.
-            "nullValue": "A String", # A null value.
-            "stringValue": "A String", # A UTF-8 encoded string value. When `exclude_from_indexes` is false (it is indexed) , may have at most 1500 bytes. Otherwise, may be set to at most 1,000,000 bytes.
-            "timestampValue": "A String", # A timestamp value. When stored in the Datastore, precise only to microseconds; any additional precision is rounded down.
-          },
+          "a_key": # Object with schema name: Value
         },
       },
       "version": "A String", # The version of the entity, a strictly positive number that monotonically increases with changes to the entity. This field is set for `FULL` entity results. For missing entities in `LookupResponse`, this is the version of the snapshot that was used to look up the entity, and it is always set except for eventually consistent reads.
@@ -668,7 +503,24 @@
           "blobValue": "A String", # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
           "booleanValue": True or False, # A boolean value.
           "doubleValue": 3.14, # A double value.
-          "entityValue": # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
+          "entityValue": { # A Datastore data object. An entity is limited to 1 megabyte when stored. That _roughly_ corresponds to a limit of 1 megabyte for the serialized form of this message. # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
+            "key": { # A unique identifier for an entity. If a key's partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # The entity's key. An entity must have a key, unless otherwise documented (for example, an entity in `Value.entity_value` may have no key). An entity's kind is its key path's last element's kind, or null if it has no key.
+              "partitionId": { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `""`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
+                "namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.
+                "projectId": "A String", # The ID of the project to which the entities belong.
+              },
+              "path": [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element's _ancestors_. An entity path is always fully complete: *all* of the entity's ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
+                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
+                  "id": "A String", # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
+                  "kind": "A String", # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
+                  "name": "A String", # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
+                },
+              ],
+            },
+            "properties": { # The entity's properties. The map's keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `""`.
+              "a_key": # Object with schema name: Value
+            },
+          },
           "excludeFromIndexes": True or False, # If the value should be excluded from all indexes including those defined explicitly.
           "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
             "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
@@ -707,7 +559,24 @@
           "blobValue": "A String", # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
           "booleanValue": True or False, # A boolean value.
           "doubleValue": 3.14, # A double value.
-          "entityValue": # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
+          "entityValue": { # A Datastore data object. An entity is limited to 1 megabyte when stored. That _roughly_ corresponds to a limit of 1 megabyte for the serialized form of this message. # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
+            "key": { # A unique identifier for an entity. If a key's partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # The entity's key. An entity must have a key, unless otherwise documented (for example, an entity in `Value.entity_value` may have no key). An entity's kind is its key path's last element's kind, or null if it has no key.
+              "partitionId": { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `""`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
+                "namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.
+                "projectId": "A String", # The ID of the project to which the entities belong.
+              },
+              "path": [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element's _ancestors_. An entity path is always fully complete: *all* of the entity's ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
+                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
+                  "id": "A String", # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
+                  "kind": "A String", # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
+                  "name": "A String", # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
+                },
+              ],
+            },
+            "properties": { # The entity's properties. The map's keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `""`.
+              "a_key": # Object with schema name: Value
+            },
+          },
           "excludeFromIndexes": True or False, # If the value should be excluded from all indexes including those defined explicitly.
           "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
             "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
@@ -768,7 +637,24 @@
           "blobValue": "A String", # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
           "booleanValue": True or False, # A boolean value.
           "doubleValue": 3.14, # A double value.
-          "entityValue": # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
+          "entityValue": { # A Datastore data object. An entity is limited to 1 megabyte when stored. That _roughly_ corresponds to a limit of 1 megabyte for the serialized form of this message. # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
+            "key": { # A unique identifier for an entity. If a key's partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # The entity's key. An entity must have a key, unless otherwise documented (for example, an entity in `Value.entity_value` may have no key). An entity's kind is its key path's last element's kind, or null if it has no key.
+              "partitionId": { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `""`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
+                "namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.
+                "projectId": "A String", # The ID of the project to which the entities belong.
+              },
+              "path": [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element's _ancestors_. An entity path is always fully complete: *all* of the entity's ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
+                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
+                  "id": "A String", # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
+                  "kind": "A String", # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
+                  "name": "A String", # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
+                },
+              ],
+            },
+            "properties": { # The entity's properties. The map's keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `""`.
+              "a_key": # Object with schema name: Value
+            },
+          },
           "excludeFromIndexes": True or False, # If the value should be excluded from all indexes including those defined explicitly.
           "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
             "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
@@ -855,40 +741,7 @@
             ],
           },
           "properties": { # The entity's properties. The map's keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `""`.
-            "a_key": { # A message that can hold any of the supported value types and associated metadata.
-              "arrayValue": { # An array value. # An array value. Cannot contain another array value. A `Value` instance that sets field `array_value` must not set fields `meaning` or `exclude_from_indexes`.
-                "values": [ # Values in the array. The order of values in an array is preserved as long as all values have identical settings for 'exclude_from_indexes'.
-                  # Object with schema name: Value
-                ],
-              },
-              "blobValue": "A String", # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
-              "booleanValue": True or False, # A boolean value.
-              "doubleValue": 3.14, # A double value.
-              "entityValue": # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
-              "excludeFromIndexes": True or False, # If the value should be excluded from all indexes including those defined explicitly.
-              "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-              },
-              "integerValue": "A String", # An integer value.
-              "keyValue": { # A unique identifier for an entity. If a key's partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # A key value.
-                "partitionId": { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `""`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
-                  "namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.
-                  "projectId": "A String", # The ID of the project to which the entities belong.
-                },
-                "path": [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element's _ancestors_. An entity path is always fully complete: *all* of the entity's ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
-                  { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
-                    "id": "A String", # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
-                    "kind": "A String", # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
-                    "name": "A String", # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
-                  },
-                ],
-              },
-              "meaning": 42, # The `meaning` field should only be populated for backwards compatibility.
-              "nullValue": "A String", # A null value.
-              "stringValue": "A String", # A UTF-8 encoded string value. When `exclude_from_indexes` is false (it is indexed) , may have at most 1500 bytes. Otherwise, may be set to at most 1,000,000 bytes.
-              "timestampValue": "A String", # A timestamp value. When stored in the Datastore, precise only to microseconds; any additional precision is rounded down.
-            },
+            "a_key": # Object with schema name: Value
           },
         },
         "version": "A String", # The version of the entity, a strictly positive number that monotonically increases with changes to the entity. This field is set for `FULL` entity results. For missing entities in `LookupResponse`, this is the version of the snapshot that was used to look up the entity, and it is always set except for eventually consistent reads.
@@ -927,7 +780,24 @@
           "blobValue": "A String", # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
           "booleanValue": True or False, # A boolean value.
           "doubleValue": 3.14, # A double value.
-          "entityValue": # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
+          "entityValue": { # A Datastore data object. An entity is limited to 1 megabyte when stored. That _roughly_ corresponds to a limit of 1 megabyte for the serialized form of this message. # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
+            "key": { # A unique identifier for an entity. If a key's partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # The entity's key. An entity must have a key, unless otherwise documented (for example, an entity in `Value.entity_value` may have no key). An entity's kind is its key path's last element's kind, or null if it has no key.
+              "partitionId": { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `""`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
+                "namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.
+                "projectId": "A String", # The ID of the project to which the entities belong.
+              },
+              "path": [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element's _ancestors_. An entity path is always fully complete: *all* of the entity's ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
+                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
+                  "id": "A String", # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
+                  "kind": "A String", # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
+                  "name": "A String", # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `""`.
+                },
+              ],
+            },
+            "properties": { # The entity's properties. The map's keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `""`.
+              "a_key": # Object with schema name: Value
+            },
+          },
           "excludeFromIndexes": True or False, # If the value should be excluded from all indexes including those defined explicitly.
           "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
             "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].

docs/dyn/deploymentmanager_alpha.deployments.html

diff --git a/docs/dyn/deploymentmanager_alpha.deployments.html b/docs/dyn/deploymentmanager_alpha.deployments.html
index 6ec117d..225fc66 100644
--- a/docs/dyn/deploymentmanager_alpha.deployments.html
+++ b/docs/dyn/deploymentmanager_alpha.deployments.html
@@ -395,7 +395,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -964,7 +964,7 @@
     },
   ],
   "etag": "A String", # Flatten Policy to create a backward compatible wire-format. Deprecated. Use 'policy' to specify the etag.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the 'resource'. The size of the policy is limited to a few 10s of KB. An empty policy is in general a valid policy but certain services (like Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the 'resource'. The size of the policy is limited to a few 10s of KB. An empty policy is in general a valid policy but certain services (like Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -1005,7 +1005,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/deploymentmanager_v2.deployments.html

diff --git a/docs/dyn/deploymentmanager_v2.deployments.html b/docs/dyn/deploymentmanager_v2.deployments.html
index 9a217f0..8fd3f6d 100644
--- a/docs/dyn/deploymentmanager_v2.deployments.html
+++ b/docs/dyn/deploymentmanager_v2.deployments.html
@@ -369,7 +369,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -858,7 +858,7 @@
     },
   ],
   "etag": "A String", # Flatten Policy to create a backward compatible wire-format. Deprecated. Use 'policy' to specify the etag.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the 'resource'. The size of the policy is limited to a few 10s of KB. An empty policy is in general a valid policy but certain services (like Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the 'resource'. The size of the policy is limited to a few 10s of KB. An empty policy is in general a valid policy but certain services (like Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -899,7 +899,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/deploymentmanager_v2beta.deployments.html

diff --git a/docs/dyn/deploymentmanager_v2beta.deployments.html b/docs/dyn/deploymentmanager_v2beta.deployments.html
index 557451e..04915e5 100644
--- a/docs/dyn/deploymentmanager_v2beta.deployments.html
+++ b/docs/dyn/deploymentmanager_v2beta.deployments.html
@@ -369,7 +369,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -860,7 +860,7 @@
     },
   ],
   "etag": "A String", # Flatten Policy to create a backward compatible wire-format. Deprecated. Use 'policy' to specify the etag.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the 'resource'. The size of the policy is limited to a few 10s of KB. An empty policy is in general a valid policy but certain services (like Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the 'resource'. The size of the policy is limited to a few 10s of KB. An empty policy is in general a valid policy but certain services (like Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -901,7 +901,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/displayvideo_v1.customBiddingAlgorithms.html

diff --git a/docs/dyn/displayvideo_v1.customBiddingAlgorithms.html b/docs/dyn/displayvideo_v1.customBiddingAlgorithms.html
index 350edd1..5feac17 100644
--- a/docs/dyn/displayvideo_v1.customBiddingAlgorithms.html
+++ b/docs/dyn/displayvideo_v1.customBiddingAlgorithms.html
@@ -125,7 +125,7 @@
 
 Args:
   advertiserId: string, The ID of the DV360 advertiser that has access to the custom bidding algorithm.
-  filter: string, Allows filtering by custom bidding algorithm fields. Supported syntax: * Filter expressions are made up of one or more restrictions. * Restrictions can be combined by `AND`. A sequence of restrictions * implicitly uses `AND`. * A restriction has the form of `{field} {operator} {value}`. * The operator must be `CONTAINS (:)` or `EQUALS (=)`. * The operator must be `CONTAINS (:)` for the following field: - `displayName` * The operator must be `EQUALS (=)` for the following field: - `customBiddingAlgorithmType` * For `displayName`, the value is a string. We return all custom bidding algorithms whose display_name contains such string. * For `customBiddingAlgorithmType`, the value is a string. We return all algorithms whose custom_bidding_algorithm_type is equal to the given type. Examples: * All custom bidding algorithms for which the display name contains "politics": `displayName:politics`. * All custom bidding algorithms for which the type is "SCRIPT_BASED": `customBiddingAlgorithmType=SCRIPT_BASED` The length of this field should be no more than 500 characters.
+  filter: string, Allows filtering by custom bidding algorithm fields. Supported syntax: * Filter expressions are made up of one or more restrictions. * Restrictions can be combined by `AND`. A sequence of restrictions * implicitly uses `AND`. * A restriction has the form of `{field} {operator} {value}`. * The operator must be `CONTAINS (:)` or `EQUALS (=)`. * The operator must be `CONTAINS (:)` for the following field: - `displayName` * The operator must be `EQUALS (=)` for the following field: - `customBiddingAlgorithmType` - `customBiddingAlgorithmState` * For `displayName`, the value is a string. We return all custom bidding algorithms whose display_name contains such string. * For `customBiddingAlgorithmType`, the value is a string. We return all algorithms whose custom_bidding_algorithm_type is equal to the given type. * For `customBiddingAlgorithmState`, the value is a string. We return all algorithms whose custom_bidding_algorithm_state is equal to the given type. Examples: * All custom bidding algorithms for which the display name contains "politics": `displayName:politics`. * All custom bidding algorithms for which the type is "SCRIPT_BASED": `customBiddingAlgorithmType=SCRIPT_BASED` * All custom bidding algorithms for which the state is "ENABLED": `customBiddingAlgorithmState=ENABLED` The length of this field should be no more than 500 characters.
   orderBy: string, Field by which to sort the list. Acceptable values are: * `displayName` (default) The default sorting order is ascending. To specify descending order for a field, a suffix "desc" should be added to the field name. Example: `displayName desc`.
   pageSize: integer, Requested page size. Must be between `1` and `100`. If unspecified will default to `100`. Returns error code `INVALID_ARGUMENT` if an invalid value is specified.
   pageToken: string, A token identifying a page of results the server should return. Typically, this is the value of next_page_token returned from the previous call to `ListCustomBiddingAlgorithms` method. If not specified, the first page of results will be returned.

docs/dyn/documentai_v1.projects.locations.operations.html

diff --git a/docs/dyn/documentai_v1.projects.locations.operations.html b/docs/dyn/documentai_v1.projects.locations.operations.html
index a5b45fa..e32aa2d 100644
--- a/docs/dyn/documentai_v1.projects.locations.operations.html
+++ b/docs/dyn/documentai_v1.projects.locations.operations.html
@@ -75,7 +75,7 @@
 <h1><a href="documentai_v1.html">Cloud Document AI API</a> . <a href="documentai_v1.projects.html">projects</a> . <a href="documentai_v1.projects.locations.html">locations</a> . <a href="documentai_v1.projects.locations.operations.html">operations</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
-  <code><a href="#cancelOperation">cancelOperation(name, x__xgafv=None)</a></code></p>
+  <code><a href="#cancel">cancel(name, x__xgafv=None)</a></code></p>
 <p class="firstline">Starts asynchronous cancellation on a long-running operation. The server makes a best effort to cancel the operation, but success is not guaranteed. If the server doesn't support this method, it returns `google.rpc.Code.UNIMPLEMENTED`. Clients can use Operations.GetOperation or other methods to check whether the cancellation succeeded or whether the operation completed despite cancellation. On successful cancellation, the operation is not deleted; instead, it becomes an operation with an Operation.error value with a google.rpc.Status.code of 1, corresponding to `Code.CANCELLED`.</p>
 <p class="toc_element">
   <code><a href="#close">close()</a></code></p>
@@ -91,7 +91,7 @@
 <p class="firstline">Retrieves the next page of results.</p>
 <h3>Method Details</h3>
 <div class="method">
-    <code class="details" id="cancelOperation">cancelOperation(name, x__xgafv=None)</code>
+    <code class="details" id="cancel">cancel(name, x__xgafv=None)</code>
   <pre>Starts asynchronous cancellation on a long-running operation. The server makes a best effort to cancel the operation, but success is not guaranteed. If the server doesn&#x27;t support this method, it returns `google.rpc.Code.UNIMPLEMENTED`. Clients can use Operations.GetOperation or other methods to check whether the cancellation succeeded or whether the operation completed despite cancellation. On successful cancellation, the operation is not deleted; instead, it becomes an operation with an Operation.error value with a google.rpc.Status.code of 1, corresponding to `Code.CANCELLED`.
 
 Args:

docs/dyn/documentai_v1.uiv1beta3.projects.locations.operations.html

diff --git a/docs/dyn/documentai_v1.uiv1beta3.projects.locations.operations.html b/docs/dyn/documentai_v1.uiv1beta3.projects.locations.operations.html
index 9defab1..a7ca898 100644
--- a/docs/dyn/documentai_v1.uiv1beta3.projects.locations.operations.html
+++ b/docs/dyn/documentai_v1.uiv1beta3.projects.locations.operations.html
@@ -75,7 +75,7 @@
 <h1><a href="documentai_v1.html">Cloud Document AI API</a> . <a href="documentai_v1.uiv1beta3.html">uiv1beta3</a> . <a href="documentai_v1.uiv1beta3.projects.html">projects</a> . <a href="documentai_v1.uiv1beta3.projects.locations.html">locations</a> . <a href="documentai_v1.uiv1beta3.projects.locations.operations.html">operations</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
-  <code><a href="#cancelOperation">cancelOperation(name, x__xgafv=None)</a></code></p>
+  <code><a href="#cancel">cancel(name, x__xgafv=None)</a></code></p>
 <p class="firstline">Starts asynchronous cancellation on a long-running operation. The server makes a best effort to cancel the operation, but success is not guaranteed. If the server doesn't support this method, it returns `google.rpc.Code.UNIMPLEMENTED`. Clients can use Operations.GetOperation or other methods to check whether the cancellation succeeded or whether the operation completed despite cancellation. On successful cancellation, the operation is not deleted; instead, it becomes an operation with an Operation.error value with a google.rpc.Status.code of 1, corresponding to `Code.CANCELLED`.</p>
 <p class="toc_element">
   <code><a href="#close">close()</a></code></p>
@@ -91,7 +91,7 @@
 <p class="firstline">Retrieves the next page of results.</p>
 <h3>Method Details</h3>
 <div class="method">
-    <code class="details" id="cancelOperation">cancelOperation(name, x__xgafv=None)</code>
+    <code class="details" id="cancel">cancel(name, x__xgafv=None)</code>
   <pre>Starts asynchronous cancellation on a long-running operation. The server makes a best effort to cancel the operation, but success is not guaranteed. If the server doesn&#x27;t support this method, it returns `google.rpc.Code.UNIMPLEMENTED`. Clients can use Operations.GetOperation or other methods to check whether the cancellation succeeded or whether the operation completed despite cancellation. On successful cancellation, the operation is not deleted; instead, it becomes an operation with an Operation.error value with a google.rpc.Status.code of 1, corresponding to `Code.CANCELLED`.
 
 Args:

docs/dyn/documentai_v1beta3.projects.locations.operations.html

diff --git a/docs/dyn/documentai_v1beta3.projects.locations.operations.html b/docs/dyn/documentai_v1beta3.projects.locations.operations.html
index 9ec8953..26b9f87 100644
--- a/docs/dyn/documentai_v1beta3.projects.locations.operations.html
+++ b/docs/dyn/documentai_v1beta3.projects.locations.operations.html
@@ -75,7 +75,7 @@
 <h1><a href="documentai_v1beta3.html">Cloud Document AI API</a> . <a href="documentai_v1beta3.projects.html">projects</a> . <a href="documentai_v1beta3.projects.locations.html">locations</a> . <a href="documentai_v1beta3.projects.locations.operations.html">operations</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
-  <code><a href="#cancelOperation">cancelOperation(name, x__xgafv=None)</a></code></p>
+  <code><a href="#cancel">cancel(name, x__xgafv=None)</a></code></p>
 <p class="firstline">Starts asynchronous cancellation on a long-running operation. The server makes a best effort to cancel the operation, but success is not guaranteed. If the server doesn't support this method, it returns `google.rpc.Code.UNIMPLEMENTED`. Clients can use Operations.GetOperation or other methods to check whether the cancellation succeeded or whether the operation completed despite cancellation. On successful cancellation, the operation is not deleted; instead, it becomes an operation with an Operation.error value with a google.rpc.Status.code of 1, corresponding to `Code.CANCELLED`.</p>
 <p class="toc_element">
   <code><a href="#close">close()</a></code></p>
@@ -91,7 +91,7 @@
 <p class="firstline">Retrieves the next page of results.</p>
 <h3>Method Details</h3>
 <div class="method">
-    <code class="details" id="cancelOperation">cancelOperation(name, x__xgafv=None)</code>
+    <code class="details" id="cancel">cancel(name, x__xgafv=None)</code>
   <pre>Starts asynchronous cancellation on a long-running operation. The server makes a best effort to cancel the operation, but success is not guaranteed. If the server doesn&#x27;t support this method, it returns `google.rpc.Code.UNIMPLEMENTED`. Clients can use Operations.GetOperation or other methods to check whether the cancellation succeeded or whether the operation completed despite cancellation. On successful cancellation, the operation is not deleted; instead, it becomes an operation with an Operation.error value with a google.rpc.Status.code of 1, corresponding to `Code.CANCELLED`.
 
 Args:

docs/dyn/eventarc_v1.projects.locations.channels.html

diff --git a/docs/dyn/eventarc_v1.projects.locations.channels.html b/docs/dyn/eventarc_v1.projects.locations.channels.html
index 5c1f77c..490cbb5 100644
--- a/docs/dyn/eventarc_v1.projects.locations.channels.html
+++ b/docs/dyn/eventarc_v1.projects.locations.channels.html
@@ -107,7 +107,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -150,7 +150,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -192,7 +192,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/eventarc_v1.projects.locations.triggers.html

diff --git a/docs/dyn/eventarc_v1.projects.locations.triggers.html b/docs/dyn/eventarc_v1.projects.locations.triggers.html
index 3b034ac..eb95f59 100644
--- a/docs/dyn/eventarc_v1.projects.locations.triggers.html
+++ b/docs/dyn/eventarc_v1.projects.locations.triggers.html
@@ -280,7 +280,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -466,7 +466,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -508,7 +508,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/file_v1.projects.locations.backups.html

diff --git a/docs/dyn/file_v1.projects.locations.backups.html b/docs/dyn/file_v1.projects.locations.backups.html
index 9ca9cf5..b8c7858 100644
--- a/docs/dyn/file_v1.projects.locations.backups.html
+++ b/docs/dyn/file_v1.projects.locations.backups.html
@@ -106,7 +106,7 @@
   <pre>Creates a backup.
 
 Args:
-  parent: string, Required. The backup&#x27;s project and location, in the format projects/{project_number}/locations/{location}. In Cloud Filestore, backup locations map to GCP regions, for example **us-west1**. (required)
+  parent: string, Required. The backup&#x27;s project and location, in the format `projects/{project_number}/locations/{location}`. In Cloud Filestore, backup locations map to GCP regions, for example **us-west1**. (required)
   body: object, The request body.
     The object takes the form of:
 
@@ -118,10 +118,10 @@
   &quot;labels&quot;: { # Resource labels to represent user provided metadata.
     &quot;a_key&quot;: &quot;A String&quot;,
   },
-  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the backup, in the format projects/{project_number}/locations/{location_id}/backups/{backup_id}.
+  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the backup, in the format `projects/{project_number}/locations/{location_id}/backups/{backup_id}`.
   &quot;satisfiesPzs&quot;: True or False, # Output only. Reserved for future use.
   &quot;sourceFileShare&quot;: &quot;A String&quot;, # Name of the file share in the source Cloud Filestore instance that the backup is created from.
-  &quot;sourceInstance&quot;: &quot;A String&quot;, # The resource name of the source Cloud Filestore instance, in the format projects/{project_number}/locations/{location_id}/instances/{instance_id}, used to create this backup.
+  &quot;sourceInstance&quot;: &quot;A String&quot;, # The resource name of the source Cloud Filestore instance, in the format `projects/{project_number}/locations/{location_id}/instances/{instance_id}`, used to create this backup.
   &quot;sourceInstanceTier&quot;: &quot;A String&quot;, # Output only. The service tier of the source Cloud Filestore instance that this backup is created from.
   &quot;state&quot;: &quot;A String&quot;, # Output only. The backup state.
   &quot;storageBytes&quot;: &quot;A String&quot;, # Output only. The size of the storage used by the backup. As backups share storage, this number is expected to change with backup creation/deletion.
@@ -162,7 +162,7 @@
   <pre>Deletes a backup.
 
 Args:
-  name: string, Required. The backup resource name, in the format projects/{project_number}/locations/{location}/backups/{backup_id} (required)
+  name: string, Required. The backup resource name, in the format `projects/{project_number}/locations/{location}/backups/{backup_id}` (required)
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
@@ -197,7 +197,7 @@
   <pre>Gets the details of a specific backup.
 
 Args:
-  name: string, Required. The backup resource name, in the format projects/{project_number}/locations/{location}/backups/{backup_id}. (required)
+  name: string, Required. The backup resource name, in the format `projects/{project_number}/locations/{location}/backups/{backup_id}`. (required)
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
@@ -214,10 +214,10 @@
   &quot;labels&quot;: { # Resource labels to represent user provided metadata.
     &quot;a_key&quot;: &quot;A String&quot;,
   },
-  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the backup, in the format projects/{project_number}/locations/{location_id}/backups/{backup_id}.
+  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the backup, in the format `projects/{project_number}/locations/{location_id}/backups/{backup_id}`.
   &quot;satisfiesPzs&quot;: True or False, # Output only. Reserved for future use.
   &quot;sourceFileShare&quot;: &quot;A String&quot;, # Name of the file share in the source Cloud Filestore instance that the backup is created from.
-  &quot;sourceInstance&quot;: &quot;A String&quot;, # The resource name of the source Cloud Filestore instance, in the format projects/{project_number}/locations/{location_id}/instances/{instance_id}, used to create this backup.
+  &quot;sourceInstance&quot;: &quot;A String&quot;, # The resource name of the source Cloud Filestore instance, in the format `projects/{project_number}/locations/{location_id}/instances/{instance_id}`, used to create this backup.
   &quot;sourceInstanceTier&quot;: &quot;A String&quot;, # Output only. The service tier of the source Cloud Filestore instance that this backup is created from.
   &quot;state&quot;: &quot;A String&quot;, # Output only. The backup state.
   &quot;storageBytes&quot;: &quot;A String&quot;, # Output only. The size of the storage used by the backup. As backups share storage, this number is expected to change with backup creation/deletion.
@@ -229,7 +229,7 @@
   <pre>Lists all backups in a project for either a specified location or for all locations.
 
 Args:
-  parent: string, Required. The project and location for which to retrieve backup information, in the format projects/{project_number}/locations/{location}. In Cloud Filestore, backup locations map to GCP regions, for example **us-west1**. To retrieve backup information for all locations, use &quot;-&quot; for the {location} value. (required)
+  parent: string, Required. The project and location for which to retrieve backup information, in the format `projects/{project_number}/locations/{location}`. In Cloud Filestore, backup locations map to GCP regions, for example **us-west1**. To retrieve backup information for all locations, use &quot;-&quot; for the `{location}` value. (required)
   filter: string, List filter.
   orderBy: string, Sort results. Supported values are &quot;name&quot;, &quot;name desc&quot; or &quot;&quot; (unsorted).
   pageSize: integer, The maximum number of items to return.
@@ -243,7 +243,7 @@
   An object of the form:
 
     { # ListBackupsResponse is the result of ListBackupsRequest.
-  &quot;backups&quot;: [ # A list of backups in the project for the specified location. If the {location} value in the request is &quot;-&quot;, the response contains a list of backups from all locations. If any location is unreachable, the response will only return backups in reachable locations and the &quot;unreachable&quot; field will be populated with a list of unreachable locations.
+  &quot;backups&quot;: [ # A list of backups in the project for the specified location. If the `{location}` value in the request is &quot;-&quot;, the response contains a list of backups from all locations. If any location is unreachable, the response will only return backups in reachable locations and the &quot;unreachable&quot; field will be populated with a list of unreachable locations.
     { # A Cloud Filestore backup.
       &quot;capacityGb&quot;: &quot;A String&quot;, # Output only. Capacity of the source file share when the backup was created.
       &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time when the backup was created.
@@ -252,10 +252,10 @@
       &quot;labels&quot;: { # Resource labels to represent user provided metadata.
         &quot;a_key&quot;: &quot;A String&quot;,
       },
-      &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the backup, in the format projects/{project_number}/locations/{location_id}/backups/{backup_id}.
+      &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the backup, in the format `projects/{project_number}/locations/{location_id}/backups/{backup_id}`.
       &quot;satisfiesPzs&quot;: True or False, # Output only. Reserved for future use.
       &quot;sourceFileShare&quot;: &quot;A String&quot;, # Name of the file share in the source Cloud Filestore instance that the backup is created from.
-      &quot;sourceInstance&quot;: &quot;A String&quot;, # The resource name of the source Cloud Filestore instance, in the format projects/{project_number}/locations/{location_id}/instances/{instance_id}, used to create this backup.
+      &quot;sourceInstance&quot;: &quot;A String&quot;, # The resource name of the source Cloud Filestore instance, in the format `projects/{project_number}/locations/{location_id}/instances/{instance_id}`, used to create this backup.
       &quot;sourceInstanceTier&quot;: &quot;A String&quot;, # Output only. The service tier of the source Cloud Filestore instance that this backup is created from.
       &quot;state&quot;: &quot;A String&quot;, # Output only. The backup state.
       &quot;storageBytes&quot;: &quot;A String&quot;, # Output only. The size of the storage used by the backup. As backups share storage, this number is expected to change with backup creation/deletion.
@@ -287,7 +287,7 @@
   <pre>Updates the settings of a specific backup.
 
 Args:
-  name: string, Output only. The resource name of the backup, in the format projects/{project_number}/locations/{location_id}/backups/{backup_id}. (required)
+  name: string, Output only. The resource name of the backup, in the format `projects/{project_number}/locations/{location_id}/backups/{backup_id}`. (required)
   body: object, The request body.
     The object takes the form of:
 
@@ -299,10 +299,10 @@
   &quot;labels&quot;: { # Resource labels to represent user provided metadata.
     &quot;a_key&quot;: &quot;A String&quot;,
   },
-  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the backup, in the format projects/{project_number}/locations/{location_id}/backups/{backup_id}.
+  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the backup, in the format `projects/{project_number}/locations/{location_id}/backups/{backup_id}`.
   &quot;satisfiesPzs&quot;: True or False, # Output only. Reserved for future use.
   &quot;sourceFileShare&quot;: &quot;A String&quot;, # Name of the file share in the source Cloud Filestore instance that the backup is created from.
-  &quot;sourceInstance&quot;: &quot;A String&quot;, # The resource name of the source Cloud Filestore instance, in the format projects/{project_number}/locations/{location_id}/instances/{instance_id}, used to create this backup.
+  &quot;sourceInstance&quot;: &quot;A String&quot;, # The resource name of the source Cloud Filestore instance, in the format `projects/{project_number}/locations/{location_id}/instances/{instance_id}`, used to create this backup.
   &quot;sourceInstanceTier&quot;: &quot;A String&quot;, # Output only. The service tier of the source Cloud Filestore instance that this backup is created from.
   &quot;state&quot;: &quot;A String&quot;, # Output only. The backup state.
   &quot;storageBytes&quot;: &quot;A String&quot;, # Output only. The size of the storage used by the backup. As backups share storage, this number is expected to change with backup creation/deletion.

docs/dyn/file_v1.projects.locations.instances.html

diff --git a/docs/dyn/file_v1.projects.locations.instances.html b/docs/dyn/file_v1.projects.locations.instances.html
index fcdcd1e..4e4e63c 100644
--- a/docs/dyn/file_v1.projects.locations.instances.html
+++ b/docs/dyn/file_v1.projects.locations.instances.html
@@ -109,7 +109,7 @@
   <pre>Creates an instance. When creating from a backup, the capacity of the new instance needs to be equal to or larger than the capacity of the backup (and also equal to or larger than the minimum capacity of the tier).
 
 Args:
-  parent: string, Required. The instance&#x27;s project and location, in the format projects/{project_id}/locations/{location}. In Cloud Filestore, locations map to GCP zones, for example **us-west1-b**. (required)
+  parent: string, Required. The instance&#x27;s project and location, in the format `projects/{project_id}/locations/{location}`. In Cloud Filestore, locations map to GCP zones, for example **us-west1-b**. (required)
   body: object, The request body.
     The object takes the form of:
 
@@ -126,29 +126,29 @@
           &quot;accessMode&quot;: &quot;A String&quot;, # Either READ_ONLY, for allowing only read requests on the exported directory, or READ_WRITE, for allowing both read and write requests. The default is READ_WRITE.
           &quot;anonGid&quot;: &quot;A String&quot;, # An integer representing the anonymous group id with a default value of 65534. Anon_gid may only be set with squash_mode of ROOT_SQUASH. An error will be returned if this field is specified for other squash_mode settings.
           &quot;anonUid&quot;: &quot;A String&quot;, # An integer representing the anonymous user id with a default value of 65534. Anon_uid may only be set with squash_mode of ROOT_SQUASH. An error will be returned if this field is specified for other squash_mode settings.
-          &quot;ipRanges&quot;: [ # List of either an IPv4 addresses in the format {octet 1}.{octet 2}.{octet 3}.{octet 4} or CIDR ranges in the format {octet 1}.{octet 2}.{octet 3}.{octet 4}/{mask size} which may mount the file share. Overlapping IP ranges are not allowed, both within and across NfsExportOptions. An error will be returned. The limit is 64 IP ranges/addresses for each FileShareConfig among all NfsExportOptions.
+          &quot;ipRanges&quot;: [ # List of either an IPv4 addresses in the format `{octet1}.{octet2}.{octet3}.{octet4}` or CIDR ranges in the format `{octet1}.{octet2}.{octet3}.{octet4}/{mask size}` which may mount the file share. Overlapping IP ranges are not allowed, both within and across NfsExportOptions. An error will be returned. The limit is 64 IP ranges/addresses for each FileShareConfig among all NfsExportOptions.
             &quot;A String&quot;,
           ],
           &quot;squashMode&quot;: &quot;A String&quot;, # Either NO_ROOT_SQUASH, for allowing root access on the exported directory, or ROOT_SQUASH, for not allowing root access. The default is NO_ROOT_SQUASH.
         },
       ],
-      &quot;sourceBackup&quot;: &quot;A String&quot;, # The resource name of the backup, in the format projects/{project_number}/locations/{location_id}/backups/{backup_id}, that this file share has been restored from.
+      &quot;sourceBackup&quot;: &quot;A String&quot;, # The resource name of the backup, in the format `projects/{project_number}/locations/{location_id}/backups/{backup_id}`, that this file share has been restored from.
     },
   ],
   &quot;labels&quot;: { # Resource labels to represent user provided metadata.
     &quot;a_key&quot;: &quot;A String&quot;,
   },
-  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the instance, in the format projects/{project}/locations/{location}/instances/{instance}.
+  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the instance, in the format `projects/{project}/locations/{location}/instances/{instance}`.
   &quot;networks&quot;: [ # VPC networks to which the instance is connected. For this version, only a single network is supported.
     { # Network configuration for the instance.
-      &quot;ipAddresses&quot;: [ # Output only. IPv4 addresses in the format {octet 1}.{octet 2}.{octet 3}.{octet 4} or IPv6 addresses in the format {block 1}:{block 2}:{block 3}:{block 4}:{block 5}:{block 6}:{block 7}:{block 8}.
+      &quot;ipAddresses&quot;: [ # Output only. IPv4 addresses in the format `{octet1}.{octet2}.{octet3}.{octet4}` or IPv6 addresses in the format `{block1}:{block2}:{block3}:{block4}:{block5}:{block6}:{block7}:{block8}`.
         &quot;A String&quot;,
       ],
       &quot;modes&quot;: [ # Internet protocol versions for which the instance has IP addresses assigned. For this version, only MODE_IPV4 is supported.
         &quot;A String&quot;,
       ],
-      &quot;network&quot;: &quot;A String&quot;, # The name of the Google Compute Engine [VPC network](/compute/docs/networks-and-firewalls#networks) to which the instance is connected.
-      &quot;reservedIpRange&quot;: &quot;A String&quot;, # A /29 CIDR block in one of the [internal IP address ranges](https://www.arin.net/knowledge/address_filters.html) that identifies the range of IP addresses reserved for this instance. For example, 10.0.0.0/29 or 192.168.0.0/29. The range you specify can&#x27;t overlap with either existing subnets or assigned IP address ranges for other Cloud Filestore instances in the selected VPC network.
+      &quot;network&quot;: &quot;A String&quot;, # The name of the Google Compute Engine [VPC network](https://cloud.google.com/vpc/docs/vpc) to which the instance is connected.
+      &quot;reservedIpRange&quot;: &quot;A String&quot;, # A /29 CIDR block in one of the [internal IP address ranges](https://www.arin.net/reference/research/statistics/address_filters/) that identifies the range of IP addresses reserved for this instance. For example, 10.0.0.0/29 or 192.168.0.0/29. The range you specify can&#x27;t overlap with either existing subnets or assigned IP address ranges for other Cloud Filestore instances in the selected VPC network.
     },
   ],
   &quot;satisfiesPzs&quot;: True or False, # Output only. Reserved for future use.
@@ -192,7 +192,7 @@
   <pre>Deletes an instance.
 
 Args:
-  name: string, Required. The instance resource name, in the format projects/{project_id}/locations/{location}/instances/{instance_id} (required)
+  name: string, Required. The instance resource name, in the format `projects/{project_id}/locations/{location}/instances/{instance_id}` (required)
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
@@ -227,7 +227,7 @@
   <pre>Gets the details of a specific instance.
 
 Args:
-  name: string, Required. The instance resource name, in the format projects/{project_id}/locations/{location}/instances/{instance_id}. (required)
+  name: string, Required. The instance resource name, in the format `projects/{project_id}/locations/{location}/instances/{instance_id}`. (required)
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
@@ -249,29 +249,29 @@
           &quot;accessMode&quot;: &quot;A String&quot;, # Either READ_ONLY, for allowing only read requests on the exported directory, or READ_WRITE, for allowing both read and write requests. The default is READ_WRITE.
           &quot;anonGid&quot;: &quot;A String&quot;, # An integer representing the anonymous group id with a default value of 65534. Anon_gid may only be set with squash_mode of ROOT_SQUASH. An error will be returned if this field is specified for other squash_mode settings.
           &quot;anonUid&quot;: &quot;A String&quot;, # An integer representing the anonymous user id with a default value of 65534. Anon_uid may only be set with squash_mode of ROOT_SQUASH. An error will be returned if this field is specified for other squash_mode settings.
-          &quot;ipRanges&quot;: [ # List of either an IPv4 addresses in the format {octet 1}.{octet 2}.{octet 3}.{octet 4} or CIDR ranges in the format {octet 1}.{octet 2}.{octet 3}.{octet 4}/{mask size} which may mount the file share. Overlapping IP ranges are not allowed, both within and across NfsExportOptions. An error will be returned. The limit is 64 IP ranges/addresses for each FileShareConfig among all NfsExportOptions.
+          &quot;ipRanges&quot;: [ # List of either an IPv4 addresses in the format `{octet1}.{octet2}.{octet3}.{octet4}` or CIDR ranges in the format `{octet1}.{octet2}.{octet3}.{octet4}/{mask size}` which may mount the file share. Overlapping IP ranges are not allowed, both within and across NfsExportOptions. An error will be returned. The limit is 64 IP ranges/addresses for each FileShareConfig among all NfsExportOptions.
             &quot;A String&quot;,
           ],
           &quot;squashMode&quot;: &quot;A String&quot;, # Either NO_ROOT_SQUASH, for allowing root access on the exported directory, or ROOT_SQUASH, for not allowing root access. The default is NO_ROOT_SQUASH.
         },
       ],
-      &quot;sourceBackup&quot;: &quot;A String&quot;, # The resource name of the backup, in the format projects/{project_number}/locations/{location_id}/backups/{backup_id}, that this file share has been restored from.
+      &quot;sourceBackup&quot;: &quot;A String&quot;, # The resource name of the backup, in the format `projects/{project_number}/locations/{location_id}/backups/{backup_id}`, that this file share has been restored from.
     },
   ],
   &quot;labels&quot;: { # Resource labels to represent user provided metadata.
     &quot;a_key&quot;: &quot;A String&quot;,
   },
-  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the instance, in the format projects/{project}/locations/{location}/instances/{instance}.
+  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the instance, in the format `projects/{project}/locations/{location}/instances/{instance}`.
   &quot;networks&quot;: [ # VPC networks to which the instance is connected. For this version, only a single network is supported.
     { # Network configuration for the instance.
-      &quot;ipAddresses&quot;: [ # Output only. IPv4 addresses in the format {octet 1}.{octet 2}.{octet 3}.{octet 4} or IPv6 addresses in the format {block 1}:{block 2}:{block 3}:{block 4}:{block 5}:{block 6}:{block 7}:{block 8}.
+      &quot;ipAddresses&quot;: [ # Output only. IPv4 addresses in the format `{octet1}.{octet2}.{octet3}.{octet4}` or IPv6 addresses in the format `{block1}:{block2}:{block3}:{block4}:{block5}:{block6}:{block7}:{block8}`.
         &quot;A String&quot;,
       ],
       &quot;modes&quot;: [ # Internet protocol versions for which the instance has IP addresses assigned. For this version, only MODE_IPV4 is supported.
         &quot;A String&quot;,
       ],
-      &quot;network&quot;: &quot;A String&quot;, # The name of the Google Compute Engine [VPC network](/compute/docs/networks-and-firewalls#networks) to which the instance is connected.
-      &quot;reservedIpRange&quot;: &quot;A String&quot;, # A /29 CIDR block in one of the [internal IP address ranges](https://www.arin.net/knowledge/address_filters.html) that identifies the range of IP addresses reserved for this instance. For example, 10.0.0.0/29 or 192.168.0.0/29. The range you specify can&#x27;t overlap with either existing subnets or assigned IP address ranges for other Cloud Filestore instances in the selected VPC network.
+      &quot;network&quot;: &quot;A String&quot;, # The name of the Google Compute Engine [VPC network](https://cloud.google.com/vpc/docs/vpc) to which the instance is connected.
+      &quot;reservedIpRange&quot;: &quot;A String&quot;, # A /29 CIDR block in one of the [internal IP address ranges](https://www.arin.net/reference/research/statistics/address_filters/) that identifies the range of IP addresses reserved for this instance. For example, 10.0.0.0/29 or 192.168.0.0/29. The range you specify can&#x27;t overlap with either existing subnets or assigned IP address ranges for other Cloud Filestore instances in the selected VPC network.
     },
   ],
   &quot;satisfiesPzs&quot;: True or False, # Output only. Reserved for future use.
@@ -286,7 +286,7 @@
   <pre>Lists all instances in a project for either a specified location or for all locations.
 
 Args:
-  parent: string, Required. The project and location for which to retrieve instance information, in the format projects/{project_id}/locations/{location}. In Cloud Filestore, locations map to GCP zones, for example **us-west1-b**. To retrieve instance information for all locations, use &quot;-&quot; for the {location} value. (required)
+  parent: string, Required. The project and location for which to retrieve instance information, in the format `projects/{project_id}/locations/{location}`. In Cloud Filestore, locations map to GCP zones, for example **us-west1-b**. To retrieve instance information for all locations, use &quot;-&quot; for the `{location}` value. (required)
   filter: string, List filter.
   orderBy: string, Sort results. Supported values are &quot;name&quot;, &quot;name desc&quot; or &quot;&quot; (unsorted).
   pageSize: integer, The maximum number of items to return.
@@ -300,7 +300,7 @@
   An object of the form:
 
     { # ListInstancesResponse is the result of ListInstancesRequest.
-  &quot;instances&quot;: [ # A list of instances in the project for the specified location. If the {location} value in the request is &quot;-&quot;, the response contains a list of instances from all locations. If any location is unreachable, the response will only return instances in reachable locations and the &quot;unreachable&quot; field will be populated with a list of unreachable locations.
+  &quot;instances&quot;: [ # A list of instances in the project for the specified location. If the `{location}` value in the request is &quot;-&quot;, the response contains a list of instances from all locations. If any location is unreachable, the response will only return instances in reachable locations and the &quot;unreachable&quot; field will be populated with a list of unreachable locations.
     { # A Cloud Filestore instance.
       &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time when the instance was created.
       &quot;description&quot;: &quot;A String&quot;, # The description of the instance (2048 characters or less).
@@ -314,29 +314,29 @@
               &quot;accessMode&quot;: &quot;A String&quot;, # Either READ_ONLY, for allowing only read requests on the exported directory, or READ_WRITE, for allowing both read and write requests. The default is READ_WRITE.
               &quot;anonGid&quot;: &quot;A String&quot;, # An integer representing the anonymous group id with a default value of 65534. Anon_gid may only be set with squash_mode of ROOT_SQUASH. An error will be returned if this field is specified for other squash_mode settings.
               &quot;anonUid&quot;: &quot;A String&quot;, # An integer representing the anonymous user id with a default value of 65534. Anon_uid may only be set with squash_mode of ROOT_SQUASH. An error will be returned if this field is specified for other squash_mode settings.
-              &quot;ipRanges&quot;: [ # List of either an IPv4 addresses in the format {octet 1}.{octet 2}.{octet 3}.{octet 4} or CIDR ranges in the format {octet 1}.{octet 2}.{octet 3}.{octet 4}/{mask size} which may mount the file share. Overlapping IP ranges are not allowed, both within and across NfsExportOptions. An error will be returned. The limit is 64 IP ranges/addresses for each FileShareConfig among all NfsExportOptions.
+              &quot;ipRanges&quot;: [ # List of either an IPv4 addresses in the format `{octet1}.{octet2}.{octet3}.{octet4}` or CIDR ranges in the format `{octet1}.{octet2}.{octet3}.{octet4}/{mask size}` which may mount the file share. Overlapping IP ranges are not allowed, both within and across NfsExportOptions. An error will be returned. The limit is 64 IP ranges/addresses for each FileShareConfig among all NfsExportOptions.
                 &quot;A String&quot;,
               ],
               &quot;squashMode&quot;: &quot;A String&quot;, # Either NO_ROOT_SQUASH, for allowing root access on the exported directory, or ROOT_SQUASH, for not allowing root access. The default is NO_ROOT_SQUASH.
             },
           ],
-          &quot;sourceBackup&quot;: &quot;A String&quot;, # The resource name of the backup, in the format projects/{project_number}/locations/{location_id}/backups/{backup_id}, that this file share has been restored from.
+          &quot;sourceBackup&quot;: &quot;A String&quot;, # The resource name of the backup, in the format `projects/{project_number}/locations/{location_id}/backups/{backup_id}`, that this file share has been restored from.
         },
       ],
       &quot;labels&quot;: { # Resource labels to represent user provided metadata.
         &quot;a_key&quot;: &quot;A String&quot;,
       },
-      &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the instance, in the format projects/{project}/locations/{location}/instances/{instance}.
+      &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the instance, in the format `projects/{project}/locations/{location}/instances/{instance}`.
       &quot;networks&quot;: [ # VPC networks to which the instance is connected. For this version, only a single network is supported.
         { # Network configuration for the instance.
-          &quot;ipAddresses&quot;: [ # Output only. IPv4 addresses in the format {octet 1}.{octet 2}.{octet 3}.{octet 4} or IPv6 addresses in the format {block 1}:{block 2}:{block 3}:{block 4}:{block 5}:{block 6}:{block 7}:{block 8}.
+          &quot;ipAddresses&quot;: [ # Output only. IPv4 addresses in the format `{octet1}.{octet2}.{octet3}.{octet4}` or IPv6 addresses in the format `{block1}:{block2}:{block3}:{block4}:{block5}:{block6}:{block7}:{block8}`.
             &quot;A String&quot;,
           ],
           &quot;modes&quot;: [ # Internet protocol versions for which the instance has IP addresses assigned. For this version, only MODE_IPV4 is supported.
             &quot;A String&quot;,
           ],
-          &quot;network&quot;: &quot;A String&quot;, # The name of the Google Compute Engine [VPC network](/compute/docs/networks-and-firewalls#networks) to which the instance is connected.
-          &quot;reservedIpRange&quot;: &quot;A String&quot;, # A /29 CIDR block in one of the [internal IP address ranges](https://www.arin.net/knowledge/address_filters.html) that identifies the range of IP addresses reserved for this instance. For example, 10.0.0.0/29 or 192.168.0.0/29. The range you specify can&#x27;t overlap with either existing subnets or assigned IP address ranges for other Cloud Filestore instances in the selected VPC network.
+          &quot;network&quot;: &quot;A String&quot;, # The name of the Google Compute Engine [VPC network](https://cloud.google.com/vpc/docs/vpc) to which the instance is connected.
+          &quot;reservedIpRange&quot;: &quot;A String&quot;, # A /29 CIDR block in one of the [internal IP address ranges](https://www.arin.net/reference/research/statistics/address_filters/) that identifies the range of IP addresses reserved for this instance. For example, 10.0.0.0/29 or 192.168.0.0/29. The range you specify can&#x27;t overlap with either existing subnets or assigned IP address ranges for other Cloud Filestore instances in the selected VPC network.
         },
       ],
       &quot;satisfiesPzs&quot;: True or False, # Output only. Reserved for future use.
@@ -371,7 +371,7 @@
   <pre>Updates the settings of a specific instance.
 
 Args:
-  name: string, Output only. The resource name of the instance, in the format projects/{project}/locations/{location}/instances/{instance}. (required)
+  name: string, Output only. The resource name of the instance, in the format `projects/{project}/locations/{location}/instances/{instance}`. (required)
   body: object, The request body.
     The object takes the form of:
 
@@ -388,29 +388,29 @@
           &quot;accessMode&quot;: &quot;A String&quot;, # Either READ_ONLY, for allowing only read requests on the exported directory, or READ_WRITE, for allowing both read and write requests. The default is READ_WRITE.
           &quot;anonGid&quot;: &quot;A String&quot;, # An integer representing the anonymous group id with a default value of 65534. Anon_gid may only be set with squash_mode of ROOT_SQUASH. An error will be returned if this field is specified for other squash_mode settings.
           &quot;anonUid&quot;: &quot;A String&quot;, # An integer representing the anonymous user id with a default value of 65534. Anon_uid may only be set with squash_mode of ROOT_SQUASH. An error will be returned if this field is specified for other squash_mode settings.
-          &quot;ipRanges&quot;: [ # List of either an IPv4 addresses in the format {octet 1}.{octet 2}.{octet 3}.{octet 4} or CIDR ranges in the format {octet 1}.{octet 2}.{octet 3}.{octet 4}/{mask size} which may mount the file share. Overlapping IP ranges are not allowed, both within and across NfsExportOptions. An error will be returned. The limit is 64 IP ranges/addresses for each FileShareConfig among all NfsExportOptions.
+          &quot;ipRanges&quot;: [ # List of either an IPv4 addresses in the format `{octet1}.{octet2}.{octet3}.{octet4}` or CIDR ranges in the format `{octet1}.{octet2}.{octet3}.{octet4}/{mask size}` which may mount the file share. Overlapping IP ranges are not allowed, both within and across NfsExportOptions. An error will be returned. The limit is 64 IP ranges/addresses for each FileShareConfig among all NfsExportOptions.
             &quot;A String&quot;,
           ],
           &quot;squashMode&quot;: &quot;A String&quot;, # Either NO_ROOT_SQUASH, for allowing root access on the exported directory, or ROOT_SQUASH, for not allowing root access. The default is NO_ROOT_SQUASH.
         },
       ],
-      &quot;sourceBackup&quot;: &quot;A String&quot;, # The resource name of the backup, in the format projects/{project_number}/locations/{location_id}/backups/{backup_id}, that this file share has been restored from.
+      &quot;sourceBackup&quot;: &quot;A String&quot;, # The resource name of the backup, in the format `projects/{project_number}/locations/{location_id}/backups/{backup_id}`, that this file share has been restored from.
     },
   ],
   &quot;labels&quot;: { # Resource labels to represent user provided metadata.
     &quot;a_key&quot;: &quot;A String&quot;,
   },
-  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the instance, in the format projects/{project}/locations/{location}/instances/{instance}.
+  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the instance, in the format `projects/{project}/locations/{location}/instances/{instance}`.
   &quot;networks&quot;: [ # VPC networks to which the instance is connected. For this version, only a single network is supported.
     { # Network configuration for the instance.
-      &quot;ipAddresses&quot;: [ # Output only. IPv4 addresses in the format {octet 1}.{octet 2}.{octet 3}.{octet 4} or IPv6 addresses in the format {block 1}:{block 2}:{block 3}:{block 4}:{block 5}:{block 6}:{block 7}:{block 8}.
+      &quot;ipAddresses&quot;: [ # Output only. IPv4 addresses in the format `{octet1}.{octet2}.{octet3}.{octet4}` or IPv6 addresses in the format `{block1}:{block2}:{block3}:{block4}:{block5}:{block6}:{block7}:{block8}`.
         &quot;A String&quot;,
       ],
       &quot;modes&quot;: [ # Internet protocol versions for which the instance has IP addresses assigned. For this version, only MODE_IPV4 is supported.
         &quot;A String&quot;,
       ],
-      &quot;network&quot;: &quot;A String&quot;, # The name of the Google Compute Engine [VPC network](/compute/docs/networks-and-firewalls#networks) to which the instance is connected.
-      &quot;reservedIpRange&quot;: &quot;A String&quot;, # A /29 CIDR block in one of the [internal IP address ranges](https://www.arin.net/knowledge/address_filters.html) that identifies the range of IP addresses reserved for this instance. For example, 10.0.0.0/29 or 192.168.0.0/29. The range you specify can&#x27;t overlap with either existing subnets or assigned IP address ranges for other Cloud Filestore instances in the selected VPC network.
+      &quot;network&quot;: &quot;A String&quot;, # The name of the Google Compute Engine [VPC network](https://cloud.google.com/vpc/docs/vpc) to which the instance is connected.
+      &quot;reservedIpRange&quot;: &quot;A String&quot;, # A /29 CIDR block in one of the [internal IP address ranges](https://www.arin.net/reference/research/statistics/address_filters/) that identifies the range of IP addresses reserved for this instance. For example, 10.0.0.0/29 or 192.168.0.0/29. The range you specify can&#x27;t overlap with either existing subnets or assigned IP address ranges for other Cloud Filestore instances in the selected VPC network.
     },
   ],
   &quot;satisfiesPzs&quot;: True or False, # Output only. Reserved for future use.
@@ -454,13 +454,13 @@
   <pre>Restores an existing instance&#x27;s file share from a backup. The capacity of the instance needs to be equal to or larger than the capacity of the backup (and also equal to or larger than the minimum capacity of the tier).
 
 Args:
-  name: string, Required. The resource name of the instance, in the format projects/{project_number}/locations/{location_id}/instances/{instance_id}. (required)
+  name: string, Required. The resource name of the instance, in the format `projects/{project_number}/locations/{location_id}/instances/{instance_id}`. (required)
   body: object, The request body.
     The object takes the form of:
 
 { # RestoreInstanceRequest restores an existing instances&#x27;s file share from a backup.
   &quot;fileShare&quot;: &quot;A String&quot;, # Required. Name of the file share in the Cloud Filestore instance that the backup is being restored to.
-  &quot;sourceBackup&quot;: &quot;A String&quot;, # The resource name of the backup, in the format projects/{project_number}/locations/{location_id}/backups/{backup_id}.
+  &quot;sourceBackup&quot;: &quot;A String&quot;, # The resource name of the backup, in the format `projects/{project_number}/locations/{location_id}/backups/{backup_id}`.
 }
 
   x__xgafv: string, V1 error format.

docs/dyn/file_v1beta1.projects.locations.backups.html

diff --git a/docs/dyn/file_v1beta1.projects.locations.backups.html b/docs/dyn/file_v1beta1.projects.locations.backups.html
index b65d2c2..1242d34 100644
--- a/docs/dyn/file_v1beta1.projects.locations.backups.html
+++ b/docs/dyn/file_v1beta1.projects.locations.backups.html
@@ -106,7 +106,7 @@
   <pre>Creates a backup.
 
 Args:
-  parent: string, Required. The backup&#x27;s project and location, in the format projects/{project_id}/locations/{location}. In Cloud Filestore, backup locations map to GCP regions, for example **us-west1**. (required)
+  parent: string, Required. The backup&#x27;s project and location, in the format `projects/{project_id}/locations/{location}`. In Cloud Filestore, backup locations map to GCP regions, for example **us-west1**. (required)
   body: object, The request body.
     The object takes the form of:
 
@@ -118,10 +118,10 @@
   &quot;labels&quot;: { # Resource labels to represent user provided metadata.
     &quot;a_key&quot;: &quot;A String&quot;,
   },
-  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the backup, in the format projects/{project_id}/locations/{location_id}/backups/{backup_id}.
+  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the backup, in the format `projects/{project_id}/locations/{location_id}/backups/{backup_id}`.
   &quot;satisfiesPzs&quot;: True or False, # Output only. Reserved for future use.
   &quot;sourceFileShare&quot;: &quot;A String&quot;, # Name of the file share in the source Cloud Filestore instance that the backup is created from.
-  &quot;sourceInstance&quot;: &quot;A String&quot;, # The resource name of the source Cloud Filestore instance, in the format projects/{project_id}/locations/{location_id}/instances/{instance_id}, used to create this backup.
+  &quot;sourceInstance&quot;: &quot;A String&quot;, # The resource name of the source Cloud Filestore instance, in the format `projects/{project_id}/locations/{location_id}/instances/{instance_id}`, used to create this backup.
   &quot;sourceInstanceTier&quot;: &quot;A String&quot;, # Output only. The service tier of the source Cloud Filestore instance that this backup is created from.
   &quot;state&quot;: &quot;A String&quot;, # Output only. The backup state.
   &quot;storageBytes&quot;: &quot;A String&quot;, # Output only. The size of the storage used by the backup. As backups share storage, this number is expected to change with backup creation/deletion.
@@ -162,7 +162,7 @@
   <pre>Deletes a backup.
 
 Args:
-  name: string, Required. The backup resource name, in the format projects/{project_id}/locations/{location}/backups/{backup_id} (required)
+  name: string, Required. The backup resource name, in the format `projects/{project_id}/locations/{location}/backups/{backup_id}` (required)
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
@@ -197,7 +197,7 @@
   <pre>Gets the details of a specific backup.
 
 Args:
-  name: string, Required. The backup resource name, in the format projects/{project_id}/locations/{location}/backups/{backup_id}. (required)
+  name: string, Required. The backup resource name, in the format `projects/{project_id}/locations/{location}/backups/{backup_id}`. (required)
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
@@ -214,10 +214,10 @@
   &quot;labels&quot;: { # Resource labels to represent user provided metadata.
     &quot;a_key&quot;: &quot;A String&quot;,
   },
-  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the backup, in the format projects/{project_id}/locations/{location_id}/backups/{backup_id}.
+  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the backup, in the format `projects/{project_id}/locations/{location_id}/backups/{backup_id}`.
   &quot;satisfiesPzs&quot;: True or False, # Output only. Reserved for future use.
   &quot;sourceFileShare&quot;: &quot;A String&quot;, # Name of the file share in the source Cloud Filestore instance that the backup is created from.
-  &quot;sourceInstance&quot;: &quot;A String&quot;, # The resource name of the source Cloud Filestore instance, in the format projects/{project_id}/locations/{location_id}/instances/{instance_id}, used to create this backup.
+  &quot;sourceInstance&quot;: &quot;A String&quot;, # The resource name of the source Cloud Filestore instance, in the format `projects/{project_id}/locations/{location_id}/instances/{instance_id}`, used to create this backup.
   &quot;sourceInstanceTier&quot;: &quot;A String&quot;, # Output only. The service tier of the source Cloud Filestore instance that this backup is created from.
   &quot;state&quot;: &quot;A String&quot;, # Output only. The backup state.
   &quot;storageBytes&quot;: &quot;A String&quot;, # Output only. The size of the storage used by the backup. As backups share storage, this number is expected to change with backup creation/deletion.
@@ -229,7 +229,7 @@
   <pre>Lists all backups in a project for either a specified location or for all locations.
 
 Args:
-  parent: string, Required. The project and location for which to retrieve backup information, in the format projects/{project_id}/locations/{location}. In Cloud Filestore, backup locations map to GCP regions, for example **us-west1**. To retrieve backup information for all locations, use &quot;-&quot; for the {location} value. (required)
+  parent: string, Required. The project and location for which to retrieve backup information, in the format `projects/{project_id}/locations/{location}`. In Cloud Filestore, backup locations map to GCP regions, for example **us-west1**. To retrieve backup information for all locations, use &quot;-&quot; for the `{location}` value. (required)
   filter: string, List filter.
   orderBy: string, Sort results. Supported values are &quot;name&quot;, &quot;name desc&quot; or &quot;&quot; (unsorted).
   pageSize: integer, The maximum number of items to return.
@@ -243,7 +243,7 @@
   An object of the form:
 
     { # ListBackupsResponse is the result of ListBackupsRequest.
-  &quot;backups&quot;: [ # A list of backups in the project for the specified location. If the {location} value in the request is &quot;-&quot;, the response contains a list of backups from all locations. If any location is unreachable, the response will only return backups in reachable locations and the &quot;unreachable&quot; field will be populated with a list of unreachable locations.
+  &quot;backups&quot;: [ # A list of backups in the project for the specified location. If the `{location}` value in the request is &quot;-&quot;, the response contains a list of backups from all locations. If any location is unreachable, the response will only return backups in reachable locations and the &quot;unreachable&quot; field will be populated with a list of unreachable locations.
     { # A Cloud Filestore backup.
       &quot;capacityGb&quot;: &quot;A String&quot;, # Output only. Capacity of the source file share when the backup was created.
       &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time when the backup was created.
@@ -252,10 +252,10 @@
       &quot;labels&quot;: { # Resource labels to represent user provided metadata.
         &quot;a_key&quot;: &quot;A String&quot;,
       },
-      &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the backup, in the format projects/{project_id}/locations/{location_id}/backups/{backup_id}.
+      &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the backup, in the format `projects/{project_id}/locations/{location_id}/backups/{backup_id}`.
       &quot;satisfiesPzs&quot;: True or False, # Output only. Reserved for future use.
       &quot;sourceFileShare&quot;: &quot;A String&quot;, # Name of the file share in the source Cloud Filestore instance that the backup is created from.
-      &quot;sourceInstance&quot;: &quot;A String&quot;, # The resource name of the source Cloud Filestore instance, in the format projects/{project_id}/locations/{location_id}/instances/{instance_id}, used to create this backup.
+      &quot;sourceInstance&quot;: &quot;A String&quot;, # The resource name of the source Cloud Filestore instance, in the format `projects/{project_id}/locations/{location_id}/instances/{instance_id}`, used to create this backup.
       &quot;sourceInstanceTier&quot;: &quot;A String&quot;, # Output only. The service tier of the source Cloud Filestore instance that this backup is created from.
       &quot;state&quot;: &quot;A String&quot;, # Output only. The backup state.
       &quot;storageBytes&quot;: &quot;A String&quot;, # Output only. The size of the storage used by the backup. As backups share storage, this number is expected to change with backup creation/deletion.
@@ -287,7 +287,7 @@
   <pre>Updates the settings of a specific backup.
 
 Args:
-  name: string, Output only. The resource name of the backup, in the format projects/{project_id}/locations/{location_id}/backups/{backup_id}. (required)
+  name: string, Output only. The resource name of the backup, in the format `projects/{project_id}/locations/{location_id}/backups/{backup_id}`. (required)
   body: object, The request body.
     The object takes the form of:
 
@@ -299,10 +299,10 @@
   &quot;labels&quot;: { # Resource labels to represent user provided metadata.
     &quot;a_key&quot;: &quot;A String&quot;,
   },
-  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the backup, in the format projects/{project_id}/locations/{location_id}/backups/{backup_id}.
+  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the backup, in the format `projects/{project_id}/locations/{location_id}/backups/{backup_id}`.
   &quot;satisfiesPzs&quot;: True or False, # Output only. Reserved for future use.
   &quot;sourceFileShare&quot;: &quot;A String&quot;, # Name of the file share in the source Cloud Filestore instance that the backup is created from.
-  &quot;sourceInstance&quot;: &quot;A String&quot;, # The resource name of the source Cloud Filestore instance, in the format projects/{project_id}/locations/{location_id}/instances/{instance_id}, used to create this backup.
+  &quot;sourceInstance&quot;: &quot;A String&quot;, # The resource name of the source Cloud Filestore instance, in the format `projects/{project_id}/locations/{location_id}/instances/{instance_id}`, used to create this backup.
   &quot;sourceInstanceTier&quot;: &quot;A String&quot;, # Output only. The service tier of the source Cloud Filestore instance that this backup is created from.
   &quot;state&quot;: &quot;A String&quot;, # Output only. The backup state.
   &quot;storageBytes&quot;: &quot;A String&quot;, # Output only. The size of the storage used by the backup. As backups share storage, this number is expected to change with backup creation/deletion.

docs/dyn/file_v1beta1.projects.locations.instances.html

diff --git a/docs/dyn/file_v1beta1.projects.locations.instances.html b/docs/dyn/file_v1beta1.projects.locations.instances.html
index a400863..4467ce5 100644
--- a/docs/dyn/file_v1beta1.projects.locations.instances.html
+++ b/docs/dyn/file_v1beta1.projects.locations.instances.html
@@ -114,7 +114,7 @@
   <pre>Creates an instance. When creating from a backup, the capacity of the new instance needs to be equal to or larger than the capacity of the backup (and also equal to or larger than the minimum capacity of the tier).
 
 Args:
-  parent: string, Required. The instance&#x27;s project and location, in the format projects/{project_id}/locations/{location}. In Cloud Filestore, locations map to GCP zones, for example **us-west1-b**. (required)
+  parent: string, Required. The instance&#x27;s project and location, in the format `projects/{project_id}/locations/{location}`. In Cloud Filestore, locations map to GCP zones, for example **us-west1-b**. (required)
   body: object, The request body.
     The object takes the form of:
 
@@ -131,30 +131,30 @@
           &quot;accessMode&quot;: &quot;A String&quot;, # Either READ_ONLY, for allowing only read requests on the exported directory, or READ_WRITE, for allowing both read and write requests. The default is READ_WRITE.
           &quot;anonGid&quot;: &quot;A String&quot;, # An integer representing the anonymous group id with a default value of 65534. Anon_gid may only be set with squash_mode of ROOT_SQUASH. An error will be returned if this field is specified for other squash_mode settings.
           &quot;anonUid&quot;: &quot;A String&quot;, # An integer representing the anonymous user id with a default value of 65534. Anon_uid may only be set with squash_mode of ROOT_SQUASH. An error will be returned if this field is specified for other squash_mode settings.
-          &quot;ipRanges&quot;: [ # List of either an IPv4 addresses in the format {octet 1}.{octet 2}.{octet 3}.{octet 4} or CIDR ranges in the format {octet 1}.{octet 2}.{octet 3}.{octet 4}/{mask size} which may mount the file share. Overlapping IP ranges are not allowed, both within and across NfsExportOptions. An error will be returned. The limit is 64 IP ranges/addresses for each FileShareConfig among all NfsExportOptions.
+          &quot;ipRanges&quot;: [ # List of either an IPv4 addresses in the format `{octet1}.{octet2}.{octet3}.{octet4}` or CIDR ranges in the format `{octet1}.{octet2}.{octet3}.{octet4}/{mask size}` which may mount the file share. Overlapping IP ranges are not allowed, both within and across NfsExportOptions. An error will be returned. The limit is 64 IP ranges/addresses for each FileShareConfig among all NfsExportOptions.
             &quot;A String&quot;,
           ],
           &quot;squashMode&quot;: &quot;A String&quot;, # Either NO_ROOT_SQUASH, for allowing root access on the exported directory, or ROOT_SQUASH, for not allowing root access. The default is NO_ROOT_SQUASH.
         },
       ],
-      &quot;sourceBackup&quot;: &quot;A String&quot;, # The resource name of the backup, in the format projects/{project_id}/locations/{location_id}/backups/{backup_id}, that this file share has been restored from.
+      &quot;sourceBackup&quot;: &quot;A String&quot;, # The resource name of the backup, in the format `projects/{project_id}/locations/{location_id}/backups/{backup_id}`, that this file share has been restored from.
     },
   ],
   &quot;labels&quot;: { # Resource labels to represent user provided metadata.
     &quot;a_key&quot;: &quot;A String&quot;,
   },
-  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the instance, in the format projects/{project_id}/locations/{location_id}/instances/{instance_id}.
+  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the instance, in the format `projects/{project_id}/locations/{location_id}/instances/{instance_id}`.
   &quot;networks&quot;: [ # VPC networks to which the instance is connected. For this version, only a single network is supported.
     { # Network configuration for the instance.
       &quot;connectMode&quot;: &quot;A String&quot;, # The network connect mode of the Filestore instance. If not provided, the connect mode defaults to DIRECT_PEERING.
-      &quot;ipAddresses&quot;: [ # Output only. IPv4 addresses in the format {octet 1}.{octet 2}.{octet 3}.{octet 4} or IPv6 addresses in the format {block 1}:{block 2}:{block 3}:{block 4}:{block 5}:{block 6}:{block 7}:{block 8}.
+      &quot;ipAddresses&quot;: [ # Output only. IPv4 addresses in the format `{octet1}.{octet2}.{octet3}.{octet4}` or IPv6 addresses in the format `{block1}:{block2}:{block3}:{block4}:{block5}:{block6}:{block7}:{block8}`.
         &quot;A String&quot;,
       ],
       &quot;modes&quot;: [ # Internet protocol versions for which the instance has IP addresses assigned. For this version, only MODE_IPV4 is supported.
         &quot;A String&quot;,
       ],
-      &quot;network&quot;: &quot;A String&quot;, # The name of the Google Compute Engine [VPC network](/compute/docs/networks-and-firewalls#networks) to which the instance is connected.
-      &quot;reservedIpRange&quot;: &quot;A String&quot;, # Optional, reserved_ip_range can have one of the following two types of values. * CIDR range value when using DIRECT_PEERING connect mode. * [Allocated IP address range](https://cloud.google.com/compute/docs/ip-addresses/reserve-static-internal-ip-address) when using PRIVATE_SERVICE_ACCESS connect mode. When the name of an allocated IP address range is specified, it must be one of the ranges associated with the private service access connection. When specified as a direct CIDR value, it must be a /29 CIDR block for Basic tier or a /23 CIDR block for High Scale or Enterprise tier in one of the [internal IP address ranges](https://www.arin.net/knowledge/address_filters.html) that identifies the range of IP addresses reserved for this instance. For example, 10.0.0.0/29 or 192.168.0.0/23. The range you specify can&#x27;t overlap with either existing subnets or assigned IP address ranges for other Cloud Filestore instances in the selected VPC network.
+      &quot;network&quot;: &quot;A String&quot;, # The name of the Google Compute Engine [VPC network](https://cloud.google.com/vpc/docs/vpc) to which the instance is connected.
+      &quot;reservedIpRange&quot;: &quot;A String&quot;, # Optional, reserved_ip_range can have one of the following two types of values. * CIDR range value when using DIRECT_PEERING connect mode. * [Allocated IP address range](https://cloud.google.com/compute/docs/ip-addresses/reserve-static-internal-ip-address) when using PRIVATE_SERVICE_ACCESS connect mode. When the name of an allocated IP address range is specified, it must be one of the ranges associated with the private service access connection. When specified as a direct CIDR value, it must be a /29 CIDR block for Basic tier or a /24 CIDR block for High Scale or Enterprise tier in one of the [internal IP address ranges](https://www.arin.net/reference/research/statistics/address_filters/) that identifies the range of IP addresses reserved for this instance. For example, 10.0.0.0/29 or 192.168.0.0/24. The range you specify can&#x27;t overlap with either existing subnets or assigned IP address ranges for other Cloud Filestore instances in the selected VPC network.
     },
   ],
   &quot;satisfiesPzs&quot;: True or False, # Output only. Reserved for future use.
@@ -198,7 +198,7 @@
   <pre>Deletes an instance.
 
 Args:
-  name: string, Required. The instance resource name, in the format projects/{project_id}/locations/{location}/instances/{instance_id} (required)
+  name: string, Required. The instance resource name, in the format `projects/{project_id}/locations/{location}/instances/{instance_id}` (required)
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
@@ -233,7 +233,7 @@
   <pre>Gets the details of a specific instance.
 
 Args:
-  name: string, Required. The instance resource name, in the format projects/{project_id}/locations/{location}/instances/{instance_id}. (required)
+  name: string, Required. The instance resource name, in the format `projects/{project_id}/locations/{location}/instances/{instance_id}`. (required)
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
@@ -255,30 +255,30 @@
           &quot;accessMode&quot;: &quot;A String&quot;, # Either READ_ONLY, for allowing only read requests on the exported directory, or READ_WRITE, for allowing both read and write requests. The default is READ_WRITE.
           &quot;anonGid&quot;: &quot;A String&quot;, # An integer representing the anonymous group id with a default value of 65534. Anon_gid may only be set with squash_mode of ROOT_SQUASH. An error will be returned if this field is specified for other squash_mode settings.
           &quot;anonUid&quot;: &quot;A String&quot;, # An integer representing the anonymous user id with a default value of 65534. Anon_uid may only be set with squash_mode of ROOT_SQUASH. An error will be returned if this field is specified for other squash_mode settings.
-          &quot;ipRanges&quot;: [ # List of either an IPv4 addresses in the format {octet 1}.{octet 2}.{octet 3}.{octet 4} or CIDR ranges in the format {octet 1}.{octet 2}.{octet 3}.{octet 4}/{mask size} which may mount the file share. Overlapping IP ranges are not allowed, both within and across NfsExportOptions. An error will be returned. The limit is 64 IP ranges/addresses for each FileShareConfig among all NfsExportOptions.
+          &quot;ipRanges&quot;: [ # List of either an IPv4 addresses in the format `{octet1}.{octet2}.{octet3}.{octet4}` or CIDR ranges in the format `{octet1}.{octet2}.{octet3}.{octet4}/{mask size}` which may mount the file share. Overlapping IP ranges are not allowed, both within and across NfsExportOptions. An error will be returned. The limit is 64 IP ranges/addresses for each FileShareConfig among all NfsExportOptions.
             &quot;A String&quot;,
           ],
           &quot;squashMode&quot;: &quot;A String&quot;, # Either NO_ROOT_SQUASH, for allowing root access on the exported directory, or ROOT_SQUASH, for not allowing root access. The default is NO_ROOT_SQUASH.
         },
       ],
-      &quot;sourceBackup&quot;: &quot;A String&quot;, # The resource name of the backup, in the format projects/{project_id}/locations/{location_id}/backups/{backup_id}, that this file share has been restored from.
+      &quot;sourceBackup&quot;: &quot;A String&quot;, # The resource name of the backup, in the format `projects/{project_id}/locations/{location_id}/backups/{backup_id}`, that this file share has been restored from.
     },
   ],
   &quot;labels&quot;: { # Resource labels to represent user provided metadata.
     &quot;a_key&quot;: &quot;A String&quot;,
   },
-  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the instance, in the format projects/{project_id}/locations/{location_id}/instances/{instance_id}.
+  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the instance, in the format `projects/{project_id}/locations/{location_id}/instances/{instance_id}`.
   &quot;networks&quot;: [ # VPC networks to which the instance is connected. For this version, only a single network is supported.
     { # Network configuration for the instance.
       &quot;connectMode&quot;: &quot;A String&quot;, # The network connect mode of the Filestore instance. If not provided, the connect mode defaults to DIRECT_PEERING.
-      &quot;ipAddresses&quot;: [ # Output only. IPv4 addresses in the format {octet 1}.{octet 2}.{octet 3}.{octet 4} or IPv6 addresses in the format {block 1}:{block 2}:{block 3}:{block 4}:{block 5}:{block 6}:{block 7}:{block 8}.
+      &quot;ipAddresses&quot;: [ # Output only. IPv4 addresses in the format `{octet1}.{octet2}.{octet3}.{octet4}` or IPv6 addresses in the format `{block1}:{block2}:{block3}:{block4}:{block5}:{block6}:{block7}:{block8}`.
         &quot;A String&quot;,
       ],
       &quot;modes&quot;: [ # Internet protocol versions for which the instance has IP addresses assigned. For this version, only MODE_IPV4 is supported.
         &quot;A String&quot;,
       ],
-      &quot;network&quot;: &quot;A String&quot;, # The name of the Google Compute Engine [VPC network](/compute/docs/networks-and-firewalls#networks) to which the instance is connected.
-      &quot;reservedIpRange&quot;: &quot;A String&quot;, # Optional, reserved_ip_range can have one of the following two types of values. * CIDR range value when using DIRECT_PEERING connect mode. * [Allocated IP address range](https://cloud.google.com/compute/docs/ip-addresses/reserve-static-internal-ip-address) when using PRIVATE_SERVICE_ACCESS connect mode. When the name of an allocated IP address range is specified, it must be one of the ranges associated with the private service access connection. When specified as a direct CIDR value, it must be a /29 CIDR block for Basic tier or a /23 CIDR block for High Scale or Enterprise tier in one of the [internal IP address ranges](https://www.arin.net/knowledge/address_filters.html) that identifies the range of IP addresses reserved for this instance. For example, 10.0.0.0/29 or 192.168.0.0/23. The range you specify can&#x27;t overlap with either existing subnets or assigned IP address ranges for other Cloud Filestore instances in the selected VPC network.
+      &quot;network&quot;: &quot;A String&quot;, # The name of the Google Compute Engine [VPC network](https://cloud.google.com/vpc/docs/vpc) to which the instance is connected.
+      &quot;reservedIpRange&quot;: &quot;A String&quot;, # Optional, reserved_ip_range can have one of the following two types of values. * CIDR range value when using DIRECT_PEERING connect mode. * [Allocated IP address range](https://cloud.google.com/compute/docs/ip-addresses/reserve-static-internal-ip-address) when using PRIVATE_SERVICE_ACCESS connect mode. When the name of an allocated IP address range is specified, it must be one of the ranges associated with the private service access connection. When specified as a direct CIDR value, it must be a /29 CIDR block for Basic tier or a /24 CIDR block for High Scale or Enterprise tier in one of the [internal IP address ranges](https://www.arin.net/reference/research/statistics/address_filters/) that identifies the range of IP addresses reserved for this instance. For example, 10.0.0.0/29 or 192.168.0.0/24. The range you specify can&#x27;t overlap with either existing subnets or assigned IP address ranges for other Cloud Filestore instances in the selected VPC network.
     },
   ],
   &quot;satisfiesPzs&quot;: True or False, # Output only. Reserved for future use.
@@ -293,7 +293,7 @@
   <pre>Lists all instances in a project for either a specified location or for all locations.
 
 Args:
-  parent: string, Required. The project and location for which to retrieve instance information, in the format projects/{project_id}/locations/{location}. In Cloud Filestore, locations map to GCP zones, for example **us-west1-b**. To retrieve instance information for all locations, use &quot;-&quot; for the {location} value. (required)
+  parent: string, Required. The project and location for which to retrieve instance information, in the format `projects/{project_id}/locations/{location}`. In Cloud Filestore, locations map to GCP zones, for example **us-west1-b**. To retrieve instance information for all locations, use &quot;-&quot; for the `{location}` value. (required)
   filter: string, List filter.
   orderBy: string, Sort results. Supported values are &quot;name&quot;, &quot;name desc&quot; or &quot;&quot; (unsorted).
   pageSize: integer, The maximum number of items to return.
@@ -307,7 +307,7 @@
   An object of the form:
 
     { # ListInstancesResponse is the result of ListInstancesRequest.
-  &quot;instances&quot;: [ # A list of instances in the project for the specified location. If the {location} value in the request is &quot;-&quot;, the response contains a list of instances from all locations. If any location is unreachable, the response will only return instances in reachable locations and the &quot;unreachable&quot; field will be populated with a list of unreachable locations.
+  &quot;instances&quot;: [ # A list of instances in the project for the specified location. If the `{location}` value in the request is &quot;-&quot;, the response contains a list of instances from all locations. If any location is unreachable, the response will only return instances in reachable locations and the &quot;unreachable&quot; field will be populated with a list of unreachable locations.
     { # A Cloud Filestore instance.
       &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time when the instance was created.
       &quot;description&quot;: &quot;A String&quot;, # The description of the instance (2048 characters or less).
@@ -321,30 +321,30 @@
               &quot;accessMode&quot;: &quot;A String&quot;, # Either READ_ONLY, for allowing only read requests on the exported directory, or READ_WRITE, for allowing both read and write requests. The default is READ_WRITE.
               &quot;anonGid&quot;: &quot;A String&quot;, # An integer representing the anonymous group id with a default value of 65534. Anon_gid may only be set with squash_mode of ROOT_SQUASH. An error will be returned if this field is specified for other squash_mode settings.
               &quot;anonUid&quot;: &quot;A String&quot;, # An integer representing the anonymous user id with a default value of 65534. Anon_uid may only be set with squash_mode of ROOT_SQUASH. An error will be returned if this field is specified for other squash_mode settings.
-              &quot;ipRanges&quot;: [ # List of either an IPv4 addresses in the format {octet 1}.{octet 2}.{octet 3}.{octet 4} or CIDR ranges in the format {octet 1}.{octet 2}.{octet 3}.{octet 4}/{mask size} which may mount the file share. Overlapping IP ranges are not allowed, both within and across NfsExportOptions. An error will be returned. The limit is 64 IP ranges/addresses for each FileShareConfig among all NfsExportOptions.
+              &quot;ipRanges&quot;: [ # List of either an IPv4 addresses in the format `{octet1}.{octet2}.{octet3}.{octet4}` or CIDR ranges in the format `{octet1}.{octet2}.{octet3}.{octet4}/{mask size}` which may mount the file share. Overlapping IP ranges are not allowed, both within and across NfsExportOptions. An error will be returned. The limit is 64 IP ranges/addresses for each FileShareConfig among all NfsExportOptions.
                 &quot;A String&quot;,
               ],
               &quot;squashMode&quot;: &quot;A String&quot;, # Either NO_ROOT_SQUASH, for allowing root access on the exported directory, or ROOT_SQUASH, for not allowing root access. The default is NO_ROOT_SQUASH.
             },
           ],
-          &quot;sourceBackup&quot;: &quot;A String&quot;, # The resource name of the backup, in the format projects/{project_id}/locations/{location_id}/backups/{backup_id}, that this file share has been restored from.
+          &quot;sourceBackup&quot;: &quot;A String&quot;, # The resource name of the backup, in the format `projects/{project_id}/locations/{location_id}/backups/{backup_id}`, that this file share has been restored from.
         },
       ],
       &quot;labels&quot;: { # Resource labels to represent user provided metadata.
         &quot;a_key&quot;: &quot;A String&quot;,
       },
-      &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the instance, in the format projects/{project_id}/locations/{location_id}/instances/{instance_id}.
+      &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the instance, in the format `projects/{project_id}/locations/{location_id}/instances/{instance_id}`.
       &quot;networks&quot;: [ # VPC networks to which the instance is connected. For this version, only a single network is supported.
         { # Network configuration for the instance.
           &quot;connectMode&quot;: &quot;A String&quot;, # The network connect mode of the Filestore instance. If not provided, the connect mode defaults to DIRECT_PEERING.
-          &quot;ipAddresses&quot;: [ # Output only. IPv4 addresses in the format {octet 1}.{octet 2}.{octet 3}.{octet 4} or IPv6 addresses in the format {block 1}:{block 2}:{block 3}:{block 4}:{block 5}:{block 6}:{block 7}:{block 8}.
+          &quot;ipAddresses&quot;: [ # Output only. IPv4 addresses in the format `{octet1}.{octet2}.{octet3}.{octet4}` or IPv6 addresses in the format `{block1}:{block2}:{block3}:{block4}:{block5}:{block6}:{block7}:{block8}`.
             &quot;A String&quot;,
           ],
           &quot;modes&quot;: [ # Internet protocol versions for which the instance has IP addresses assigned. For this version, only MODE_IPV4 is supported.
             &quot;A String&quot;,
           ],
-          &quot;network&quot;: &quot;A String&quot;, # The name of the Google Compute Engine [VPC network](/compute/docs/networks-and-firewalls#networks) to which the instance is connected.
-          &quot;reservedIpRange&quot;: &quot;A String&quot;, # Optional, reserved_ip_range can have one of the following two types of values. * CIDR range value when using DIRECT_PEERING connect mode. * [Allocated IP address range](https://cloud.google.com/compute/docs/ip-addresses/reserve-static-internal-ip-address) when using PRIVATE_SERVICE_ACCESS connect mode. When the name of an allocated IP address range is specified, it must be one of the ranges associated with the private service access connection. When specified as a direct CIDR value, it must be a /29 CIDR block for Basic tier or a /23 CIDR block for High Scale or Enterprise tier in one of the [internal IP address ranges](https://www.arin.net/knowledge/address_filters.html) that identifies the range of IP addresses reserved for this instance. For example, 10.0.0.0/29 or 192.168.0.0/23. The range you specify can&#x27;t overlap with either existing subnets or assigned IP address ranges for other Cloud Filestore instances in the selected VPC network.
+          &quot;network&quot;: &quot;A String&quot;, # The name of the Google Compute Engine [VPC network](https://cloud.google.com/vpc/docs/vpc) to which the instance is connected.
+          &quot;reservedIpRange&quot;: &quot;A String&quot;, # Optional, reserved_ip_range can have one of the following two types of values. * CIDR range value when using DIRECT_PEERING connect mode. * [Allocated IP address range](https://cloud.google.com/compute/docs/ip-addresses/reserve-static-internal-ip-address) when using PRIVATE_SERVICE_ACCESS connect mode. When the name of an allocated IP address range is specified, it must be one of the ranges associated with the private service access connection. When specified as a direct CIDR value, it must be a /29 CIDR block for Basic tier or a /24 CIDR block for High Scale or Enterprise tier in one of the [internal IP address ranges](https://www.arin.net/reference/research/statistics/address_filters/) that identifies the range of IP addresses reserved for this instance. For example, 10.0.0.0/29 or 192.168.0.0/24. The range you specify can&#x27;t overlap with either existing subnets or assigned IP address ranges for other Cloud Filestore instances in the selected VPC network.
         },
       ],
       &quot;satisfiesPzs&quot;: True or False, # Output only. Reserved for future use.
@@ -379,7 +379,7 @@
   <pre>Updates the settings of a specific instance.
 
 Args:
-  name: string, Output only. The resource name of the instance, in the format projects/{project_id}/locations/{location_id}/instances/{instance_id}. (required)
+  name: string, Output only. The resource name of the instance, in the format `projects/{project_id}/locations/{location_id}/instances/{instance_id}`. (required)
   body: object, The request body.
     The object takes the form of:
 
@@ -396,30 +396,30 @@
           &quot;accessMode&quot;: &quot;A String&quot;, # Either READ_ONLY, for allowing only read requests on the exported directory, or READ_WRITE, for allowing both read and write requests. The default is READ_WRITE.
           &quot;anonGid&quot;: &quot;A String&quot;, # An integer representing the anonymous group id with a default value of 65534. Anon_gid may only be set with squash_mode of ROOT_SQUASH. An error will be returned if this field is specified for other squash_mode settings.
           &quot;anonUid&quot;: &quot;A String&quot;, # An integer representing the anonymous user id with a default value of 65534. Anon_uid may only be set with squash_mode of ROOT_SQUASH. An error will be returned if this field is specified for other squash_mode settings.
-          &quot;ipRanges&quot;: [ # List of either an IPv4 addresses in the format {octet 1}.{octet 2}.{octet 3}.{octet 4} or CIDR ranges in the format {octet 1}.{octet 2}.{octet 3}.{octet 4}/{mask size} which may mount the file share. Overlapping IP ranges are not allowed, both within and across NfsExportOptions. An error will be returned. The limit is 64 IP ranges/addresses for each FileShareConfig among all NfsExportOptions.
+          &quot;ipRanges&quot;: [ # List of either an IPv4 addresses in the format `{octet1}.{octet2}.{octet3}.{octet4}` or CIDR ranges in the format `{octet1}.{octet2}.{octet3}.{octet4}/{mask size}` which may mount the file share. Overlapping IP ranges are not allowed, both within and across NfsExportOptions. An error will be returned. The limit is 64 IP ranges/addresses for each FileShareConfig among all NfsExportOptions.
             &quot;A String&quot;,
           ],
           &quot;squashMode&quot;: &quot;A String&quot;, # Either NO_ROOT_SQUASH, for allowing root access on the exported directory, or ROOT_SQUASH, for not allowing root access. The default is NO_ROOT_SQUASH.
         },
       ],
-      &quot;sourceBackup&quot;: &quot;A String&quot;, # The resource name of the backup, in the format projects/{project_id}/locations/{location_id}/backups/{backup_id}, that this file share has been restored from.
+      &quot;sourceBackup&quot;: &quot;A String&quot;, # The resource name of the backup, in the format `projects/{project_id}/locations/{location_id}/backups/{backup_id}`, that this file share has been restored from.
     },
   ],
   &quot;labels&quot;: { # Resource labels to represent user provided metadata.
     &quot;a_key&quot;: &quot;A String&quot;,
   },
-  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the instance, in the format projects/{project_id}/locations/{location_id}/instances/{instance_id}.
+  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the instance, in the format `projects/{project_id}/locations/{location_id}/instances/{instance_id}`.
   &quot;networks&quot;: [ # VPC networks to which the instance is connected. For this version, only a single network is supported.
     { # Network configuration for the instance.
       &quot;connectMode&quot;: &quot;A String&quot;, # The network connect mode of the Filestore instance. If not provided, the connect mode defaults to DIRECT_PEERING.
-      &quot;ipAddresses&quot;: [ # Output only. IPv4 addresses in the format {octet 1}.{octet 2}.{octet 3}.{octet 4} or IPv6 addresses in the format {block 1}:{block 2}:{block 3}:{block 4}:{block 5}:{block 6}:{block 7}:{block 8}.
+      &quot;ipAddresses&quot;: [ # Output only. IPv4 addresses in the format `{octet1}.{octet2}.{octet3}.{octet4}` or IPv6 addresses in the format `{block1}:{block2}:{block3}:{block4}:{block5}:{block6}:{block7}:{block8}`.
         &quot;A String&quot;,
       ],
       &quot;modes&quot;: [ # Internet protocol versions for which the instance has IP addresses assigned. For this version, only MODE_IPV4 is supported.
         &quot;A String&quot;,
       ],
-      &quot;network&quot;: &quot;A String&quot;, # The name of the Google Compute Engine [VPC network](/compute/docs/networks-and-firewalls#networks) to which the instance is connected.
-      &quot;reservedIpRange&quot;: &quot;A String&quot;, # Optional, reserved_ip_range can have one of the following two types of values. * CIDR range value when using DIRECT_PEERING connect mode. * [Allocated IP address range](https://cloud.google.com/compute/docs/ip-addresses/reserve-static-internal-ip-address) when using PRIVATE_SERVICE_ACCESS connect mode. When the name of an allocated IP address range is specified, it must be one of the ranges associated with the private service access connection. When specified as a direct CIDR value, it must be a /29 CIDR block for Basic tier or a /23 CIDR block for High Scale or Enterprise tier in one of the [internal IP address ranges](https://www.arin.net/knowledge/address_filters.html) that identifies the range of IP addresses reserved for this instance. For example, 10.0.0.0/29 or 192.168.0.0/23. The range you specify can&#x27;t overlap with either existing subnets or assigned IP address ranges for other Cloud Filestore instances in the selected VPC network.
+      &quot;network&quot;: &quot;A String&quot;, # The name of the Google Compute Engine [VPC network](https://cloud.google.com/vpc/docs/vpc) to which the instance is connected.
+      &quot;reservedIpRange&quot;: &quot;A String&quot;, # Optional, reserved_ip_range can have one of the following two types of values. * CIDR range value when using DIRECT_PEERING connect mode. * [Allocated IP address range](https://cloud.google.com/compute/docs/ip-addresses/reserve-static-internal-ip-address) when using PRIVATE_SERVICE_ACCESS connect mode. When the name of an allocated IP address range is specified, it must be one of the ranges associated with the private service access connection. When specified as a direct CIDR value, it must be a /29 CIDR block for Basic tier or a /24 CIDR block for High Scale or Enterprise tier in one of the [internal IP address ranges](https://www.arin.net/reference/research/statistics/address_filters/) that identifies the range of IP addresses reserved for this instance. For example, 10.0.0.0/29 or 192.168.0.0/24. The range you specify can&#x27;t overlap with either existing subnets or assigned IP address ranges for other Cloud Filestore instances in the selected VPC network.
     },
   ],
   &quot;satisfiesPzs&quot;: True or False, # Output only. Reserved for future use.
@@ -463,14 +463,14 @@
   <pre>Restores an existing instance&#x27;s file share from a backup. The capacity of the instance needs to be equal to or larger than the capacity of the backup (and also equal to or larger than the minimum capacity of the tier).
 
 Args:
-  name: string, Required. The resource name of the instance, in the format projects/{project_id}/locations/{location_id}/instances/{instance_id}. (required)
+  name: string, Required. The resource name of the instance, in the format `projects/{project_id}/locations/{location_id}/instances/{instance_id}`. (required)
   body: object, The request body.
     The object takes the form of:
 
 { # RestoreInstanceRequest restores an existing instances&#x27;s file share from a snapshot or backup.
   &quot;fileShare&quot;: &quot;A String&quot;, # Required. Name of the file share in the Cloud Filestore instance that the snapshot is being restored to.
-  &quot;sourceBackup&quot;: &quot;A String&quot;, # The resource name of the backup, in the format projects/{project_id}/locations/{location_id}/backups/{backup_id}.
-  &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The resource name of the snapshot, in the format projects/{project_id}/locations/{location_id}/snapshots/{snapshot_id}.
+  &quot;sourceBackup&quot;: &quot;A String&quot;, # The resource name of the backup, in the format `projects/{project_id}/locations/{location_id}/backups/{backup_id}`.
+  &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The resource name of the snapshot, in the format `projects/{project_id}/locations/{location_id}/snapshots/{snapshot_id}`.
 }
 
   x__xgafv: string, V1 error format.

docs/dyn/file_v1beta1.projects.locations.instances.snapshots.html

diff --git a/docs/dyn/file_v1beta1.projects.locations.instances.snapshots.html b/docs/dyn/file_v1beta1.projects.locations.instances.snapshots.html
index 9d0459f..bce4da8 100644
--- a/docs/dyn/file_v1beta1.projects.locations.instances.snapshots.html
+++ b/docs/dyn/file_v1beta1.projects.locations.instances.snapshots.html
@@ -106,7 +106,7 @@
   <pre>Creates a snapshot.
 
 Args:
-  parent: string, Required. The Filestore Instance to create the snapshots of, in the format projects/{project_id}/locations/{location}/instances/{instance_id} (required)
+  parent: string, Required. The Filestore Instance to create the snapshots of, in the format `projects/{project_id}/locations/{location}/instances/{instance_id}` (required)
   body: object, The request body.
     The object takes the form of:
 
@@ -117,7 +117,7 @@
   &quot;labels&quot;: { # Resource labels to represent user provided metadata.
     &quot;a_key&quot;: &quot;A String&quot;,
   },
-  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the snapshot, in the format projects/{project_id}/locations/{location_id}/instances/{instance_id}/snapshots/{snapshot_id}.
+  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the snapshot, in the format `projects/{project_id}/locations/{location_id}/instances/{instance_id}/snapshots/{snapshot_id}`.
   &quot;state&quot;: &quot;A String&quot;, # Output only. The snapshot state.
 }
 
@@ -156,7 +156,7 @@
   <pre>Deletes a snapshot.
 
 Args:
-  name: string, Required. The snapshot resource name, in the format projects/{project_id}/locations/{location}/instances/{instance_id}/snapshots/{snapshot_id} (required)
+  name: string, Required. The snapshot resource name, in the format `projects/{project_id}/locations/{location}/instances/{instance_id}/snapshots/{snapshot_id}` (required)
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
@@ -191,7 +191,7 @@
   <pre>Gets the details of a specific snapshot.
 
 Args:
-  name: string, Required. The snapshot resource name, in the format projects/{project_id}/locations/{location}/instances/{instance_id}/snapshots/{snapshot_id} (required)
+  name: string, Required. The snapshot resource name, in the format `projects/{project_id}/locations/{location}/instances/{instance_id}/snapshots/{snapshot_id}` (required)
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
@@ -207,7 +207,7 @@
   &quot;labels&quot;: { # Resource labels to represent user provided metadata.
     &quot;a_key&quot;: &quot;A String&quot;,
   },
-  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the snapshot, in the format projects/{project_id}/locations/{location_id}/instances/{instance_id}/snapshots/{snapshot_id}.
+  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the snapshot, in the format `projects/{project_id}/locations/{location_id}/instances/{instance_id}/snapshots/{snapshot_id}`.
   &quot;state&quot;: &quot;A String&quot;, # Output only. The snapshot state.
 }</pre>
 </div>
@@ -217,7 +217,7 @@
   <pre>Lists all snapshots in a project for either a specified location or for all locations.
 
 Args:
-  parent: string, Required. The instance for which to retrieve snapshot information, in the format projects/{project_id}/locations/{location}/instances/{instance_id}. (required)
+  parent: string, Required. The instance for which to retrieve snapshot information, in the format `projects/{project_id}/locations/{location}/instances/{instance_id}`. (required)
   filter: string, List filter.
   orderBy: string, Sort results. Supported values are &quot;name&quot;, &quot;name desc&quot; or &quot;&quot; (unsorted).
   pageSize: integer, The maximum number of items to return.
@@ -240,7 +240,7 @@
       &quot;labels&quot;: { # Resource labels to represent user provided metadata.
         &quot;a_key&quot;: &quot;A String&quot;,
       },
-      &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the snapshot, in the format projects/{project_id}/locations/{location_id}/instances/{instance_id}/snapshots/{snapshot_id}.
+      &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the snapshot, in the format `projects/{project_id}/locations/{location_id}/instances/{instance_id}/snapshots/{snapshot_id}`.
       &quot;state&quot;: &quot;A String&quot;, # Output only. The snapshot state.
     },
   ],
@@ -266,7 +266,7 @@
   <pre>Updates the settings of a specific snapshot.
 
 Args:
-  name: string, Output only. The resource name of the snapshot, in the format projects/{project_id}/locations/{location_id}/instances/{instance_id}/snapshots/{snapshot_id}. (required)
+  name: string, Output only. The resource name of the snapshot, in the format `projects/{project_id}/locations/{location_id}/instances/{instance_id}/snapshots/{snapshot_id}`. (required)
   body: object, The request body.
     The object takes the form of:
 
@@ -277,7 +277,7 @@
   &quot;labels&quot;: { # Resource labels to represent user provided metadata.
     &quot;a_key&quot;: &quot;A String&quot;,
   },
-  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the snapshot, in the format projects/{project_id}/locations/{location_id}/instances/{instance_id}/snapshots/{snapshot_id}.
+  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the snapshot, in the format `projects/{project_id}/locations/{location_id}/instances/{instance_id}/snapshots/{snapshot_id}`.
   &quot;state&quot;: &quot;A String&quot;, # Output only. The snapshot state.
 }
 

docs/dyn/firebaserules_v1.projects.releases.html

diff --git a/docs/dyn/firebaserules_v1.projects.releases.html b/docs/dyn/firebaserules_v1.projects.releases.html
index 50a3ac1..72e785a 100644
--- a/docs/dyn/firebaserules_v1.projects.releases.html
+++ b/docs/dyn/firebaserules_v1.projects.releases.html
@@ -79,7 +79,7 @@
 <p class="firstline">Close httplib2 connections.</p>
 <p class="toc_element">
   <code><a href="#create">create(name, body=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Create a `Release`. Release names should reflect the developer's deployment practices. For example, the release name may include the environment name, application name, application version, or any other name meaningful to the developer. Once a `Release` refers to a `Ruleset`, the rules can be enforced by Firebase Rules-enabled services. More than one `Release` may be 'live' concurrently. Consider the following three `Release` names for `projects/foo` and the `Ruleset` to which they refer. Release Name | Ruleset Name --------------------------------|------------- projects/foo/releases/prod | projects/foo/rulesets/uuid123 projects/foo/releases/prod/beta | projects/foo/rulesets/uuid123 projects/foo/releases/prod/v23 | projects/foo/rulesets/uuid456 The table reflects the `Ruleset` rollout in progress. The `prod` and `prod/beta` releases refer to the same `Ruleset`. However, `prod/v23` refers to a new `Ruleset`. The `Ruleset` reference for a `Release` may be updated using the UpdateRelease method.</p>
+<p class="firstline">Create a `Release`. Release names should reflect the developer's deployment practices. For example, the release name may include the environment name, application name, application version, or any other name meaningful to the developer. Once a `Release` refers to a `Ruleset`, the rules can be enforced by Firebase Rules-enabled services. More than one `Release` may be 'live' concurrently. Consider the following three `Release` names for `projects/foo` and the `Ruleset` to which they refer. Release Name -> Ruleset Name * projects/foo/releases/prod -> projects/foo/rulesets/uuid123 * projects/foo/releases/prod/beta -> projects/foo/rulesets/uuid123 * projects/foo/releases/prod/v23 -> projects/foo/rulesets/uuid456 The relationships reflect a `Ruleset` rollout in progress. The `prod` and `prod/beta` releases refer to the same `Ruleset`. However, `prod/v23` refers to a new `Ruleset`. The `Ruleset` reference for a `Release` may be updated using the UpdateRelease method.</p>
 <p class="toc_element">
   <code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>
 <p class="firstline">Delete a `Release` by resource name.</p>
@@ -106,7 +106,7 @@
 
 <div class="method">
     <code class="details" id="create">create(name, body=None, x__xgafv=None)</code>
-  <pre>Create a `Release`. Release names should reflect the developer&#x27;s deployment practices. For example, the release name may include the environment name, application name, application version, or any other name meaningful to the developer. Once a `Release` refers to a `Ruleset`, the rules can be enforced by Firebase Rules-enabled services. More than one `Release` may be &#x27;live&#x27; concurrently. Consider the following three `Release` names for `projects/foo` and the `Ruleset` to which they refer. Release Name | Ruleset Name --------------------------------|------------- projects/foo/releases/prod | projects/foo/rulesets/uuid123 projects/foo/releases/prod/beta | projects/foo/rulesets/uuid123 projects/foo/releases/prod/v23 | projects/foo/rulesets/uuid456 The table reflects the `Ruleset` rollout in progress. The `prod` and `prod/beta` releases refer to the same `Ruleset`. However, `prod/v23` refers to a new `Ruleset`. The `Ruleset` reference for a `Release` may be updated using the UpdateRelease method.
+  <pre>Create a `Release`. Release names should reflect the developer&#x27;s deployment practices. For example, the release name may include the environment name, application name, application version, or any other name meaningful to the developer. Once a `Release` refers to a `Ruleset`, the rules can be enforced by Firebase Rules-enabled services. More than one `Release` may be &#x27;live&#x27; concurrently. Consider the following three `Release` names for `projects/foo` and the `Ruleset` to which they refer. Release Name -&gt; Ruleset Name * projects/foo/releases/prod -&gt; projects/foo/rulesets/uuid123 * projects/foo/releases/prod/beta -&gt; projects/foo/rulesets/uuid123 * projects/foo/releases/prod/v23 -&gt; projects/foo/rulesets/uuid456 The relationships reflect a `Ruleset` rollout in progress. The `prod` and `prod/beta` releases refer to the same `Ruleset`. However, `prod/v23` refers to a new `Ruleset`. The `Ruleset` reference for a `Release` may be updated using the UpdateRelease method.
 
 Args:
   name: string, Required. Resource name for the project which owns this `Release`. Format: `projects/{project_id}` (required)

docs/dyn/firestore_v1.projects.databases.documents.html

diff --git a/docs/dyn/firestore_v1.projects.databases.documents.html b/docs/dyn/firestore_v1.projects.databases.documents.html
index 5887319..02464f5 100644
--- a/docs/dyn/firestore_v1.projects.databases.documents.html
+++ b/docs/dyn/firestore_v1.projects.databases.documents.html
@@ -175,7 +175,11 @@
     "createTime": "A String", # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
     "fields": { # The document's fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `"foo" : { map_value: { "x&y" : { string_value: "hello" }}}` would be represented by the field path `foo.x&y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&y` `` represents `x&y` and `` `bak\`tik` `` represents `` bak`tik ``.
       "a_key": { # A message that can hold any of the supported value types.
-        "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+        "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "values": [ # Values in the array.
+            # Object with schema name: Value
+          ],
+        },
         "booleanValue": True or False, # A boolean value.
         "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
         "doubleValue": 3.14, # A double value.
@@ -230,31 +234,16 @@
           { # A transformation of a field of the document.
             "appendMissingElements": { # An array value. # Append the given elements in order if they are not already present in the current field value. If the field is not an array, or if the field does not yet exist, it is first set to the empty array. Equivalent numbers of different types (e.g. 3L and 3.0) are considered equal when checking if a value is missing. NaN is equal to NaN, and Null is equal to Null. If the input contains multiple equivalent values, only the first will be considered. The corresponding transform_result will be the null value.
               "values": [ # Values in the array.
-                { # A message that can hold any of the supported value types.
-                  "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                  "booleanValue": True or False, # A boolean value.
-                  "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                  "doubleValue": 3.14, # A double value.
-                  "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                    "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                    "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                  },
-                  "integerValue": "A String", # An integer value.
-                  "mapValue": { # A map value. # A map value.
-                    "fields": { # The map's fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                      "a_key": # Object with schema name: Value
-                    },
-                  },
-                  "nullValue": "A String", # A null value.
-                  "referenceValue": "A String", # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                  "stringValue": "A String", # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                  "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-                },
+                # Object with schema name: Value
               ],
             },
             "fieldPath": "A String", # The path of the field. See Document.fields for the field path syntax reference.
             "increment": { # A message that can hold any of the supported value types. # Adds the given value to the field's current value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If either of the given value or the current field value are doubles, both values will be interpreted as doubles. Double arithmetic and representation of double values follow IEEE 754 semantics. If there is positive/negative integer overflow, the field is resolved to the largest magnitude positive/negative integer.
-              "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                "values": [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               "booleanValue": True or False, # A boolean value.
               "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               "doubleValue": 3.14, # A double value.
@@ -274,7 +263,11 @@
               "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
             },
             "maximum": { # A message that can hold any of the supported value types. # Sets the field to the maximum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If a maximum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the larger operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The maximum of a zero stored value and zero input value is always the stored value. The maximum of any numeric value x and NaN is NaN.
-              "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                "values": [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               "booleanValue": True or False, # A boolean value.
               "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               "doubleValue": 3.14, # A double value.
@@ -294,7 +287,11 @@
               "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
             },
             "minimum": { # A message that can hold any of the supported value types. # Sets the field to the minimum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the input value. If a minimum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the smaller operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The minimum of a zero stored value and zero input value is always the stored value. The minimum of any numeric value x and NaN is NaN.
-              "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                "values": [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               "booleanValue": True or False, # A boolean value.
               "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               "doubleValue": 3.14, # A double value.
@@ -315,26 +312,7 @@
             },
             "removeAllFromArray": { # An array value. # Remove all of the given elements from the array in the field. If the field is not an array, or if the field does not yet exist, it is set to the empty array. Equivalent numbers of the different types (e.g. 3L and 3.0) are considered equal when deciding whether an element should be removed. NaN is equal to NaN, and Null is equal to Null. This will remove all equivalent values if there are duplicates. The corresponding transform_result will be the null value.
               "values": [ # Values in the array.
-                { # A message that can hold any of the supported value types.
-                  "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                  "booleanValue": True or False, # A boolean value.
-                  "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                  "doubleValue": 3.14, # A double value.
-                  "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                    "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                    "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                  },
-                  "integerValue": "A String", # An integer value.
-                  "mapValue": { # A map value. # A map value.
-                    "fields": { # The map's fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                      "a_key": # Object with schema name: Value
-                    },
-                  },
-                  "nullValue": "A String", # A null value.
-                  "referenceValue": "A String", # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                  "stringValue": "A String", # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                  "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-                },
+                # Object with schema name: Value
               ],
             },
             "setToServerValue": "A String", # Sets the field to the given server value.
@@ -345,7 +323,11 @@
         "createTime": "A String", # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
         "fields": { # The document's fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `"foo" : { map_value: { "x&y" : { string_value: "hello" }}}` would be represented by the field path `foo.x&y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&y` `` represents `x&y` and `` `bak\`tik` `` represents `` bak`tik ``.
           "a_key": { # A message that can hold any of the supported value types.
-            "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "values": [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             "booleanValue": True or False, # A boolean value.
             "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             "doubleValue": 3.14, # A double value.
@@ -377,31 +359,16 @@
         { # A transformation of a field of the document.
           "appendMissingElements": { # An array value. # Append the given elements in order if they are not already present in the current field value. If the field is not an array, or if the field does not yet exist, it is first set to the empty array. Equivalent numbers of different types (e.g. 3L and 3.0) are considered equal when checking if a value is missing. NaN is equal to NaN, and Null is equal to Null. If the input contains multiple equivalent values, only the first will be considered. The corresponding transform_result will be the null value.
             "values": [ # Values in the array.
-              { # A message that can hold any of the supported value types.
-                "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                "booleanValue": True or False, # A boolean value.
-                "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                "doubleValue": 3.14, # A double value.
-                "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                  "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                  "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                },
-                "integerValue": "A String", # An integer value.
-                "mapValue": { # A map value. # A map value.
-                  "fields": { # The map's fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                    "a_key": # Object with schema name: Value
-                  },
-                },
-                "nullValue": "A String", # A null value.
-                "referenceValue": "A String", # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                "stringValue": "A String", # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-              },
+              # Object with schema name: Value
             ],
           },
           "fieldPath": "A String", # The path of the field. See Document.fields for the field path syntax reference.
           "increment": { # A message that can hold any of the supported value types. # Adds the given value to the field's current value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If either of the given value or the current field value are doubles, both values will be interpreted as doubles. Double arithmetic and representation of double values follow IEEE 754 semantics. If there is positive/negative integer overflow, the field is resolved to the largest magnitude positive/negative integer.
-            "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "values": [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             "booleanValue": True or False, # A boolean value.
             "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             "doubleValue": 3.14, # A double value.
@@ -421,7 +388,11 @@
             "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
           },
           "maximum": { # A message that can hold any of the supported value types. # Sets the field to the maximum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If a maximum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the larger operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The maximum of a zero stored value and zero input value is always the stored value. The maximum of any numeric value x and NaN is NaN.
-            "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "values": [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             "booleanValue": True or False, # A boolean value.
             "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             "doubleValue": 3.14, # A double value.
@@ -441,7 +412,11 @@
             "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
           },
           "minimum": { # A message that can hold any of the supported value types. # Sets the field to the minimum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the input value. If a minimum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the smaller operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The minimum of a zero stored value and zero input value is always the stored value. The minimum of any numeric value x and NaN is NaN.
-            "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "values": [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             "booleanValue": True or False, # A boolean value.
             "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             "doubleValue": 3.14, # A double value.
@@ -462,26 +437,7 @@
           },
           "removeAllFromArray": { # An array value. # Remove all of the given elements from the array in the field. If the field is not an array, or if the field does not yet exist, it is set to the empty array. Equivalent numbers of the different types (e.g. 3L and 3.0) are considered equal when deciding whether an element should be removed. NaN is equal to NaN, and Null is equal to Null. This will remove all equivalent values if there are duplicates. The corresponding transform_result will be the null value.
             "values": [ # Values in the array.
-              { # A message that can hold any of the supported value types.
-                "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                "booleanValue": True or False, # A boolean value.
-                "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                "doubleValue": 3.14, # A double value.
-                "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                  "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                  "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                },
-                "integerValue": "A String", # An integer value.
-                "mapValue": { # A map value. # A map value.
-                  "fields": { # The map's fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                    "a_key": # Object with schema name: Value
-                  },
-                },
-                "nullValue": "A String", # A null value.
-                "referenceValue": "A String", # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                "stringValue": "A String", # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-              },
+              # Object with schema name: Value
             ],
           },
           "setToServerValue": "A String", # Sets the field to the given server value.
@@ -515,7 +471,11 @@
     { # The result of applying a write.
       "transformResults": [ # The results of applying each DocumentTransform.FieldTransform, in the same order.
         { # A message that can hold any of the supported value types.
-          "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "values": [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           "booleanValue": True or False, # A boolean value.
           "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           "doubleValue": 3.14, # A double value.
@@ -603,31 +563,16 @@
           { # A transformation of a field of the document.
             "appendMissingElements": { # An array value. # Append the given elements in order if they are not already present in the current field value. If the field is not an array, or if the field does not yet exist, it is first set to the empty array. Equivalent numbers of different types (e.g. 3L and 3.0) are considered equal when checking if a value is missing. NaN is equal to NaN, and Null is equal to Null. If the input contains multiple equivalent values, only the first will be considered. The corresponding transform_result will be the null value.
               "values": [ # Values in the array.
-                { # A message that can hold any of the supported value types.
-                  "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                  "booleanValue": True or False, # A boolean value.
-                  "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                  "doubleValue": 3.14, # A double value.
-                  "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                    "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                    "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                  },
-                  "integerValue": "A String", # An integer value.
-                  "mapValue": { # A map value. # A map value.
-                    "fields": { # The map's fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                      "a_key": # Object with schema name: Value
-                    },
-                  },
-                  "nullValue": "A String", # A null value.
-                  "referenceValue": "A String", # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                  "stringValue": "A String", # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                  "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-                },
+                # Object with schema name: Value
               ],
             },
             "fieldPath": "A String", # The path of the field. See Document.fields for the field path syntax reference.
             "increment": { # A message that can hold any of the supported value types. # Adds the given value to the field's current value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If either of the given value or the current field value are doubles, both values will be interpreted as doubles. Double arithmetic and representation of double values follow IEEE 754 semantics. If there is positive/negative integer overflow, the field is resolved to the largest magnitude positive/negative integer.
-              "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                "values": [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               "booleanValue": True or False, # A boolean value.
               "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               "doubleValue": 3.14, # A double value.
@@ -647,7 +592,11 @@
               "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
             },
             "maximum": { # A message that can hold any of the supported value types. # Sets the field to the maximum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If a maximum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the larger operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The maximum of a zero stored value and zero input value is always the stored value. The maximum of any numeric value x and NaN is NaN.
-              "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                "values": [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               "booleanValue": True or False, # A boolean value.
               "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               "doubleValue": 3.14, # A double value.
@@ -667,7 +616,11 @@
               "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
             },
             "minimum": { # A message that can hold any of the supported value types. # Sets the field to the minimum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the input value. If a minimum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the smaller operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The minimum of a zero stored value and zero input value is always the stored value. The minimum of any numeric value x and NaN is NaN.
-              "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                "values": [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               "booleanValue": True or False, # A boolean value.
               "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               "doubleValue": 3.14, # A double value.
@@ -688,26 +641,7 @@
             },
             "removeAllFromArray": { # An array value. # Remove all of the given elements from the array in the field. If the field is not an array, or if the field does not yet exist, it is set to the empty array. Equivalent numbers of the different types (e.g. 3L and 3.0) are considered equal when deciding whether an element should be removed. NaN is equal to NaN, and Null is equal to Null. This will remove all equivalent values if there are duplicates. The corresponding transform_result will be the null value.
               "values": [ # Values in the array.
-                { # A message that can hold any of the supported value types.
-                  "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                  "booleanValue": True or False, # A boolean value.
-                  "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                  "doubleValue": 3.14, # A double value.
-                  "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                    "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                    "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                  },
-                  "integerValue": "A String", # An integer value.
-                  "mapValue": { # A map value. # A map value.
-                    "fields": { # The map's fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                      "a_key": # Object with schema name: Value
-                    },
-                  },
-                  "nullValue": "A String", # A null value.
-                  "referenceValue": "A String", # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                  "stringValue": "A String", # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                  "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-                },
+                # Object with schema name: Value
               ],
             },
             "setToServerValue": "A String", # Sets the field to the given server value.
@@ -718,7 +652,11 @@
         "createTime": "A String", # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
         "fields": { # The document's fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `"foo" : { map_value: { "x&y" : { string_value: "hello" }}}` would be represented by the field path `foo.x&y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&y` `` represents `x&y` and `` `bak\`tik` `` represents `` bak`tik ``.
           "a_key": { # A message that can hold any of the supported value types.
-            "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "values": [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             "booleanValue": True or False, # A boolean value.
             "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             "doubleValue": 3.14, # A double value.
@@ -750,31 +688,16 @@
         { # A transformation of a field of the document.
           "appendMissingElements": { # An array value. # Append the given elements in order if they are not already present in the current field value. If the field is not an array, or if the field does not yet exist, it is first set to the empty array. Equivalent numbers of different types (e.g. 3L and 3.0) are considered equal when checking if a value is missing. NaN is equal to NaN, and Null is equal to Null. If the input contains multiple equivalent values, only the first will be considered. The corresponding transform_result will be the null value.
             "values": [ # Values in the array.
-              { # A message that can hold any of the supported value types.
-                "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                "booleanValue": True or False, # A boolean value.
-                "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                "doubleValue": 3.14, # A double value.
-                "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                  "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                  "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                },
-                "integerValue": "A String", # An integer value.
-                "mapValue": { # A map value. # A map value.
-                  "fields": { # The map's fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                    "a_key": # Object with schema name: Value
-                  },
-                },
-                "nullValue": "A String", # A null value.
-                "referenceValue": "A String", # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                "stringValue": "A String", # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-              },
+              # Object with schema name: Value
             ],
           },
           "fieldPath": "A String", # The path of the field. See Document.fields for the field path syntax reference.
           "increment": { # A message that can hold any of the supported value types. # Adds the given value to the field's current value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If either of the given value or the current field value are doubles, both values will be interpreted as doubles. Double arithmetic and representation of double values follow IEEE 754 semantics. If there is positive/negative integer overflow, the field is resolved to the largest magnitude positive/negative integer.
-            "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "values": [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             "booleanValue": True or False, # A boolean value.
             "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             "doubleValue": 3.14, # A double value.
@@ -794,7 +717,11 @@
             "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
           },
           "maximum": { # A message that can hold any of the supported value types. # Sets the field to the maximum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If a maximum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the larger operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The maximum of a zero stored value and zero input value is always the stored value. The maximum of any numeric value x and NaN is NaN.
-            "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "values": [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             "booleanValue": True or False, # A boolean value.
             "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             "doubleValue": 3.14, # A double value.
@@ -814,7 +741,11 @@
             "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
           },
           "minimum": { # A message that can hold any of the supported value types. # Sets the field to the minimum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the input value. If a minimum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the smaller operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The minimum of a zero stored value and zero input value is always the stored value. The minimum of any numeric value x and NaN is NaN.
-            "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "values": [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             "booleanValue": True or False, # A boolean value.
             "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             "doubleValue": 3.14, # A double value.
@@ -835,26 +766,7 @@
           },
           "removeAllFromArray": { # An array value. # Remove all of the given elements from the array in the field. If the field is not an array, or if the field does not yet exist, it is set to the empty array. Equivalent numbers of the different types (e.g. 3L and 3.0) are considered equal when deciding whether an element should be removed. NaN is equal to NaN, and Null is equal to Null. This will remove all equivalent values if there are duplicates. The corresponding transform_result will be the null value.
             "values": [ # Values in the array.
-              { # A message that can hold any of the supported value types.
-                "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                "booleanValue": True or False, # A boolean value.
-                "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                "doubleValue": 3.14, # A double value.
-                "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                  "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                  "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                },
-                "integerValue": "A String", # An integer value.
-                "mapValue": { # A map value. # A map value.
-                  "fields": { # The map's fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                    "a_key": # Object with schema name: Value
-                  },
-                },
-                "nullValue": "A String", # A null value.
-                "referenceValue": "A String", # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                "stringValue": "A String", # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-              },
+              # Object with schema name: Value
             ],
           },
           "setToServerValue": "A String", # Sets the field to the given server value.
@@ -878,7 +790,11 @@
     { # The result of applying a write.
       "transformResults": [ # The results of applying each DocumentTransform.FieldTransform, in the same order.
         { # A message that can hold any of the supported value types.
-          "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "values": [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           "booleanValue": True or False, # A boolean value.
           "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           "doubleValue": 3.14, # A double value.
@@ -918,7 +834,11 @@
   "createTime": "A String", # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
   "fields": { # The document's fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `"foo" : { map_value: { "x&y" : { string_value: "hello" }}}` would be represented by the field path `foo.x&y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&y` `` represents `x&y` and `` `bak\`tik` `` represents `` bak`tik ``.
     "a_key": { # A message that can hold any of the supported value types.
-      "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+      "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+        "values": [ # Values in the array.
+          # Object with schema name: Value
+        ],
+      },
       "booleanValue": True or False, # A boolean value.
       "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
       "doubleValue": 3.14, # A double value.
@@ -956,7 +876,11 @@
   "createTime": "A String", # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
   "fields": { # The document's fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `"foo" : { map_value: { "x&y" : { string_value: "hello" }}}` would be represented by the field path `foo.x&y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&y` `` represents `x&y` and `` `bak\`tik` `` represents `` bak`tik ``.
     "a_key": { # A message that can hold any of the supported value types.
-      "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+      "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+        "values": [ # Values in the array.
+          # Object with schema name: Value
+        ],
+      },
       "booleanValue": True or False, # A boolean value.
       "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
       "doubleValue": 3.14, # A double value.
@@ -1022,7 +946,11 @@
   "createTime": "A String", # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
   "fields": { # The document's fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `"foo" : { map_value: { "x&y" : { string_value: "hello" }}}` would be represented by the field path `foo.x&y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&y` `` represents `x&y` and `` `bak\`tik` `` represents `` bak`tik ``.
     "a_key": { # A message that can hold any of the supported value types.
-      "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+      "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+        "values": [ # Values in the array.
+          # Object with schema name: Value
+        ],
+      },
       "booleanValue": True or False, # A boolean value.
       "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
       "doubleValue": 3.14, # A double value.
@@ -1075,7 +1003,11 @@
       "createTime": "A String", # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
       "fields": { # The document's fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `"foo" : { map_value: { "x&y" : { string_value: "hello" }}}` would be represented by the field path `foo.x&y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&y` `` represents `x&y` and `` `bak\`tik` `` represents `` bak`tik ``.
         "a_key": { # A message that can hold any of the supported value types.
-          "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "values": [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           "booleanValue": True or False, # A boolean value.
           "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           "doubleValue": 3.14, # A double value.
@@ -1185,7 +1117,11 @@
           "before": True or False, # If the position is just before or just after the given values, relative to the sort order defined by the query.
           "values": [ # The values that represent a position, in the order they appear in the order by clause of a query. Can contain fewer values than specified in the order by clause.
             { # A message that can hold any of the supported value types.
-              "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                "values": [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               "booleanValue": True or False, # A boolean value.
               "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               "doubleValue": 3.14, # A double value.
@@ -1233,7 +1169,11 @@
           "before": True or False, # If the position is just before or just after the given values, relative to the sort order defined by the query.
           "values": [ # The values that represent a position, in the order they appear in the order by clause of a query. Can contain fewer values than specified in the order by clause.
             { # A message that can hold any of the supported value types.
-              "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                "values": [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               "booleanValue": True or False, # A boolean value.
               "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               "doubleValue": 3.14, # A double value.
@@ -1267,7 +1207,11 @@
             },
             "op": "A String", # The operator to filter by.
             "value": { # A message that can hold any of the supported value types. # The value to compare to.
-              "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                "values": [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               "booleanValue": True or False, # A boolean value.
               "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               "doubleValue": 3.14, # A double value.
@@ -1320,7 +1264,11 @@
       "createTime": "A String", # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
       "fields": { # The document's fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `"foo" : { map_value: { "x&y" : { string_value: "hello" }}}` would be represented by the field path `foo.x&y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&y` `` represents `x&y` and `` `bak\`tik` `` represents `` bak`tik ``.
         "a_key": { # A message that can hold any of the supported value types.
-          "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "values": [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           "booleanValue": True or False, # A boolean value.
           "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           "doubleValue": 3.14, # A double value.
@@ -1406,7 +1354,11 @@
       "before": True or False, # If the position is just before or just after the given values, relative to the sort order defined by the query.
       "values": [ # The values that represent a position, in the order they appear in the order by clause of a query. Can contain fewer values than specified in the order by clause.
         { # A message that can hold any of the supported value types.
-          "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "values": [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           "booleanValue": True or False, # A boolean value.
           "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           "doubleValue": 3.14, # A double value.
@@ -1454,7 +1406,11 @@
       "before": True or False, # If the position is just before or just after the given values, relative to the sort order defined by the query.
       "values": [ # The values that represent a position, in the order they appear in the order by clause of a query. Can contain fewer values than specified in the order by clause.
         { # A message that can hold any of the supported value types.
-          "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "values": [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           "booleanValue": True or False, # A boolean value.
           "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           "doubleValue": 3.14, # A double value.
@@ -1488,7 +1444,11 @@
         },
         "op": "A String", # The operator to filter by.
         "value": { # A message that can hold any of the supported value types. # The value to compare to.
-          "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "values": [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           "booleanValue": True or False, # A boolean value.
           "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           "doubleValue": 3.14, # A double value.
@@ -1533,7 +1493,11 @@
       "before": True or False, # If the position is just before or just after the given values, relative to the sort order defined by the query.
       "values": [ # The values that represent a position, in the order they appear in the order by clause of a query. Can contain fewer values than specified in the order by clause.
         { # A message that can hold any of the supported value types.
-          "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "values": [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           "booleanValue": True or False, # A boolean value.
           "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           "doubleValue": 3.14, # A double value.
@@ -1585,7 +1549,11 @@
   "createTime": "A String", # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
   "fields": { # The document's fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `"foo" : { map_value: { "x&y" : { string_value: "hello" }}}` would be represented by the field path `foo.x&y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&y` `` represents `x&y` and `` `bak\`tik` `` represents `` bak`tik ``.
     "a_key": { # A message that can hold any of the supported value types.
-      "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+      "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+        "values": [ # Values in the array.
+          # Object with schema name: Value
+        ],
+      },
       "booleanValue": True or False, # A boolean value.
       "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
       "doubleValue": 3.14, # A double value.
@@ -1625,7 +1593,11 @@
   "createTime": "A String", # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
   "fields": { # The document's fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `"foo" : { map_value: { "x&y" : { string_value: "hello" }}}` would be represented by the field path `foo.x&y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&y` `` represents `x&y` and `` `bak\`tik` `` represents `` bak`tik ``.
     "a_key": { # A message that can hold any of the supported value types.
-      "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+      "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+        "values": [ # Values in the array.
+          # Object with schema name: Value
+        ],
+      },
       "booleanValue": True or False, # A boolean value.
       "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
       "doubleValue": 3.14, # A double value.
@@ -1699,7 +1671,11 @@
       "before": True or False, # If the position is just before or just after the given values, relative to the sort order defined by the query.
       "values": [ # The values that represent a position, in the order they appear in the order by clause of a query. Can contain fewer values than specified in the order by clause.
         { # A message that can hold any of the supported value types.
-          "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "values": [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           "booleanValue": True or False, # A boolean value.
           "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           "doubleValue": 3.14, # A double value.
@@ -1747,7 +1723,11 @@
       "before": True or False, # If the position is just before or just after the given values, relative to the sort order defined by the query.
       "values": [ # The values that represent a position, in the order they appear in the order by clause of a query. Can contain fewer values than specified in the order by clause.
         { # A message that can hold any of the supported value types.
-          "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "values": [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           "booleanValue": True or False, # A boolean value.
           "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           "doubleValue": 3.14, # A double value.
@@ -1781,7 +1761,11 @@
         },
         "op": "A String", # The operator to filter by.
         "value": { # A message that can hold any of the supported value types. # The value to compare to.
-          "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "values": [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           "booleanValue": True or False, # A boolean value.
           "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           "doubleValue": 3.14, # A double value.
@@ -1825,7 +1809,11 @@
     "createTime": "A String", # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
     "fields": { # The document's fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `"foo" : { map_value: { "x&y" : { string_value: "hello" }}}` would be represented by the field path `foo.x&y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&y` `` represents `x&y` and `` `bak\`tik` `` represents `` bak`tik ``.
       "a_key": { # A message that can hold any of the supported value types.
-        "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+        "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "values": [ # Values in the array.
+            # Object with schema name: Value
+          ],
+        },
         "booleanValue": True or False, # A boolean value.
         "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
         "doubleValue": 3.14, # A double value.
@@ -1882,31 +1870,16 @@
           { # A transformation of a field of the document.
             "appendMissingElements": { # An array value. # Append the given elements in order if they are not already present in the current field value. If the field is not an array, or if the field does not yet exist, it is first set to the empty array. Equivalent numbers of different types (e.g. 3L and 3.0) are considered equal when checking if a value is missing. NaN is equal to NaN, and Null is equal to Null. If the input contains multiple equivalent values, only the first will be considered. The corresponding transform_result will be the null value.
               "values": [ # Values in the array.
-                { # A message that can hold any of the supported value types.
-                  "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                  "booleanValue": True or False, # A boolean value.
-                  "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                  "doubleValue": 3.14, # A double value.
-                  "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                    "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                    "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                  },
-                  "integerValue": "A String", # An integer value.
-                  "mapValue": { # A map value. # A map value.
-                    "fields": { # The map's fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                      "a_key": # Object with schema name: Value
-                    },
-                  },
-                  "nullValue": "A String", # A null value.
-                  "referenceValue": "A String", # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                  "stringValue": "A String", # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                  "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-                },
+                # Object with schema name: Value
               ],
             },
             "fieldPath": "A String", # The path of the field. See Document.fields for the field path syntax reference.
             "increment": { # A message that can hold any of the supported value types. # Adds the given value to the field's current value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If either of the given value or the current field value are doubles, both values will be interpreted as doubles. Double arithmetic and representation of double values follow IEEE 754 semantics. If there is positive/negative integer overflow, the field is resolved to the largest magnitude positive/negative integer.
-              "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                "values": [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               "booleanValue": True or False, # A boolean value.
               "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               "doubleValue": 3.14, # A double value.
@@ -1926,7 +1899,11 @@
               "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
             },
             "maximum": { # A message that can hold any of the supported value types. # Sets the field to the maximum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If a maximum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the larger operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The maximum of a zero stored value and zero input value is always the stored value. The maximum of any numeric value x and NaN is NaN.
-              "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                "values": [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               "booleanValue": True or False, # A boolean value.
               "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               "doubleValue": 3.14, # A double value.
@@ -1946,7 +1923,11 @@
               "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
             },
             "minimum": { # A message that can hold any of the supported value types. # Sets the field to the minimum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the input value. If a minimum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the smaller operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The minimum of a zero stored value and zero input value is always the stored value. The minimum of any numeric value x and NaN is NaN.
-              "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                "values": [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               "booleanValue": True or False, # A boolean value.
               "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               "doubleValue": 3.14, # A double value.
@@ -1967,26 +1948,7 @@
             },
             "removeAllFromArray": { # An array value. # Remove all of the given elements from the array in the field. If the field is not an array, or if the field does not yet exist, it is set to the empty array. Equivalent numbers of the different types (e.g. 3L and 3.0) are considered equal when deciding whether an element should be removed. NaN is equal to NaN, and Null is equal to Null. This will remove all equivalent values if there are duplicates. The corresponding transform_result will be the null value.
               "values": [ # Values in the array.
-                { # A message that can hold any of the supported value types.
-                  "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                  "booleanValue": True or False, # A boolean value.
-                  "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                  "doubleValue": 3.14, # A double value.
-                  "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                    "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                    "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                  },
-                  "integerValue": "A String", # An integer value.
-                  "mapValue": { # A map value. # A map value.
-                    "fields": { # The map's fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                      "a_key": # Object with schema name: Value
-                    },
-                  },
-                  "nullValue": "A String", # A null value.
-                  "referenceValue": "A String", # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                  "stringValue": "A String", # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                  "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-                },
+                # Object with schema name: Value
               ],
             },
             "setToServerValue": "A String", # Sets the field to the given server value.
@@ -1997,7 +1959,11 @@
         "createTime": "A String", # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
         "fields": { # The document's fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `"foo" : { map_value: { "x&y" : { string_value: "hello" }}}` would be represented by the field path `foo.x&y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&y` `` represents `x&y` and `` `bak\`tik` `` represents `` bak`tik ``.
           "a_key": { # A message that can hold any of the supported value types.
-            "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "values": [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             "booleanValue": True or False, # A boolean value.
             "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             "doubleValue": 3.14, # A double value.
@@ -2029,31 +1995,16 @@
         { # A transformation of a field of the document.
           "appendMissingElements": { # An array value. # Append the given elements in order if they are not already present in the current field value. If the field is not an array, or if the field does not yet exist, it is first set to the empty array. Equivalent numbers of different types (e.g. 3L and 3.0) are considered equal when checking if a value is missing. NaN is equal to NaN, and Null is equal to Null. If the input contains multiple equivalent values, only the first will be considered. The corresponding transform_result will be the null value.
             "values": [ # Values in the array.
-              { # A message that can hold any of the supported value types.
-                "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                "booleanValue": True or False, # A boolean value.
-                "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                "doubleValue": 3.14, # A double value.
-                "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                  "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                  "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                },
-                "integerValue": "A String", # An integer value.
-                "mapValue": { # A map value. # A map value.
-                  "fields": { # The map's fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                    "a_key": # Object with schema name: Value
-                  },
-                },
-                "nullValue": "A String", # A null value.
-                "referenceValue": "A String", # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                "stringValue": "A String", # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-              },
+              # Object with schema name: Value
             ],
           },
           "fieldPath": "A String", # The path of the field. See Document.fields for the field path syntax reference.
           "increment": { # A message that can hold any of the supported value types. # Adds the given value to the field's current value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If either of the given value or the current field value are doubles, both values will be interpreted as doubles. Double arithmetic and representation of double values follow IEEE 754 semantics. If there is positive/negative integer overflow, the field is resolved to the largest magnitude positive/negative integer.
-            "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "values": [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             "booleanValue": True or False, # A boolean value.
             "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             "doubleValue": 3.14, # A double value.
@@ -2073,7 +2024,11 @@
             "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
           },
           "maximum": { # A message that can hold any of the supported value types. # Sets the field to the maximum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If a maximum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the larger operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The maximum of a zero stored value and zero input value is always the stored value. The maximum of any numeric value x and NaN is NaN.
-            "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "values": [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             "booleanValue": True or False, # A boolean value.
             "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             "doubleValue": 3.14, # A double value.
@@ -2093,7 +2048,11 @@
             "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
           },
           "minimum": { # A message that can hold any of the supported value types. # Sets the field to the minimum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the input value. If a minimum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the smaller operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The minimum of a zero stored value and zero input value is always the stored value. The minimum of any numeric value x and NaN is NaN.
-            "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "values": [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             "booleanValue": True or False, # A boolean value.
             "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             "doubleValue": 3.14, # A double value.
@@ -2114,26 +2073,7 @@
           },
           "removeAllFromArray": { # An array value. # Remove all of the given elements from the array in the field. If the field is not an array, or if the field does not yet exist, it is set to the empty array. Equivalent numbers of the different types (e.g. 3L and 3.0) are considered equal when deciding whether an element should be removed. NaN is equal to NaN, and Null is equal to Null. This will remove all equivalent values if there are duplicates. The corresponding transform_result will be the null value.
             "values": [ # Values in the array.
-              { # A message that can hold any of the supported value types.
-                "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                "booleanValue": True or False, # A boolean value.
-                "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                "doubleValue": 3.14, # A double value.
-                "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                  "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                  "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                },
-                "integerValue": "A String", # An integer value.
-                "mapValue": { # A map value. # A map value.
-                  "fields": { # The map's fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                    "a_key": # Object with schema name: Value
-                  },
-                },
-                "nullValue": "A String", # A null value.
-                "referenceValue": "A String", # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                "stringValue": "A String", # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-              },
+              # Object with schema name: Value
             ],
           },
           "setToServerValue": "A String", # Sets the field to the given server value.
@@ -2159,7 +2099,11 @@
     { # The result of applying a write.
       "transformResults": [ # The results of applying each DocumentTransform.FieldTransform, in the same order.
         { # A message that can hold any of the supported value types.
-          "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "values": [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           "booleanValue": True or False, # A boolean value.
           "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           "doubleValue": 3.14, # A double value.

docs/dyn/firestore_v1beta1.projects.databases.documents.html

diff --git a/docs/dyn/firestore_v1beta1.projects.databases.documents.html b/docs/dyn/firestore_v1beta1.projects.databases.documents.html
index 712832b..352fb52 100644
--- a/docs/dyn/firestore_v1beta1.projects.databases.documents.html
+++ b/docs/dyn/firestore_v1beta1.projects.databases.documents.html
@@ -175,7 +175,11 @@
     "createTime": "A String", # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
     "fields": { # The document's fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `"foo" : { map_value: { "x&y" : { string_value: "hello" }}}` would be represented by the field path `foo.x&y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&y` `` represents `x&y` and `` `bak\`tik` `` represents `` bak`tik ``.
       "a_key": { # A message that can hold any of the supported value types.
-        "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+        "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "values": [ # Values in the array.
+            # Object with schema name: Value
+          ],
+        },
         "booleanValue": True or False, # A boolean value.
         "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
         "doubleValue": 3.14, # A double value.
@@ -230,31 +234,16 @@
           { # A transformation of a field of the document.
             "appendMissingElements": { # An array value. # Append the given elements in order if they are not already present in the current field value. If the field is not an array, or if the field does not yet exist, it is first set to the empty array. Equivalent numbers of different types (e.g. 3L and 3.0) are considered equal when checking if a value is missing. NaN is equal to NaN, and Null is equal to Null. If the input contains multiple equivalent values, only the first will be considered. The corresponding transform_result will be the null value.
               "values": [ # Values in the array.
-                { # A message that can hold any of the supported value types.
-                  "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                  "booleanValue": True or False, # A boolean value.
-                  "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                  "doubleValue": 3.14, # A double value.
-                  "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                    "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                    "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                  },
-                  "integerValue": "A String", # An integer value.
-                  "mapValue": { # A map value. # A map value.
-                    "fields": { # The map's fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                      "a_key": # Object with schema name: Value
-                    },
-                  },
-                  "nullValue": "A String", # A null value.
-                  "referenceValue": "A String", # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                  "stringValue": "A String", # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                  "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-                },
+                # Object with schema name: Value
               ],
             },
             "fieldPath": "A String", # The path of the field. See Document.fields for the field path syntax reference.
             "increment": { # A message that can hold any of the supported value types. # Adds the given value to the field's current value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If either of the given value or the current field value are doubles, both values will be interpreted as doubles. Double arithmetic and representation of double values follow IEEE 754 semantics. If there is positive/negative integer overflow, the field is resolved to the largest magnitude positive/negative integer.
-              "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                "values": [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               "booleanValue": True or False, # A boolean value.
               "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               "doubleValue": 3.14, # A double value.
@@ -274,7 +263,11 @@
               "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
             },
             "maximum": { # A message that can hold any of the supported value types. # Sets the field to the maximum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If a maximum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the larger operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The maximum of a zero stored value and zero input value is always the stored value. The maximum of any numeric value x and NaN is NaN.
-              "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                "values": [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               "booleanValue": True or False, # A boolean value.
               "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               "doubleValue": 3.14, # A double value.
@@ -294,7 +287,11 @@
               "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
             },
             "minimum": { # A message that can hold any of the supported value types. # Sets the field to the minimum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the input value. If a minimum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the smaller operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The minimum of a zero stored value and zero input value is always the stored value. The minimum of any numeric value x and NaN is NaN.
-              "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                "values": [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               "booleanValue": True or False, # A boolean value.
               "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               "doubleValue": 3.14, # A double value.
@@ -315,26 +312,7 @@
             },
             "removeAllFromArray": { # An array value. # Remove all of the given elements from the array in the field. If the field is not an array, or if the field does not yet exist, it is set to the empty array. Equivalent numbers of the different types (e.g. 3L and 3.0) are considered equal when deciding whether an element should be removed. NaN is equal to NaN, and Null is equal to Null. This will remove all equivalent values if there are duplicates. The corresponding transform_result will be the null value.
               "values": [ # Values in the array.
-                { # A message that can hold any of the supported value types.
-                  "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                  "booleanValue": True or False, # A boolean value.
-                  "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                  "doubleValue": 3.14, # A double value.
-                  "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                    "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                    "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                  },
-                  "integerValue": "A String", # An integer value.
-                  "mapValue": { # A map value. # A map value.
-                    "fields": { # The map's fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                      "a_key": # Object with schema name: Value
-                    },
-                  },
-                  "nullValue": "A String", # A null value.
-                  "referenceValue": "A String", # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                  "stringValue": "A String", # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                  "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-                },
+                # Object with schema name: Value
               ],
             },
             "setToServerValue": "A String", # Sets the field to the given server value.
@@ -345,7 +323,11 @@
         "createTime": "A String", # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
         "fields": { # The document's fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `"foo" : { map_value: { "x&y" : { string_value: "hello" }}}` would be represented by the field path `foo.x&y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&y` `` represents `x&y` and `` `bak\`tik` `` represents `` bak`tik ``.
           "a_key": { # A message that can hold any of the supported value types.
-            "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "values": [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             "booleanValue": True or False, # A boolean value.
             "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             "doubleValue": 3.14, # A double value.
@@ -377,31 +359,16 @@
         { # A transformation of a field of the document.
           "appendMissingElements": { # An array value. # Append the given elements in order if they are not already present in the current field value. If the field is not an array, or if the field does not yet exist, it is first set to the empty array. Equivalent numbers of different types (e.g. 3L and 3.0) are considered equal when checking if a value is missing. NaN is equal to NaN, and Null is equal to Null. If the input contains multiple equivalent values, only the first will be considered. The corresponding transform_result will be the null value.
             "values": [ # Values in the array.
-              { # A message that can hold any of the supported value types.
-                "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                "booleanValue": True or False, # A boolean value.
-                "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                "doubleValue": 3.14, # A double value.
-                "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                  "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                  "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                },
-                "integerValue": "A String", # An integer value.
-                "mapValue": { # A map value. # A map value.
-                  "fields": { # The map's fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                    "a_key": # Object with schema name: Value
-                  },
-                },
-                "nullValue": "A String", # A null value.
-                "referenceValue": "A String", # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                "stringValue": "A String", # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-              },
+              # Object with schema name: Value
             ],
           },
           "fieldPath": "A String", # The path of the field. See Document.fields for the field path syntax reference.
           "increment": { # A message that can hold any of the supported value types. # Adds the given value to the field's current value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If either of the given value or the current field value are doubles, both values will be interpreted as doubles. Double arithmetic and representation of double values follow IEEE 754 semantics. If there is positive/negative integer overflow, the field is resolved to the largest magnitude positive/negative integer.
-            "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "values": [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             "booleanValue": True or False, # A boolean value.
             "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             "doubleValue": 3.14, # A double value.
@@ -421,7 +388,11 @@
             "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
           },
           "maximum": { # A message that can hold any of the supported value types. # Sets the field to the maximum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If a maximum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the larger operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The maximum of a zero stored value and zero input value is always the stored value. The maximum of any numeric value x and NaN is NaN.
-            "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "values": [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             "booleanValue": True or False, # A boolean value.
             "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             "doubleValue": 3.14, # A double value.
@@ -441,7 +412,11 @@
             "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
           },
           "minimum": { # A message that can hold any of the supported value types. # Sets the field to the minimum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the input value. If a minimum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the smaller operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The minimum of a zero stored value and zero input value is always the stored value. The minimum of any numeric value x and NaN is NaN.
-            "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "values": [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             "booleanValue": True or False, # A boolean value.
             "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             "doubleValue": 3.14, # A double value.
@@ -462,26 +437,7 @@
           },
           "removeAllFromArray": { # An array value. # Remove all of the given elements from the array in the field. If the field is not an array, or if the field does not yet exist, it is set to the empty array. Equivalent numbers of the different types (e.g. 3L and 3.0) are considered equal when deciding whether an element should be removed. NaN is equal to NaN, and Null is equal to Null. This will remove all equivalent values if there are duplicates. The corresponding transform_result will be the null value.
             "values": [ # Values in the array.
-              { # A message that can hold any of the supported value types.
-                "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                "booleanValue": True or False, # A boolean value.
-                "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                "doubleValue": 3.14, # A double value.
-                "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                  "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                  "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                },
-                "integerValue": "A String", # An integer value.
-                "mapValue": { # A map value. # A map value.
-                  "fields": { # The map's fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                    "a_key": # Object with schema name: Value
-                  },
-                },
-                "nullValue": "A String", # A null value.
-                "referenceValue": "A String", # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                "stringValue": "A String", # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-              },
+              # Object with schema name: Value
             ],
           },
           "setToServerValue": "A String", # Sets the field to the given server value.
@@ -515,7 +471,11 @@
     { # The result of applying a write.
       "transformResults": [ # The results of applying each DocumentTransform.FieldTransform, in the same order.
         { # A message that can hold any of the supported value types.
-          "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "values": [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           "booleanValue": True or False, # A boolean value.
           "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           "doubleValue": 3.14, # A double value.
@@ -603,31 +563,16 @@
           { # A transformation of a field of the document.
             "appendMissingElements": { # An array value. # Append the given elements in order if they are not already present in the current field value. If the field is not an array, or if the field does not yet exist, it is first set to the empty array. Equivalent numbers of different types (e.g. 3L and 3.0) are considered equal when checking if a value is missing. NaN is equal to NaN, and Null is equal to Null. If the input contains multiple equivalent values, only the first will be considered. The corresponding transform_result will be the null value.
               "values": [ # Values in the array.
-                { # A message that can hold any of the supported value types.
-                  "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                  "booleanValue": True or False, # A boolean value.
-                  "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                  "doubleValue": 3.14, # A double value.
-                  "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                    "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                    "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                  },
-                  "integerValue": "A String", # An integer value.
-                  "mapValue": { # A map value. # A map value.
-                    "fields": { # The map's fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                      "a_key": # Object with schema name: Value
-                    },
-                  },
-                  "nullValue": "A String", # A null value.
-                  "referenceValue": "A String", # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                  "stringValue": "A String", # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                  "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-                },
+                # Object with schema name: Value
               ],
             },
             "fieldPath": "A String", # The path of the field. See Document.fields for the field path syntax reference.
             "increment": { # A message that can hold any of the supported value types. # Adds the given value to the field's current value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If either of the given value or the current field value are doubles, both values will be interpreted as doubles. Double arithmetic and representation of double values follow IEEE 754 semantics. If there is positive/negative integer overflow, the field is resolved to the largest magnitude positive/negative integer.
-              "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                "values": [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               "booleanValue": True or False, # A boolean value.
               "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               "doubleValue": 3.14, # A double value.
@@ -647,7 +592,11 @@
               "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
             },
             "maximum": { # A message that can hold any of the supported value types. # Sets the field to the maximum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If a maximum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the larger operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The maximum of a zero stored value and zero input value is always the stored value. The maximum of any numeric value x and NaN is NaN.
-              "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                "values": [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               "booleanValue": True or False, # A boolean value.
               "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               "doubleValue": 3.14, # A double value.
@@ -667,7 +616,11 @@
               "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
             },
             "minimum": { # A message that can hold any of the supported value types. # Sets the field to the minimum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the input value. If a minimum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the smaller operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The minimum of a zero stored value and zero input value is always the stored value. The minimum of any numeric value x and NaN is NaN.
-              "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                "values": [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               "booleanValue": True or False, # A boolean value.
               "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               "doubleValue": 3.14, # A double value.
@@ -688,26 +641,7 @@
             },
             "removeAllFromArray": { # An array value. # Remove all of the given elements from the array in the field. If the field is not an array, or if the field does not yet exist, it is set to the empty array. Equivalent numbers of the different types (e.g. 3L and 3.0) are considered equal when deciding whether an element should be removed. NaN is equal to NaN, and Null is equal to Null. This will remove all equivalent values if there are duplicates. The corresponding transform_result will be the null value.
               "values": [ # Values in the array.
-                { # A message that can hold any of the supported value types.
-                  "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                  "booleanValue": True or False, # A boolean value.
-                  "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                  "doubleValue": 3.14, # A double value.
-                  "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                    "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                    "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                  },
-                  "integerValue": "A String", # An integer value.
-                  "mapValue": { # A map value. # A map value.
-                    "fields": { # The map's fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                      "a_key": # Object with schema name: Value
-                    },
-                  },
-                  "nullValue": "A String", # A null value.
-                  "referenceValue": "A String", # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                  "stringValue": "A String", # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                  "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-                },
+                # Object with schema name: Value
               ],
             },
             "setToServerValue": "A String", # Sets the field to the given server value.
@@ -718,7 +652,11 @@
         "createTime": "A String", # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
         "fields": { # The document's fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `"foo" : { map_value: { "x&y" : { string_value: "hello" }}}` would be represented by the field path `foo.x&y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&y` `` represents `x&y` and `` `bak\`tik` `` represents `` bak`tik ``.
           "a_key": { # A message that can hold any of the supported value types.
-            "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "values": [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             "booleanValue": True or False, # A boolean value.
             "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             "doubleValue": 3.14, # A double value.
@@ -750,31 +688,16 @@
         { # A transformation of a field of the document.
           "appendMissingElements": { # An array value. # Append the given elements in order if they are not already present in the current field value. If the field is not an array, or if the field does not yet exist, it is first set to the empty array. Equivalent numbers of different types (e.g. 3L and 3.0) are considered equal when checking if a value is missing. NaN is equal to NaN, and Null is equal to Null. If the input contains multiple equivalent values, only the first will be considered. The corresponding transform_result will be the null value.
             "values": [ # Values in the array.
-              { # A message that can hold any of the supported value types.
-                "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                "booleanValue": True or False, # A boolean value.
-                "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                "doubleValue": 3.14, # A double value.
-                "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                  "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                  "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                },
-                "integerValue": "A String", # An integer value.
-                "mapValue": { # A map value. # A map value.
-                  "fields": { # The map's fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                    "a_key": # Object with schema name: Value
-                  },
-                },
-                "nullValue": "A String", # A null value.
-                "referenceValue": "A String", # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                "stringValue": "A String", # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-              },
+              # Object with schema name: Value
             ],
           },
           "fieldPath": "A String", # The path of the field. See Document.fields for the field path syntax reference.
           "increment": { # A message that can hold any of the supported value types. # Adds the given value to the field's current value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If either of the given value or the current field value are doubles, both values will be interpreted as doubles. Double arithmetic and representation of double values follow IEEE 754 semantics. If there is positive/negative integer overflow, the field is resolved to the largest magnitude positive/negative integer.
-            "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "values": [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             "booleanValue": True or False, # A boolean value.
             "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             "doubleValue": 3.14, # A double value.
@@ -794,7 +717,11 @@
             "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
           },
           "maximum": { # A message that can hold any of the supported value types. # Sets the field to the maximum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If a maximum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the larger operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The maximum of a zero stored value and zero input value is always the stored value. The maximum of any numeric value x and NaN is NaN.
-            "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "values": [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             "booleanValue": True or False, # A boolean value.
             "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             "doubleValue": 3.14, # A double value.
@@ -814,7 +741,11 @@
             "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
           },
           "minimum": { # A message that can hold any of the supported value types. # Sets the field to the minimum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the input value. If a minimum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the smaller operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The minimum of a zero stored value and zero input value is always the stored value. The minimum of any numeric value x and NaN is NaN.
-            "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "values": [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             "booleanValue": True or False, # A boolean value.
             "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             "doubleValue": 3.14, # A double value.
@@ -835,26 +766,7 @@
           },
           "removeAllFromArray": { # An array value. # Remove all of the given elements from the array in the field. If the field is not an array, or if the field does not yet exist, it is set to the empty array. Equivalent numbers of the different types (e.g. 3L and 3.0) are considered equal when deciding whether an element should be removed. NaN is equal to NaN, and Null is equal to Null. This will remove all equivalent values if there are duplicates. The corresponding transform_result will be the null value.
             "values": [ # Values in the array.
-              { # A message that can hold any of the supported value types.
-                "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                "booleanValue": True or False, # A boolean value.
-                "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                "doubleValue": 3.14, # A double value.
-                "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                  "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                  "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                },
-                "integerValue": "A String", # An integer value.
-                "mapValue": { # A map value. # A map value.
-                  "fields": { # The map's fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                    "a_key": # Object with schema name: Value
-                  },
-                },
-                "nullValue": "A String", # A null value.
-                "referenceValue": "A String", # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                "stringValue": "A String", # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-              },
+              # Object with schema name: Value
             ],
           },
           "setToServerValue": "A String", # Sets the field to the given server value.
@@ -878,7 +790,11 @@
     { # The result of applying a write.
       "transformResults": [ # The results of applying each DocumentTransform.FieldTransform, in the same order.
         { # A message that can hold any of the supported value types.
-          "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "values": [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           "booleanValue": True or False, # A boolean value.
           "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           "doubleValue": 3.14, # A double value.
@@ -918,7 +834,11 @@
   "createTime": "A String", # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
   "fields": { # The document's fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `"foo" : { map_value: { "x&y" : { string_value: "hello" }}}` would be represented by the field path `foo.x&y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&y` `` represents `x&y` and `` `bak\`tik` `` represents `` bak`tik ``.
     "a_key": { # A message that can hold any of the supported value types.
-      "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+      "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+        "values": [ # Values in the array.
+          # Object with schema name: Value
+        ],
+      },
       "booleanValue": True or False, # A boolean value.
       "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
       "doubleValue": 3.14, # A double value.
@@ -956,7 +876,11 @@
   "createTime": "A String", # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
   "fields": { # The document's fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `"foo" : { map_value: { "x&y" : { string_value: "hello" }}}` would be represented by the field path `foo.x&y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&y` `` represents `x&y` and `` `bak\`tik` `` represents `` bak`tik ``.
     "a_key": { # A message that can hold any of the supported value types.
-      "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+      "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+        "values": [ # Values in the array.
+          # Object with schema name: Value
+        ],
+      },
       "booleanValue": True or False, # A boolean value.
       "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
       "doubleValue": 3.14, # A double value.
@@ -1022,7 +946,11 @@
   "createTime": "A String", # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
   "fields": { # The document's fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `"foo" : { map_value: { "x&y" : { string_value: "hello" }}}` would be represented by the field path `foo.x&y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&y` `` represents `x&y` and `` `bak\`tik` `` represents `` bak`tik ``.
     "a_key": { # A message that can hold any of the supported value types.
-      "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+      "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+        "values": [ # Values in the array.
+          # Object with schema name: Value
+        ],
+      },
       "booleanValue": True or False, # A boolean value.
       "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
       "doubleValue": 3.14, # A double value.
@@ -1075,7 +1003,11 @@
       "createTime": "A String", # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
       "fields": { # The document's fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `"foo" : { map_value: { "x&y" : { string_value: "hello" }}}` would be represented by the field path `foo.x&y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&y` `` represents `x&y` and `` `bak\`tik` `` represents `` bak`tik ``.
         "a_key": { # A message that can hold any of the supported value types.
-          "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "values": [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           "booleanValue": True or False, # A boolean value.
           "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           "doubleValue": 3.14, # A double value.
@@ -1185,7 +1117,11 @@
           "before": True or False, # If the position is just before or just after the given values, relative to the sort order defined by the query.
           "values": [ # The values that represent a position, in the order they appear in the order by clause of a query. Can contain fewer values than specified in the order by clause.
             { # A message that can hold any of the supported value types.
-              "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                "values": [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               "booleanValue": True or False, # A boolean value.
               "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               "doubleValue": 3.14, # A double value.
@@ -1233,7 +1169,11 @@
           "before": True or False, # If the position is just before or just after the given values, relative to the sort order defined by the query.
           "values": [ # The values that represent a position, in the order they appear in the order by clause of a query. Can contain fewer values than specified in the order by clause.
             { # A message that can hold any of the supported value types.
-              "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                "values": [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               "booleanValue": True or False, # A boolean value.
               "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               "doubleValue": 3.14, # A double value.
@@ -1267,7 +1207,11 @@
             },
             "op": "A String", # The operator to filter by.
             "value": { # A message that can hold any of the supported value types. # The value to compare to.
-              "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                "values": [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               "booleanValue": True or False, # A boolean value.
               "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               "doubleValue": 3.14, # A double value.
@@ -1320,7 +1264,11 @@
       "createTime": "A String", # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
       "fields": { # The document's fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `"foo" : { map_value: { "x&y" : { string_value: "hello" }}}` would be represented by the field path `foo.x&y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&y` `` represents `x&y` and `` `bak\`tik` `` represents `` bak`tik ``.
         "a_key": { # A message that can hold any of the supported value types.
-          "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "values": [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           "booleanValue": True or False, # A boolean value.
           "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           "doubleValue": 3.14, # A double value.
@@ -1406,7 +1354,11 @@
       "before": True or False, # If the position is just before or just after the given values, relative to the sort order defined by the query.
       "values": [ # The values that represent a position, in the order they appear in the order by clause of a query. Can contain fewer values than specified in the order by clause.
         { # A message that can hold any of the supported value types.
-          "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "values": [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           "booleanValue": True or False, # A boolean value.
           "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           "doubleValue": 3.14, # A double value.
@@ -1454,7 +1406,11 @@
       "before": True or False, # If the position is just before or just after the given values, relative to the sort order defined by the query.
       "values": [ # The values that represent a position, in the order they appear in the order by clause of a query. Can contain fewer values than specified in the order by clause.
         { # A message that can hold any of the supported value types.
-          "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "values": [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           "booleanValue": True or False, # A boolean value.
           "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           "doubleValue": 3.14, # A double value.
@@ -1488,7 +1444,11 @@
         },
         "op": "A String", # The operator to filter by.
         "value": { # A message that can hold any of the supported value types. # The value to compare to.
-          "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "values": [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           "booleanValue": True or False, # A boolean value.
           "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           "doubleValue": 3.14, # A double value.
@@ -1533,7 +1493,11 @@
       "before": True or False, # If the position is just before or just after the given values, relative to the sort order defined by the query.
       "values": [ # The values that represent a position, in the order they appear in the order by clause of a query. Can contain fewer values than specified in the order by clause.
         { # A message that can hold any of the supported value types.
-          "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "values": [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           "booleanValue": True or False, # A boolean value.
           "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           "doubleValue": 3.14, # A double value.
@@ -1585,7 +1549,11 @@
   "createTime": "A String", # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
   "fields": { # The document's fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `"foo" : { map_value: { "x&y" : { string_value: "hello" }}}` would be represented by the field path `foo.x&y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&y` `` represents `x&y` and `` `bak\`tik` `` represents `` bak`tik ``.
     "a_key": { # A message that can hold any of the supported value types.
-      "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+      "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+        "values": [ # Values in the array.
+          # Object with schema name: Value
+        ],
+      },
       "booleanValue": True or False, # A boolean value.
       "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
       "doubleValue": 3.14, # A double value.
@@ -1625,7 +1593,11 @@
   "createTime": "A String", # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
   "fields": { # The document's fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `"foo" : { map_value: { "x&y" : { string_value: "hello" }}}` would be represented by the field path `foo.x&y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&y` `` represents `x&y` and `` `bak\`tik` `` represents `` bak`tik ``.
     "a_key": { # A message that can hold any of the supported value types.
-      "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+      "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+        "values": [ # Values in the array.
+          # Object with schema name: Value
+        ],
+      },
       "booleanValue": True or False, # A boolean value.
       "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
       "doubleValue": 3.14, # A double value.
@@ -1699,7 +1671,11 @@
       "before": True or False, # If the position is just before or just after the given values, relative to the sort order defined by the query.
       "values": [ # The values that represent a position, in the order they appear in the order by clause of a query. Can contain fewer values than specified in the order by clause.
         { # A message that can hold any of the supported value types.
-          "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "values": [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           "booleanValue": True or False, # A boolean value.
           "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           "doubleValue": 3.14, # A double value.
@@ -1747,7 +1723,11 @@
       "before": True or False, # If the position is just before or just after the given values, relative to the sort order defined by the query.
       "values": [ # The values that represent a position, in the order they appear in the order by clause of a query. Can contain fewer values than specified in the order by clause.
         { # A message that can hold any of the supported value types.
-          "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "values": [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           "booleanValue": True or False, # A boolean value.
           "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           "doubleValue": 3.14, # A double value.
@@ -1781,7 +1761,11 @@
         },
         "op": "A String", # The operator to filter by.
         "value": { # A message that can hold any of the supported value types. # The value to compare to.
-          "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "values": [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           "booleanValue": True or False, # A boolean value.
           "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           "doubleValue": 3.14, # A double value.
@@ -1825,7 +1809,11 @@
     "createTime": "A String", # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
     "fields": { # The document's fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `"foo" : { map_value: { "x&y" : { string_value: "hello" }}}` would be represented by the field path `foo.x&y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&y` `` represents `x&y` and `` `bak\`tik` `` represents `` bak`tik ``.
       "a_key": { # A message that can hold any of the supported value types.
-        "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+        "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "values": [ # Values in the array.
+            # Object with schema name: Value
+          ],
+        },
         "booleanValue": True or False, # A boolean value.
         "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
         "doubleValue": 3.14, # A double value.
@@ -1882,31 +1870,16 @@
           { # A transformation of a field of the document.
             "appendMissingElements": { # An array value. # Append the given elements in order if they are not already present in the current field value. If the field is not an array, or if the field does not yet exist, it is first set to the empty array. Equivalent numbers of different types (e.g. 3L and 3.0) are considered equal when checking if a value is missing. NaN is equal to NaN, and Null is equal to Null. If the input contains multiple equivalent values, only the first will be considered. The corresponding transform_result will be the null value.
               "values": [ # Values in the array.
-                { # A message that can hold any of the supported value types.
-                  "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                  "booleanValue": True or False, # A boolean value.
-                  "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                  "doubleValue": 3.14, # A double value.
-                  "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                    "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                    "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                  },
-                  "integerValue": "A String", # An integer value.
-                  "mapValue": { # A map value. # A map value.
-                    "fields": { # The map's fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                      "a_key": # Object with schema name: Value
-                    },
-                  },
-                  "nullValue": "A String", # A null value.
-                  "referenceValue": "A String", # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                  "stringValue": "A String", # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                  "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-                },
+                # Object with schema name: Value
               ],
             },
             "fieldPath": "A String", # The path of the field. See Document.fields for the field path syntax reference.
             "increment": { # A message that can hold any of the supported value types. # Adds the given value to the field's current value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If either of the given value or the current field value are doubles, both values will be interpreted as doubles. Double arithmetic and representation of double values follow IEEE 754 semantics. If there is positive/negative integer overflow, the field is resolved to the largest magnitude positive/negative integer.
-              "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                "values": [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               "booleanValue": True or False, # A boolean value.
               "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               "doubleValue": 3.14, # A double value.
@@ -1926,7 +1899,11 @@
               "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
             },
             "maximum": { # A message that can hold any of the supported value types. # Sets the field to the maximum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If a maximum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the larger operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The maximum of a zero stored value and zero input value is always the stored value. The maximum of any numeric value x and NaN is NaN.
-              "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                "values": [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               "booleanValue": True or False, # A boolean value.
               "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               "doubleValue": 3.14, # A double value.
@@ -1946,7 +1923,11 @@
               "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
             },
             "minimum": { # A message that can hold any of the supported value types. # Sets the field to the minimum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the input value. If a minimum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the smaller operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The minimum of a zero stored value and zero input value is always the stored value. The minimum of any numeric value x and NaN is NaN.
-              "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                "values": [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               "booleanValue": True or False, # A boolean value.
               "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               "doubleValue": 3.14, # A double value.
@@ -1967,26 +1948,7 @@
             },
             "removeAllFromArray": { # An array value. # Remove all of the given elements from the array in the field. If the field is not an array, or if the field does not yet exist, it is set to the empty array. Equivalent numbers of the different types (e.g. 3L and 3.0) are considered equal when deciding whether an element should be removed. NaN is equal to NaN, and Null is equal to Null. This will remove all equivalent values if there are duplicates. The corresponding transform_result will be the null value.
               "values": [ # Values in the array.
-                { # A message that can hold any of the supported value types.
-                  "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                  "booleanValue": True or False, # A boolean value.
-                  "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                  "doubleValue": 3.14, # A double value.
-                  "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                    "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                    "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                  },
-                  "integerValue": "A String", # An integer value.
-                  "mapValue": { # A map value. # A map value.
-                    "fields": { # The map's fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                      "a_key": # Object with schema name: Value
-                    },
-                  },
-                  "nullValue": "A String", # A null value.
-                  "referenceValue": "A String", # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                  "stringValue": "A String", # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                  "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-                },
+                # Object with schema name: Value
               ],
             },
             "setToServerValue": "A String", # Sets the field to the given server value.
@@ -1997,7 +1959,11 @@
         "createTime": "A String", # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
         "fields": { # The document's fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `"foo" : { map_value: { "x&y" : { string_value: "hello" }}}` would be represented by the field path `foo.x&y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&y` `` represents `x&y` and `` `bak\`tik` `` represents `` bak`tik ``.
           "a_key": { # A message that can hold any of the supported value types.
-            "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "values": [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             "booleanValue": True or False, # A boolean value.
             "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             "doubleValue": 3.14, # A double value.
@@ -2029,31 +1995,16 @@
         { # A transformation of a field of the document.
           "appendMissingElements": { # An array value. # Append the given elements in order if they are not already present in the current field value. If the field is not an array, or if the field does not yet exist, it is first set to the empty array. Equivalent numbers of different types (e.g. 3L and 3.0) are considered equal when checking if a value is missing. NaN is equal to NaN, and Null is equal to Null. If the input contains multiple equivalent values, only the first will be considered. The corresponding transform_result will be the null value.
             "values": [ # Values in the array.
-              { # A message that can hold any of the supported value types.
-                "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                "booleanValue": True or False, # A boolean value.
-                "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                "doubleValue": 3.14, # A double value.
-                "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                  "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                  "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                },
-                "integerValue": "A String", # An integer value.
-                "mapValue": { # A map value. # A map value.
-                  "fields": { # The map's fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                    "a_key": # Object with schema name: Value
-                  },
-                },
-                "nullValue": "A String", # A null value.
-                "referenceValue": "A String", # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                "stringValue": "A String", # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-              },
+              # Object with schema name: Value
             ],
           },
           "fieldPath": "A String", # The path of the field. See Document.fields for the field path syntax reference.
           "increment": { # A message that can hold any of the supported value types. # Adds the given value to the field's current value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If either of the given value or the current field value are doubles, both values will be interpreted as doubles. Double arithmetic and representation of double values follow IEEE 754 semantics. If there is positive/negative integer overflow, the field is resolved to the largest magnitude positive/negative integer.
-            "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "values": [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             "booleanValue": True or False, # A boolean value.
             "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             "doubleValue": 3.14, # A double value.
@@ -2073,7 +2024,11 @@
             "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
           },
           "maximum": { # A message that can hold any of the supported value types. # Sets the field to the maximum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If a maximum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the larger operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The maximum of a zero stored value and zero input value is always the stored value. The maximum of any numeric value x and NaN is NaN.
-            "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "values": [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             "booleanValue": True or False, # A boolean value.
             "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             "doubleValue": 3.14, # A double value.
@@ -2093,7 +2048,11 @@
             "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
           },
           "minimum": { # A message that can hold any of the supported value types. # Sets the field to the minimum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the input value. If a minimum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the smaller operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The minimum of a zero stored value and zero input value is always the stored value. The minimum of any numeric value x and NaN is NaN.
-            "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              "values": [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             "booleanValue": True or False, # A boolean value.
             "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             "doubleValue": 3.14, # A double value.
@@ -2114,26 +2073,7 @@
           },
           "removeAllFromArray": { # An array value. # Remove all of the given elements from the array in the field. If the field is not an array, or if the field does not yet exist, it is set to the empty array. Equivalent numbers of the different types (e.g. 3L and 3.0) are considered equal when deciding whether an element should be removed. NaN is equal to NaN, and Null is equal to Null. This will remove all equivalent values if there are duplicates. The corresponding transform_result will be the null value.
             "values": [ # Values in the array.
-              { # A message that can hold any of the supported value types.
-                "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                "booleanValue": True or False, # A boolean value.
-                "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                "doubleValue": 3.14, # A double value.
-                "geoPointValue": { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                  "latitude": 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                  "longitude": 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                },
-                "integerValue": "A String", # An integer value.
-                "mapValue": { # A map value. # A map value.
-                  "fields": { # The map's fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                    "a_key": # Object with schema name: Value
-                  },
-                },
-                "nullValue": "A String", # A null value.
-                "referenceValue": "A String", # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                "stringValue": "A String", # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                "timestampValue": "A String", # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-              },
+              # Object with schema name: Value
             ],
           },
           "setToServerValue": "A String", # Sets the field to the given server value.
@@ -2159,7 +2099,11 @@
     { # The result of applying a write.
       "transformResults": [ # The results of applying each DocumentTransform.FieldTransform, in the same order.
         { # A message that can hold any of the supported value types.
-          "arrayValue": # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          "arrayValue": { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            "values": [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           "booleanValue": True or False, # A boolean value.
           "bytesValue": "A String", # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           "doubleValue": 3.14, # A double value.

docs/dyn/gameservices_v1.projects.locations.gameServerDeployments.html

diff --git a/docs/dyn/gameservices_v1.projects.locations.gameServerDeployments.html b/docs/dyn/gameservices_v1.projects.locations.gameServerDeployments.html
index 34c5e08..8c5d9e5 100644
--- a/docs/dyn/gameservices_v1.projects.locations.gameServerDeployments.html
+++ b/docs/dyn/gameservices_v1.projects.locations.gameServerDeployments.html
@@ -311,7 +311,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -615,7 +615,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -712,7 +712,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/gameservices_v1beta.projects.locations.gameServerDeployments.html

diff --git a/docs/dyn/gameservices_v1beta.projects.locations.gameServerDeployments.html b/docs/dyn/gameservices_v1beta.projects.locations.gameServerDeployments.html
index 3f52e63..0894883 100644
--- a/docs/dyn/gameservices_v1beta.projects.locations.gameServerDeployments.html
+++ b/docs/dyn/gameservices_v1beta.projects.locations.gameServerDeployments.html
@@ -311,7 +311,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -615,7 +615,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -712,7 +712,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/gkehub_v1.html

diff --git a/docs/dyn/gkehub_v1.html b/docs/dyn/gkehub_v1.html
index c498ec3..c704095 100644
--- a/docs/dyn/gkehub_v1.html
+++ b/docs/dyn/gkehub_v1.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1.html">GKE Hub</a></h1>
+<h1><a href="gkehub_v1.html">GKE Hub API</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="gkehub_v1.projects.html">projects()</a></code>

docs/dyn/gkehub_v1.projects.html

diff --git a/docs/dyn/gkehub_v1.projects.html b/docs/dyn/gkehub_v1.projects.html
index dad7860..52e952b 100644
--- a/docs/dyn/gkehub_v1.projects.html
+++ b/docs/dyn/gkehub_v1.projects.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1.html">GKE Hub</a> . <a href="gkehub_v1.projects.html">projects</a></h1>
+<h1><a href="gkehub_v1.html">GKE Hub API</a> . <a href="gkehub_v1.projects.html">projects</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="gkehub_v1.projects.locations.html">locations()</a></code>

docs/dyn/gkehub_v1.projects.locations.features.html

diff --git a/docs/dyn/gkehub_v1.projects.locations.features.html b/docs/dyn/gkehub_v1.projects.locations.features.html
index 91193dd..4309d22 100644
--- a/docs/dyn/gkehub_v1.projects.locations.features.html
+++ b/docs/dyn/gkehub_v1.projects.locations.features.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1.html">GKE Hub</a> . <a href="gkehub_v1.projects.html">projects</a> . <a href="gkehub_v1.projects.locations.html">locations</a> . <a href="gkehub_v1.projects.locations.features.html">features</a></h1>
+<h1><a href="gkehub_v1.html">GKE Hub API</a> . <a href="gkehub_v1.projects.html">projects</a> . <a href="gkehub_v1.projects.locations.html">locations</a> . <a href="gkehub_v1.projects.locations.features.html">features</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="#close">close()</a></code></p>
@@ -567,7 +567,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -1038,7 +1038,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -1080,7 +1080,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.

docs/dyn/gkehub_v1.projects.locations.html

diff --git a/docs/dyn/gkehub_v1.projects.locations.html b/docs/dyn/gkehub_v1.projects.locations.html
index c65eabb..4b81dc4 100644
--- a/docs/dyn/gkehub_v1.projects.locations.html
+++ b/docs/dyn/gkehub_v1.projects.locations.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1.html">GKE Hub</a> . <a href="gkehub_v1.projects.html">projects</a> . <a href="gkehub_v1.projects.locations.html">locations</a></h1>
+<h1><a href="gkehub_v1.html">GKE Hub API</a> . <a href="gkehub_v1.projects.html">projects</a> . <a href="gkehub_v1.projects.locations.html">locations</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="gkehub_v1.projects.locations.features.html">features()</a></code>

docs/dyn/gkehub_v1.projects.locations.memberships.html

diff --git a/docs/dyn/gkehub_v1.projects.locations.memberships.html b/docs/dyn/gkehub_v1.projects.locations.memberships.html
index a131239..568403a 100644
--- a/docs/dyn/gkehub_v1.projects.locations.memberships.html
+++ b/docs/dyn/gkehub_v1.projects.locations.memberships.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1.html">GKE Hub</a> . <a href="gkehub_v1.projects.html">projects</a> . <a href="gkehub_v1.projects.locations.html">locations</a> . <a href="gkehub_v1.projects.locations.memberships.html">memberships</a></h1>
+<h1><a href="gkehub_v1.html">GKE Hub API</a> . <a href="gkehub_v1.projects.html">projects</a> . <a href="gkehub_v1.projects.locations.html">locations</a> . <a href="gkehub_v1.projects.locations.memberships.html">memberships</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="#close">close()</a></code></p>
@@ -326,7 +326,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -524,7 +524,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -566,7 +566,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.

docs/dyn/gkehub_v1.projects.locations.operations.html

diff --git a/docs/dyn/gkehub_v1.projects.locations.operations.html b/docs/dyn/gkehub_v1.projects.locations.operations.html
index c8fe208..004ea47 100644
--- a/docs/dyn/gkehub_v1.projects.locations.operations.html
+++ b/docs/dyn/gkehub_v1.projects.locations.operations.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1.html">GKE Hub</a> . <a href="gkehub_v1.projects.html">projects</a> . <a href="gkehub_v1.projects.locations.html">locations</a> . <a href="gkehub_v1.projects.locations.operations.html">operations</a></h1>
+<h1><a href="gkehub_v1.html">GKE Hub API</a> . <a href="gkehub_v1.projects.html">projects</a> . <a href="gkehub_v1.projects.locations.html">locations</a> . <a href="gkehub_v1.projects.locations.operations.html">operations</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="#cancel">cancel(name, body=None, x__xgafv=None)</a></code></p>

docs/dyn/gkehub_v1alpha.html

diff --git a/docs/dyn/gkehub_v1alpha.html b/docs/dyn/gkehub_v1alpha.html
index 5c5f483..ea095db 100644
--- a/docs/dyn/gkehub_v1alpha.html
+++ b/docs/dyn/gkehub_v1alpha.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1alpha.html">GKE Hub</a></h1>
+<h1><a href="gkehub_v1alpha.html">GKE Hub API</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="gkehub_v1alpha.projects.html">projects()</a></code>

docs/dyn/gkehub_v1alpha.projects.html

diff --git a/docs/dyn/gkehub_v1alpha.projects.html b/docs/dyn/gkehub_v1alpha.projects.html
index 42ce1ad..18a2c79 100644
--- a/docs/dyn/gkehub_v1alpha.projects.html
+++ b/docs/dyn/gkehub_v1alpha.projects.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1alpha.html">GKE Hub</a> . <a href="gkehub_v1alpha.projects.html">projects</a></h1>
+<h1><a href="gkehub_v1alpha.html">GKE Hub API</a> . <a href="gkehub_v1alpha.projects.html">projects</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="gkehub_v1alpha.projects.locations.html">locations()</a></code>

docs/dyn/gkehub_v1alpha.projects.locations.features.html

diff --git a/docs/dyn/gkehub_v1alpha.projects.locations.features.html b/docs/dyn/gkehub_v1alpha.projects.locations.features.html
index ea12dc2..1be2f78 100644
--- a/docs/dyn/gkehub_v1alpha.projects.locations.features.html
+++ b/docs/dyn/gkehub_v1alpha.projects.locations.features.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1alpha.html">GKE Hub</a> . <a href="gkehub_v1alpha.projects.html">projects</a> . <a href="gkehub_v1alpha.projects.locations.html">locations</a> . <a href="gkehub_v1alpha.projects.locations.features.html">features</a></h1>
+<h1><a href="gkehub_v1alpha.html">GKE Hub API</a> . <a href="gkehub_v1alpha.projects.html">projects</a> . <a href="gkehub_v1alpha.projects.locations.html">locations</a> . <a href="gkehub_v1alpha.projects.locations.features.html">features</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="#close">close()</a></code></p>
@@ -162,6 +162,27 @@
         },
         &quot;version&quot;: &quot;A String&quot;, # Version of ACM installed.
       },
+      &quot;identityservice&quot;: { # **Anthos Identity Service**: Configuration for a single Membership. # Identity Service-specific spec.
+        &quot;authMethods&quot;: [ # A member may support multiple auth methods.
+          { # Configuration of an auth method for a member/cluster. Only one authentication method (e.g., OIDC and LDAP) can be set per AuthMethod.
+            &quot;name&quot;: &quot;A String&quot;, # Identifier for auth config.
+            &quot;oidcConfig&quot;: { # Configuration for OIDC Auth flow. # OIDC specific configuration.
+              &quot;certificateAuthorityData&quot;: &quot;A String&quot;, # PEM-encoded CA for OIDC provider.
+              &quot;clientId&quot;: &quot;A String&quot;, # ID for OIDC client application.
+              &quot;deployCloudConsoleProxy&quot;: True or False, # Flag to denote if reverse proxy is used to connect to auth provider. This flag should be set to true when provider is not reachable by Google Cloud Console.
+              &quot;extraParams&quot;: &quot;A String&quot;, # Comma-separated list of key-value pairs.
+              &quot;groupPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to group name.
+              &quot;groupsClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds group information.
+              &quot;issuerUri&quot;: &quot;A String&quot;, # URI for the OIDC provider. This should point to the level below .well-known/openid-configuration.
+              &quot;kubectlRedirectUri&quot;: &quot;A String&quot;, # Registered redirect uri to redirect users going through OAuth flow using kubectl plugin.
+              &quot;scopes&quot;: &quot;A String&quot;, # Comma-separated list of identifiers.
+              &quot;userClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds username.
+              &quot;userPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to user name.
+            },
+            &quot;proxy&quot;: &quot;A String&quot;, # Proxy server address to use for auth method.
+          },
+        ],
+      },
     },
   },
   &quot;membershipStates&quot;: { # Output only. Membership-specific Feature status. If this Feature does report any per-Membership status, this field may be unused. The keys indicate which Membership the state is for, in the form: `projects/{p}/locations/{l}/memberships/{m}` Where {p} is the project number, {l} is a valid location and {m} is a valid Membership in this project at that location. {p} MUST match the Feature&#x27;s project number.
@@ -283,6 +304,32 @@
           },
         },
       },
+      &quot;identityservice&quot;: { # **Anthos Identity Service**: State for a single Membership. # Identity Service-specific state.
+        &quot;failureReason&quot;: &quot;A String&quot;, # The reason of the failure.
+        &quot;installedVersion&quot;: &quot;A String&quot;, # Installed AIS version. This is the AIS version installed on this member. The values makes sense iff state is OK.
+        &quot;memberConfig&quot;: { # **Anthos Identity Service**: Configuration for a single Membership. # Last reconciled membership configuration
+          &quot;authMethods&quot;: [ # A member may support multiple auth methods.
+            { # Configuration of an auth method for a member/cluster. Only one authentication method (e.g., OIDC and LDAP) can be set per AuthMethod.
+              &quot;name&quot;: &quot;A String&quot;, # Identifier for auth config.
+              &quot;oidcConfig&quot;: { # Configuration for OIDC Auth flow. # OIDC specific configuration.
+                &quot;certificateAuthorityData&quot;: &quot;A String&quot;, # PEM-encoded CA for OIDC provider.
+                &quot;clientId&quot;: &quot;A String&quot;, # ID for OIDC client application.
+                &quot;deployCloudConsoleProxy&quot;: True or False, # Flag to denote if reverse proxy is used to connect to auth provider. This flag should be set to true when provider is not reachable by Google Cloud Console.
+                &quot;extraParams&quot;: &quot;A String&quot;, # Comma-separated list of key-value pairs.
+                &quot;groupPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to group name.
+                &quot;groupsClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds group information.
+                &quot;issuerUri&quot;: &quot;A String&quot;, # URI for the OIDC provider. This should point to the level below .well-known/openid-configuration.
+                &quot;kubectlRedirectUri&quot;: &quot;A String&quot;, # Registered redirect uri to redirect users going through OAuth flow using kubectl plugin.
+                &quot;scopes&quot;: &quot;A String&quot;, # Comma-separated list of identifiers.
+                &quot;userClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds username.
+                &quot;userPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to user name.
+              },
+              &quot;proxy&quot;: &quot;A String&quot;, # Proxy server address to use for auth method.
+            },
+          ],
+        },
+        &quot;state&quot;: &quot;A String&quot;, # Deployment state on this member
+      },
       &quot;metering&quot;: { # **Metering**: Per-Membership Feature State. # Metering-specific spec.
         &quot;lastMeasurementTime&quot;: &quot;A String&quot;, # The time stamp of the most recent measurement of the number of vCPUs in the cluster.
         &quot;preciseLastMeasuredClusterVcpuCapacity&quot;: 3.14, # The vCPUs capacity in the cluster according to the most recent measurement (1/1000 precision).
@@ -486,6 +533,27 @@
         },
         &quot;version&quot;: &quot;A String&quot;, # Version of ACM installed.
       },
+      &quot;identityservice&quot;: { # **Anthos Identity Service**: Configuration for a single Membership. # Identity Service-specific spec.
+        &quot;authMethods&quot;: [ # A member may support multiple auth methods.
+          { # Configuration of an auth method for a member/cluster. Only one authentication method (e.g., OIDC and LDAP) can be set per AuthMethod.
+            &quot;name&quot;: &quot;A String&quot;, # Identifier for auth config.
+            &quot;oidcConfig&quot;: { # Configuration for OIDC Auth flow. # OIDC specific configuration.
+              &quot;certificateAuthorityData&quot;: &quot;A String&quot;, # PEM-encoded CA for OIDC provider.
+              &quot;clientId&quot;: &quot;A String&quot;, # ID for OIDC client application.
+              &quot;deployCloudConsoleProxy&quot;: True or False, # Flag to denote if reverse proxy is used to connect to auth provider. This flag should be set to true when provider is not reachable by Google Cloud Console.
+              &quot;extraParams&quot;: &quot;A String&quot;, # Comma-separated list of key-value pairs.
+              &quot;groupPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to group name.
+              &quot;groupsClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds group information.
+              &quot;issuerUri&quot;: &quot;A String&quot;, # URI for the OIDC provider. This should point to the level below .well-known/openid-configuration.
+              &quot;kubectlRedirectUri&quot;: &quot;A String&quot;, # Registered redirect uri to redirect users going through OAuth flow using kubectl plugin.
+              &quot;scopes&quot;: &quot;A String&quot;, # Comma-separated list of identifiers.
+              &quot;userClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds username.
+              &quot;userPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to user name.
+            },
+            &quot;proxy&quot;: &quot;A String&quot;, # Proxy server address to use for auth method.
+          },
+        ],
+      },
     },
   },
   &quot;membershipStates&quot;: { # Output only. Membership-specific Feature status. If this Feature does report any per-Membership status, this field may be unused. The keys indicate which Membership the state is for, in the form: `projects/{p}/locations/{l}/memberships/{m}` Where {p} is the project number, {l} is a valid location and {m} is a valid Membership in this project at that location. {p} MUST match the Feature&#x27;s project number.
@@ -607,6 +675,32 @@
           },
         },
       },
+      &quot;identityservice&quot;: { # **Anthos Identity Service**: State for a single Membership. # Identity Service-specific state.
+        &quot;failureReason&quot;: &quot;A String&quot;, # The reason of the failure.
+        &quot;installedVersion&quot;: &quot;A String&quot;, # Installed AIS version. This is the AIS version installed on this member. The values makes sense iff state is OK.
+        &quot;memberConfig&quot;: { # **Anthos Identity Service**: Configuration for a single Membership. # Last reconciled membership configuration
+          &quot;authMethods&quot;: [ # A member may support multiple auth methods.
+            { # Configuration of an auth method for a member/cluster. Only one authentication method (e.g., OIDC and LDAP) can be set per AuthMethod.
+              &quot;name&quot;: &quot;A String&quot;, # Identifier for auth config.
+              &quot;oidcConfig&quot;: { # Configuration for OIDC Auth flow. # OIDC specific configuration.
+                &quot;certificateAuthorityData&quot;: &quot;A String&quot;, # PEM-encoded CA for OIDC provider.
+                &quot;clientId&quot;: &quot;A String&quot;, # ID for OIDC client application.
+                &quot;deployCloudConsoleProxy&quot;: True or False, # Flag to denote if reverse proxy is used to connect to auth provider. This flag should be set to true when provider is not reachable by Google Cloud Console.
+                &quot;extraParams&quot;: &quot;A String&quot;, # Comma-separated list of key-value pairs.
+                &quot;groupPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to group name.
+                &quot;groupsClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds group information.
+                &quot;issuerUri&quot;: &quot;A String&quot;, # URI for the OIDC provider. This should point to the level below .well-known/openid-configuration.
+                &quot;kubectlRedirectUri&quot;: &quot;A String&quot;, # Registered redirect uri to redirect users going through OAuth flow using kubectl plugin.
+                &quot;scopes&quot;: &quot;A String&quot;, # Comma-separated list of identifiers.
+                &quot;userClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds username.
+                &quot;userPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to user name.
+              },
+              &quot;proxy&quot;: &quot;A String&quot;, # Proxy server address to use for auth method.
+            },
+          ],
+        },
+        &quot;state&quot;: &quot;A String&quot;, # Deployment state on this member
+      },
       &quot;metering&quot;: { # **Metering**: Per-Membership Feature State. # Metering-specific spec.
         &quot;lastMeasurementTime&quot;: &quot;A String&quot;, # The time stamp of the most recent measurement of the number of vCPUs in the cluster.
         &quot;preciseLastMeasuredClusterVcpuCapacity&quot;: 3.14, # The vCPUs capacity in the cluster according to the most recent measurement (1/1000 precision).
@@ -701,7 +795,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -798,6 +892,27 @@
             },
             &quot;version&quot;: &quot;A String&quot;, # Version of ACM installed.
           },
+          &quot;identityservice&quot;: { # **Anthos Identity Service**: Configuration for a single Membership. # Identity Service-specific spec.
+            &quot;authMethods&quot;: [ # A member may support multiple auth methods.
+              { # Configuration of an auth method for a member/cluster. Only one authentication method (e.g., OIDC and LDAP) can be set per AuthMethod.
+                &quot;name&quot;: &quot;A String&quot;, # Identifier for auth config.
+                &quot;oidcConfig&quot;: { # Configuration for OIDC Auth flow. # OIDC specific configuration.
+                  &quot;certificateAuthorityData&quot;: &quot;A String&quot;, # PEM-encoded CA for OIDC provider.
+                  &quot;clientId&quot;: &quot;A String&quot;, # ID for OIDC client application.
+                  &quot;deployCloudConsoleProxy&quot;: True or False, # Flag to denote if reverse proxy is used to connect to auth provider. This flag should be set to true when provider is not reachable by Google Cloud Console.
+                  &quot;extraParams&quot;: &quot;A String&quot;, # Comma-separated list of key-value pairs.
+                  &quot;groupPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to group name.
+                  &quot;groupsClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds group information.
+                  &quot;issuerUri&quot;: &quot;A String&quot;, # URI for the OIDC provider. This should point to the level below .well-known/openid-configuration.
+                  &quot;kubectlRedirectUri&quot;: &quot;A String&quot;, # Registered redirect uri to redirect users going through OAuth flow using kubectl plugin.
+                  &quot;scopes&quot;: &quot;A String&quot;, # Comma-separated list of identifiers.
+                  &quot;userClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds username.
+                  &quot;userPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to user name.
+                },
+                &quot;proxy&quot;: &quot;A String&quot;, # Proxy server address to use for auth method.
+              },
+            ],
+          },
         },
       },
       &quot;membershipStates&quot;: { # Output only. Membership-specific Feature status. If this Feature does report any per-Membership status, this field may be unused. The keys indicate which Membership the state is for, in the form: `projects/{p}/locations/{l}/memberships/{m}` Where {p} is the project number, {l} is a valid location and {m} is a valid Membership in this project at that location. {p} MUST match the Feature&#x27;s project number.
@@ -919,6 +1034,32 @@
               },
             },
           },
+          &quot;identityservice&quot;: { # **Anthos Identity Service**: State for a single Membership. # Identity Service-specific state.
+            &quot;failureReason&quot;: &quot;A String&quot;, # The reason of the failure.
+            &quot;installedVersion&quot;: &quot;A String&quot;, # Installed AIS version. This is the AIS version installed on this member. The values makes sense iff state is OK.
+            &quot;memberConfig&quot;: { # **Anthos Identity Service**: Configuration for a single Membership. # Last reconciled membership configuration
+              &quot;authMethods&quot;: [ # A member may support multiple auth methods.
+                { # Configuration of an auth method for a member/cluster. Only one authentication method (e.g., OIDC and LDAP) can be set per AuthMethod.
+                  &quot;name&quot;: &quot;A String&quot;, # Identifier for auth config.
+                  &quot;oidcConfig&quot;: { # Configuration for OIDC Auth flow. # OIDC specific configuration.
+                    &quot;certificateAuthorityData&quot;: &quot;A String&quot;, # PEM-encoded CA for OIDC provider.
+                    &quot;clientId&quot;: &quot;A String&quot;, # ID for OIDC client application.
+                    &quot;deployCloudConsoleProxy&quot;: True or False, # Flag to denote if reverse proxy is used to connect to auth provider. This flag should be set to true when provider is not reachable by Google Cloud Console.
+                    &quot;extraParams&quot;: &quot;A String&quot;, # Comma-separated list of key-value pairs.
+                    &quot;groupPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to group name.
+                    &quot;groupsClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds group information.
+                    &quot;issuerUri&quot;: &quot;A String&quot;, # URI for the OIDC provider. This should point to the level below .well-known/openid-configuration.
+                    &quot;kubectlRedirectUri&quot;: &quot;A String&quot;, # Registered redirect uri to redirect users going through OAuth flow using kubectl plugin.
+                    &quot;scopes&quot;: &quot;A String&quot;, # Comma-separated list of identifiers.
+                    &quot;userClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds username.
+                    &quot;userPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to user name.
+                  },
+                  &quot;proxy&quot;: &quot;A String&quot;, # Proxy server address to use for auth method.
+                },
+              ],
+            },
+            &quot;state&quot;: &quot;A String&quot;, # Deployment state on this member
+          },
           &quot;metering&quot;: { # **Metering**: Per-Membership Feature State. # Metering-specific spec.
             &quot;lastMeasurementTime&quot;: &quot;A String&quot;, # The time stamp of the most recent measurement of the number of vCPUs in the cluster.
             &quot;preciseLastMeasuredClusterVcpuCapacity&quot;: 3.14, # The vCPUs capacity in the cluster according to the most recent measurement (1/1000 precision).
@@ -1066,6 +1207,27 @@
         },
         &quot;version&quot;: &quot;A String&quot;, # Version of ACM installed.
       },
+      &quot;identityservice&quot;: { # **Anthos Identity Service**: Configuration for a single Membership. # Identity Service-specific spec.
+        &quot;authMethods&quot;: [ # A member may support multiple auth methods.
+          { # Configuration of an auth method for a member/cluster. Only one authentication method (e.g., OIDC and LDAP) can be set per AuthMethod.
+            &quot;name&quot;: &quot;A String&quot;, # Identifier for auth config.
+            &quot;oidcConfig&quot;: { # Configuration for OIDC Auth flow. # OIDC specific configuration.
+              &quot;certificateAuthorityData&quot;: &quot;A String&quot;, # PEM-encoded CA for OIDC provider.
+              &quot;clientId&quot;: &quot;A String&quot;, # ID for OIDC client application.
+              &quot;deployCloudConsoleProxy&quot;: True or False, # Flag to denote if reverse proxy is used to connect to auth provider. This flag should be set to true when provider is not reachable by Google Cloud Console.
+              &quot;extraParams&quot;: &quot;A String&quot;, # Comma-separated list of key-value pairs.
+              &quot;groupPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to group name.
+              &quot;groupsClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds group information.
+              &quot;issuerUri&quot;: &quot;A String&quot;, # URI for the OIDC provider. This should point to the level below .well-known/openid-configuration.
+              &quot;kubectlRedirectUri&quot;: &quot;A String&quot;, # Registered redirect uri to redirect users going through OAuth flow using kubectl plugin.
+              &quot;scopes&quot;: &quot;A String&quot;, # Comma-separated list of identifiers.
+              &quot;userClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds username.
+              &quot;userPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to user name.
+            },
+            &quot;proxy&quot;: &quot;A String&quot;, # Proxy server address to use for auth method.
+          },
+        ],
+      },
     },
   },
   &quot;membershipStates&quot;: { # Output only. Membership-specific Feature status. If this Feature does report any per-Membership status, this field may be unused. The keys indicate which Membership the state is for, in the form: `projects/{p}/locations/{l}/memberships/{m}` Where {p} is the project number, {l} is a valid location and {m} is a valid Membership in this project at that location. {p} MUST match the Feature&#x27;s project number.
@@ -1187,6 +1349,32 @@
           },
         },
       },
+      &quot;identityservice&quot;: { # **Anthos Identity Service**: State for a single Membership. # Identity Service-specific state.
+        &quot;failureReason&quot;: &quot;A String&quot;, # The reason of the failure.
+        &quot;installedVersion&quot;: &quot;A String&quot;, # Installed AIS version. This is the AIS version installed on this member. The values makes sense iff state is OK.
+        &quot;memberConfig&quot;: { # **Anthos Identity Service**: Configuration for a single Membership. # Last reconciled membership configuration
+          &quot;authMethods&quot;: [ # A member may support multiple auth methods.
+            { # Configuration of an auth method for a member/cluster. Only one authentication method (e.g., OIDC and LDAP) can be set per AuthMethod.
+              &quot;name&quot;: &quot;A String&quot;, # Identifier for auth config.
+              &quot;oidcConfig&quot;: { # Configuration for OIDC Auth flow. # OIDC specific configuration.
+                &quot;certificateAuthorityData&quot;: &quot;A String&quot;, # PEM-encoded CA for OIDC provider.
+                &quot;clientId&quot;: &quot;A String&quot;, # ID for OIDC client application.
+                &quot;deployCloudConsoleProxy&quot;: True or False, # Flag to denote if reverse proxy is used to connect to auth provider. This flag should be set to true when provider is not reachable by Google Cloud Console.
+                &quot;extraParams&quot;: &quot;A String&quot;, # Comma-separated list of key-value pairs.
+                &quot;groupPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to group name.
+                &quot;groupsClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds group information.
+                &quot;issuerUri&quot;: &quot;A String&quot;, # URI for the OIDC provider. This should point to the level below .well-known/openid-configuration.
+                &quot;kubectlRedirectUri&quot;: &quot;A String&quot;, # Registered redirect uri to redirect users going through OAuth flow using kubectl plugin.
+                &quot;scopes&quot;: &quot;A String&quot;, # Comma-separated list of identifiers.
+                &quot;userClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds username.
+                &quot;userPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to user name.
+              },
+              &quot;proxy&quot;: &quot;A String&quot;, # Proxy server address to use for auth method.
+            },
+          ],
+        },
+        &quot;state&quot;: &quot;A String&quot;, # Deployment state on this member
+      },
       &quot;metering&quot;: { # **Metering**: Per-Membership Feature State. # Metering-specific spec.
         &quot;lastMeasurementTime&quot;: &quot;A String&quot;, # The time stamp of the most recent measurement of the number of vCPUs in the cluster.
         &quot;preciseLastMeasuredClusterVcpuCapacity&quot;: 3.14, # The vCPUs capacity in the cluster according to the most recent measurement (1/1000 precision).
@@ -1306,7 +1494,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -1348,7 +1536,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.

docs/dyn/gkehub_v1alpha.projects.locations.html

diff --git a/docs/dyn/gkehub_v1alpha.projects.locations.html b/docs/dyn/gkehub_v1alpha.projects.locations.html
index 81cc96a..57eabce 100644
--- a/docs/dyn/gkehub_v1alpha.projects.locations.html
+++ b/docs/dyn/gkehub_v1alpha.projects.locations.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1alpha.html">GKE Hub</a> . <a href="gkehub_v1alpha.projects.html">projects</a> . <a href="gkehub_v1alpha.projects.locations.html">locations</a></h1>
+<h1><a href="gkehub_v1alpha.html">GKE Hub API</a> . <a href="gkehub_v1alpha.projects.html">projects</a> . <a href="gkehub_v1alpha.projects.locations.html">locations</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="gkehub_v1alpha.projects.locations.features.html">features()</a></code>

docs/dyn/gkehub_v1alpha.projects.locations.memberships.html

diff --git a/docs/dyn/gkehub_v1alpha.projects.locations.memberships.html b/docs/dyn/gkehub_v1alpha.projects.locations.memberships.html
index 90fd97e..5f6383c 100644
--- a/docs/dyn/gkehub_v1alpha.projects.locations.memberships.html
+++ b/docs/dyn/gkehub_v1alpha.projects.locations.memberships.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1alpha.html">GKE Hub</a> . <a href="gkehub_v1alpha.projects.html">projects</a> . <a href="gkehub_v1alpha.projects.locations.html">locations</a> . <a href="gkehub_v1alpha.projects.locations.memberships.html">memberships</a></h1>
+<h1><a href="gkehub_v1alpha.html">GKE Hub API</a> . <a href="gkehub_v1alpha.projects.html">projects</a> . <a href="gkehub_v1alpha.projects.locations.html">locations</a> . <a href="gkehub_v1alpha.projects.locations.memberships.html">memberships</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="#close">close()</a></code></p>
@@ -107,7 +107,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -150,7 +150,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -192,7 +192,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.

docs/dyn/gkehub_v1alpha.projects.locations.operations.html

diff --git a/docs/dyn/gkehub_v1alpha.projects.locations.operations.html b/docs/dyn/gkehub_v1alpha.projects.locations.operations.html
index 99f68d1..6b1349f 100644
--- a/docs/dyn/gkehub_v1alpha.projects.locations.operations.html
+++ b/docs/dyn/gkehub_v1alpha.projects.locations.operations.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1alpha.html">GKE Hub</a> . <a href="gkehub_v1alpha.projects.html">projects</a> . <a href="gkehub_v1alpha.projects.locations.html">locations</a> . <a href="gkehub_v1alpha.projects.locations.operations.html">operations</a></h1>
+<h1><a href="gkehub_v1alpha.html">GKE Hub API</a> . <a href="gkehub_v1alpha.projects.html">projects</a> . <a href="gkehub_v1alpha.projects.locations.html">locations</a> . <a href="gkehub_v1alpha.projects.locations.operations.html">operations</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="#cancel">cancel(name, body=None, x__xgafv=None)</a></code></p>

docs/dyn/gkehub_v1alpha2.html

diff --git a/docs/dyn/gkehub_v1alpha2.html b/docs/dyn/gkehub_v1alpha2.html
index 167e045..d43f5e5 100644
--- a/docs/dyn/gkehub_v1alpha2.html
+++ b/docs/dyn/gkehub_v1alpha2.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1alpha2.html">GKE Hub</a></h1>
+<h1><a href="gkehub_v1alpha2.html">GKE Hub API</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="gkehub_v1alpha2.projects.html">projects()</a></code>

docs/dyn/gkehub_v1alpha2.projects.html

diff --git a/docs/dyn/gkehub_v1alpha2.projects.html b/docs/dyn/gkehub_v1alpha2.projects.html
index 3032d5e..453dcd6 100644
--- a/docs/dyn/gkehub_v1alpha2.projects.html
+++ b/docs/dyn/gkehub_v1alpha2.projects.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1alpha2.html">GKE Hub</a> . <a href="gkehub_v1alpha2.projects.html">projects</a></h1>
+<h1><a href="gkehub_v1alpha2.html">GKE Hub API</a> . <a href="gkehub_v1alpha2.projects.html">projects</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="gkehub_v1alpha2.projects.locations.html">locations()</a></code>

docs/dyn/gkehub_v1alpha2.projects.locations.global_.html

diff --git a/docs/dyn/gkehub_v1alpha2.projects.locations.global_.html b/docs/dyn/gkehub_v1alpha2.projects.locations.global_.html
index da72384..6ca15b5 100644
--- a/docs/dyn/gkehub_v1alpha2.projects.locations.global_.html
+++ b/docs/dyn/gkehub_v1alpha2.projects.locations.global_.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1alpha2.html">GKE Hub</a> . <a href="gkehub_v1alpha2.projects.html">projects</a> . <a href="gkehub_v1alpha2.projects.locations.html">locations</a> . <a href="gkehub_v1alpha2.projects.locations.global_.html">global_</a></h1>
+<h1><a href="gkehub_v1alpha2.html">GKE Hub API</a> . <a href="gkehub_v1alpha2.projects.html">projects</a> . <a href="gkehub_v1alpha2.projects.locations.html">locations</a> . <a href="gkehub_v1alpha2.projects.locations.global_.html">global_</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="gkehub_v1alpha2.projects.locations.global_.memberships.html">memberships()</a></code>

docs/dyn/gkehub_v1alpha2.projects.locations.global_.memberships.html

diff --git a/docs/dyn/gkehub_v1alpha2.projects.locations.global_.memberships.html b/docs/dyn/gkehub_v1alpha2.projects.locations.global_.memberships.html
index 82c7515..b6822d0 100644
--- a/docs/dyn/gkehub_v1alpha2.projects.locations.global_.memberships.html
+++ b/docs/dyn/gkehub_v1alpha2.projects.locations.global_.memberships.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1alpha2.html">GKE Hub</a> . <a href="gkehub_v1alpha2.projects.html">projects</a> . <a href="gkehub_v1alpha2.projects.locations.html">locations</a> . <a href="gkehub_v1alpha2.projects.locations.global_.html">global_</a> . <a href="gkehub_v1alpha2.projects.locations.global_.memberships.html">memberships</a></h1>
+<h1><a href="gkehub_v1alpha2.html">GKE Hub API</a> . <a href="gkehub_v1alpha2.projects.html">projects</a> . <a href="gkehub_v1alpha2.projects.locations.html">locations</a> . <a href="gkehub_v1alpha2.projects.locations.global_.html">global_</a> . <a href="gkehub_v1alpha2.projects.locations.global_.memberships.html">memberships</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="#close">close()</a></code></p>

docs/dyn/gkehub_v1alpha2.projects.locations.html

diff --git a/docs/dyn/gkehub_v1alpha2.projects.locations.html b/docs/dyn/gkehub_v1alpha2.projects.locations.html
index bbd99de..8148340 100644
--- a/docs/dyn/gkehub_v1alpha2.projects.locations.html
+++ b/docs/dyn/gkehub_v1alpha2.projects.locations.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1alpha2.html">GKE Hub</a> . <a href="gkehub_v1alpha2.projects.html">projects</a> . <a href="gkehub_v1alpha2.projects.locations.html">locations</a></h1>
+<h1><a href="gkehub_v1alpha2.html">GKE Hub API</a> . <a href="gkehub_v1alpha2.projects.html">projects</a> . <a href="gkehub_v1alpha2.projects.locations.html">locations</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="gkehub_v1alpha2.projects.locations.global_.html">global_()</a></code>

docs/dyn/gkehub_v1alpha2.projects.locations.memberships.html

diff --git a/docs/dyn/gkehub_v1alpha2.projects.locations.memberships.html b/docs/dyn/gkehub_v1alpha2.projects.locations.memberships.html
index 4fa934a..6595024 100644
--- a/docs/dyn/gkehub_v1alpha2.projects.locations.memberships.html
+++ b/docs/dyn/gkehub_v1alpha2.projects.locations.memberships.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1alpha2.html">GKE Hub</a> . <a href="gkehub_v1alpha2.projects.html">projects</a> . <a href="gkehub_v1alpha2.projects.locations.html">locations</a> . <a href="gkehub_v1alpha2.projects.locations.memberships.html">memberships</a></h1>
+<h1><a href="gkehub_v1alpha2.html">GKE Hub API</a> . <a href="gkehub_v1alpha2.projects.html">projects</a> . <a href="gkehub_v1alpha2.projects.locations.html">locations</a> . <a href="gkehub_v1alpha2.projects.locations.memberships.html">memberships</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="#close">close()</a></code></p>
@@ -364,7 +364,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -601,7 +601,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -643,7 +643,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.

docs/dyn/gkehub_v1alpha2.projects.locations.operations.html

diff --git a/docs/dyn/gkehub_v1alpha2.projects.locations.operations.html b/docs/dyn/gkehub_v1alpha2.projects.locations.operations.html
index 124280d..142f911 100644
--- a/docs/dyn/gkehub_v1alpha2.projects.locations.operations.html
+++ b/docs/dyn/gkehub_v1alpha2.projects.locations.operations.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1alpha2.html">GKE Hub</a> . <a href="gkehub_v1alpha2.projects.html">projects</a> . <a href="gkehub_v1alpha2.projects.locations.html">locations</a> . <a href="gkehub_v1alpha2.projects.locations.operations.html">operations</a></h1>
+<h1><a href="gkehub_v1alpha2.html">GKE Hub API</a> . <a href="gkehub_v1alpha2.projects.html">projects</a> . <a href="gkehub_v1alpha2.projects.locations.html">locations</a> . <a href="gkehub_v1alpha2.projects.locations.operations.html">operations</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="#cancel">cancel(name, body=None, x__xgafv=None)</a></code></p>

docs/dyn/gkehub_v1beta.html

diff --git a/docs/dyn/gkehub_v1beta.html b/docs/dyn/gkehub_v1beta.html
index b3a071e..bbf8920 100644
--- a/docs/dyn/gkehub_v1beta.html
+++ b/docs/dyn/gkehub_v1beta.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1beta.html">GKE Hub</a></h1>
+<h1><a href="gkehub_v1beta.html">GKE Hub API</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="gkehub_v1beta.projects.html">projects()</a></code>

docs/dyn/gkehub_v1beta.projects.html

diff --git a/docs/dyn/gkehub_v1beta.projects.html b/docs/dyn/gkehub_v1beta.projects.html
index 5f8d5be..e410053 100644
--- a/docs/dyn/gkehub_v1beta.projects.html
+++ b/docs/dyn/gkehub_v1beta.projects.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1beta.html">GKE Hub</a> . <a href="gkehub_v1beta.projects.html">projects</a></h1>
+<h1><a href="gkehub_v1beta.html">GKE Hub API</a> . <a href="gkehub_v1beta.projects.html">projects</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="gkehub_v1beta.projects.locations.html">locations()</a></code>

docs/dyn/gkehub_v1beta.projects.locations.features.html

diff --git a/docs/dyn/gkehub_v1beta.projects.locations.features.html b/docs/dyn/gkehub_v1beta.projects.locations.features.html
index 0e5e60d..7fe99b6 100644
--- a/docs/dyn/gkehub_v1beta.projects.locations.features.html
+++ b/docs/dyn/gkehub_v1beta.projects.locations.features.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1beta.html">GKE Hub</a> . <a href="gkehub_v1beta.projects.html">projects</a> . <a href="gkehub_v1beta.projects.locations.html">locations</a> . <a href="gkehub_v1beta.projects.locations.features.html">features</a></h1>
+<h1><a href="gkehub_v1beta.html">GKE Hub API</a> . <a href="gkehub_v1beta.projects.html">projects</a> . <a href="gkehub_v1beta.projects.locations.html">locations</a> . <a href="gkehub_v1beta.projects.locations.features.html">features</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="#close">close()</a></code></p>
@@ -161,6 +161,27 @@
         },
         &quot;version&quot;: &quot;A String&quot;, # Version of ACM installed.
       },
+      &quot;identityservice&quot;: { # **Anthos Identity Service**: Configuration for a single Membership. # Identity Service-specific spec.
+        &quot;authMethods&quot;: [ # A member may support multiple auth methods.
+          { # Configuration of an auth method for a member/cluster. Only one authentication method (e.g., OIDC and LDAP) can be set per AuthMethod.
+            &quot;name&quot;: &quot;A String&quot;, # Identifier for auth config.
+            &quot;oidcConfig&quot;: { # Configuration for OIDC Auth flow. # OIDC specific configuration.
+              &quot;certificateAuthorityData&quot;: &quot;A String&quot;, # PEM-encoded CA for OIDC provider.
+              &quot;clientId&quot;: &quot;A String&quot;, # ID for OIDC client application.
+              &quot;deployCloudConsoleProxy&quot;: True or False, # Flag to denote if reverse proxy is used to connect to auth provider. This flag should be set to true when provider is not reachable by Google Cloud Console.
+              &quot;extraParams&quot;: &quot;A String&quot;, # Comma-separated list of key-value pairs.
+              &quot;groupPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to group name.
+              &quot;groupsClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds group information.
+              &quot;issuerUri&quot;: &quot;A String&quot;, # URI for the OIDC provider. This should point to the level below .well-known/openid-configuration.
+              &quot;kubectlRedirectUri&quot;: &quot;A String&quot;, # Registered redirect uri to redirect users going through OAuth flow using kubectl plugin.
+              &quot;scopes&quot;: &quot;A String&quot;, # Comma-separated list of identifiers.
+              &quot;userClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds username.
+              &quot;userPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to user name.
+            },
+            &quot;proxy&quot;: &quot;A String&quot;, # Proxy server address to use for auth method.
+          },
+        ],
+      },
     },
   },
   &quot;membershipStates&quot;: { # Output only. Membership-specific Feature status. If this Feature does report any per-Membership status, this field may be unused. The keys indicate which Membership the state is for, in the form: `projects/{p}/locations/{l}/memberships/{m}` Where {p} is the project number, {l} is a valid location and {m} is a valid Membership in this project at that location. {p} MUST match the Feature&#x27;s project number.
@@ -280,6 +301,32 @@
           },
         },
       },
+      &quot;identityservice&quot;: { # **Anthos Identity Service**: State for a single Membership. # Identity Service-specific state.
+        &quot;failureReason&quot;: &quot;A String&quot;, # The reason of the failure.
+        &quot;installedVersion&quot;: &quot;A String&quot;, # Installed AIS version. This is the AIS version installed on this member. The values makes sense iff state is OK.
+        &quot;memberConfig&quot;: { # **Anthos Identity Service**: Configuration for a single Membership. # Last reconciled membership configuration
+          &quot;authMethods&quot;: [ # A member may support multiple auth methods.
+            { # Configuration of an auth method for a member/cluster. Only one authentication method (e.g., OIDC and LDAP) can be set per AuthMethod.
+              &quot;name&quot;: &quot;A String&quot;, # Identifier for auth config.
+              &quot;oidcConfig&quot;: { # Configuration for OIDC Auth flow. # OIDC specific configuration.
+                &quot;certificateAuthorityData&quot;: &quot;A String&quot;, # PEM-encoded CA for OIDC provider.
+                &quot;clientId&quot;: &quot;A String&quot;, # ID for OIDC client application.
+                &quot;deployCloudConsoleProxy&quot;: True or False, # Flag to denote if reverse proxy is used to connect to auth provider. This flag should be set to true when provider is not reachable by Google Cloud Console.
+                &quot;extraParams&quot;: &quot;A String&quot;, # Comma-separated list of key-value pairs.
+                &quot;groupPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to group name.
+                &quot;groupsClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds group information.
+                &quot;issuerUri&quot;: &quot;A String&quot;, # URI for the OIDC provider. This should point to the level below .well-known/openid-configuration.
+                &quot;kubectlRedirectUri&quot;: &quot;A String&quot;, # Registered redirect uri to redirect users going through OAuth flow using kubectl plugin.
+                &quot;scopes&quot;: &quot;A String&quot;, # Comma-separated list of identifiers.
+                &quot;userClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds username.
+                &quot;userPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to user name.
+              },
+              &quot;proxy&quot;: &quot;A String&quot;, # Proxy server address to use for auth method.
+            },
+          ],
+        },
+        &quot;state&quot;: &quot;A String&quot;, # Deployment state on this member
+      },
       &quot;metering&quot;: { # **Metering**: Per-Membership Feature State. # Metering-specific spec.
         &quot;lastMeasurementTime&quot;: &quot;A String&quot;, # The time stamp of the most recent measurement of the number of vCPUs in the cluster.
         &quot;preciseLastMeasuredClusterVcpuCapacity&quot;: 3.14, # The vCPUs capacity in the cluster according to the most recent measurement (1/1000 precision).
@@ -435,6 +482,27 @@
         },
         &quot;version&quot;: &quot;A String&quot;, # Version of ACM installed.
       },
+      &quot;identityservice&quot;: { # **Anthos Identity Service**: Configuration for a single Membership. # Identity Service-specific spec.
+        &quot;authMethods&quot;: [ # A member may support multiple auth methods.
+          { # Configuration of an auth method for a member/cluster. Only one authentication method (e.g., OIDC and LDAP) can be set per AuthMethod.
+            &quot;name&quot;: &quot;A String&quot;, # Identifier for auth config.
+            &quot;oidcConfig&quot;: { # Configuration for OIDC Auth flow. # OIDC specific configuration.
+              &quot;certificateAuthorityData&quot;: &quot;A String&quot;, # PEM-encoded CA for OIDC provider.
+              &quot;clientId&quot;: &quot;A String&quot;, # ID for OIDC client application.
+              &quot;deployCloudConsoleProxy&quot;: True or False, # Flag to denote if reverse proxy is used to connect to auth provider. This flag should be set to true when provider is not reachable by Google Cloud Console.
+              &quot;extraParams&quot;: &quot;A String&quot;, # Comma-separated list of key-value pairs.
+              &quot;groupPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to group name.
+              &quot;groupsClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds group information.
+              &quot;issuerUri&quot;: &quot;A String&quot;, # URI for the OIDC provider. This should point to the level below .well-known/openid-configuration.
+              &quot;kubectlRedirectUri&quot;: &quot;A String&quot;, # Registered redirect uri to redirect users going through OAuth flow using kubectl plugin.
+              &quot;scopes&quot;: &quot;A String&quot;, # Comma-separated list of identifiers.
+              &quot;userClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds username.
+              &quot;userPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to user name.
+            },
+            &quot;proxy&quot;: &quot;A String&quot;, # Proxy server address to use for auth method.
+          },
+        ],
+      },
     },
   },
   &quot;membershipStates&quot;: { # Output only. Membership-specific Feature status. If this Feature does report any per-Membership status, this field may be unused. The keys indicate which Membership the state is for, in the form: `projects/{p}/locations/{l}/memberships/{m}` Where {p} is the project number, {l} is a valid location and {m} is a valid Membership in this project at that location. {p} MUST match the Feature&#x27;s project number.
@@ -554,6 +622,32 @@
           },
         },
       },
+      &quot;identityservice&quot;: { # **Anthos Identity Service**: State for a single Membership. # Identity Service-specific state.
+        &quot;failureReason&quot;: &quot;A String&quot;, # The reason of the failure.
+        &quot;installedVersion&quot;: &quot;A String&quot;, # Installed AIS version. This is the AIS version installed on this member. The values makes sense iff state is OK.
+        &quot;memberConfig&quot;: { # **Anthos Identity Service**: Configuration for a single Membership. # Last reconciled membership configuration
+          &quot;authMethods&quot;: [ # A member may support multiple auth methods.
+            { # Configuration of an auth method for a member/cluster. Only one authentication method (e.g., OIDC and LDAP) can be set per AuthMethod.
+              &quot;name&quot;: &quot;A String&quot;, # Identifier for auth config.
+              &quot;oidcConfig&quot;: { # Configuration for OIDC Auth flow. # OIDC specific configuration.
+                &quot;certificateAuthorityData&quot;: &quot;A String&quot;, # PEM-encoded CA for OIDC provider.
+                &quot;clientId&quot;: &quot;A String&quot;, # ID for OIDC client application.
+                &quot;deployCloudConsoleProxy&quot;: True or False, # Flag to denote if reverse proxy is used to connect to auth provider. This flag should be set to true when provider is not reachable by Google Cloud Console.
+                &quot;extraParams&quot;: &quot;A String&quot;, # Comma-separated list of key-value pairs.
+                &quot;groupPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to group name.
+                &quot;groupsClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds group information.
+                &quot;issuerUri&quot;: &quot;A String&quot;, # URI for the OIDC provider. This should point to the level below .well-known/openid-configuration.
+                &quot;kubectlRedirectUri&quot;: &quot;A String&quot;, # Registered redirect uri to redirect users going through OAuth flow using kubectl plugin.
+                &quot;scopes&quot;: &quot;A String&quot;, # Comma-separated list of identifiers.
+                &quot;userClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds username.
+                &quot;userPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to user name.
+              },
+              &quot;proxy&quot;: &quot;A String&quot;, # Proxy server address to use for auth method.
+            },
+          ],
+        },
+        &quot;state&quot;: &quot;A String&quot;, # Deployment state on this member
+      },
       &quot;metering&quot;: { # **Metering**: Per-Membership Feature State. # Metering-specific spec.
         &quot;lastMeasurementTime&quot;: &quot;A String&quot;, # The time stamp of the most recent measurement of the number of vCPUs in the cluster.
         &quot;preciseLastMeasuredClusterVcpuCapacity&quot;: 3.14, # The vCPUs capacity in the cluster according to the most recent measurement (1/1000 precision).
@@ -601,7 +695,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -697,6 +791,27 @@
             },
             &quot;version&quot;: &quot;A String&quot;, # Version of ACM installed.
           },
+          &quot;identityservice&quot;: { # **Anthos Identity Service**: Configuration for a single Membership. # Identity Service-specific spec.
+            &quot;authMethods&quot;: [ # A member may support multiple auth methods.
+              { # Configuration of an auth method for a member/cluster. Only one authentication method (e.g., OIDC and LDAP) can be set per AuthMethod.
+                &quot;name&quot;: &quot;A String&quot;, # Identifier for auth config.
+                &quot;oidcConfig&quot;: { # Configuration for OIDC Auth flow. # OIDC specific configuration.
+                  &quot;certificateAuthorityData&quot;: &quot;A String&quot;, # PEM-encoded CA for OIDC provider.
+                  &quot;clientId&quot;: &quot;A String&quot;, # ID for OIDC client application.
+                  &quot;deployCloudConsoleProxy&quot;: True or False, # Flag to denote if reverse proxy is used to connect to auth provider. This flag should be set to true when provider is not reachable by Google Cloud Console.
+                  &quot;extraParams&quot;: &quot;A String&quot;, # Comma-separated list of key-value pairs.
+                  &quot;groupPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to group name.
+                  &quot;groupsClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds group information.
+                  &quot;issuerUri&quot;: &quot;A String&quot;, # URI for the OIDC provider. This should point to the level below .well-known/openid-configuration.
+                  &quot;kubectlRedirectUri&quot;: &quot;A String&quot;, # Registered redirect uri to redirect users going through OAuth flow using kubectl plugin.
+                  &quot;scopes&quot;: &quot;A String&quot;, # Comma-separated list of identifiers.
+                  &quot;userClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds username.
+                  &quot;userPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to user name.
+                },
+                &quot;proxy&quot;: &quot;A String&quot;, # Proxy server address to use for auth method.
+              },
+            ],
+          },
         },
       },
       &quot;membershipStates&quot;: { # Output only. Membership-specific Feature status. If this Feature does report any per-Membership status, this field may be unused. The keys indicate which Membership the state is for, in the form: `projects/{p}/locations/{l}/memberships/{m}` Where {p} is the project number, {l} is a valid location and {m} is a valid Membership in this project at that location. {p} MUST match the Feature&#x27;s project number.
@@ -816,6 +931,32 @@
               },
             },
           },
+          &quot;identityservice&quot;: { # **Anthos Identity Service**: State for a single Membership. # Identity Service-specific state.
+            &quot;failureReason&quot;: &quot;A String&quot;, # The reason of the failure.
+            &quot;installedVersion&quot;: &quot;A String&quot;, # Installed AIS version. This is the AIS version installed on this member. The values makes sense iff state is OK.
+            &quot;memberConfig&quot;: { # **Anthos Identity Service**: Configuration for a single Membership. # Last reconciled membership configuration
+              &quot;authMethods&quot;: [ # A member may support multiple auth methods.
+                { # Configuration of an auth method for a member/cluster. Only one authentication method (e.g., OIDC and LDAP) can be set per AuthMethod.
+                  &quot;name&quot;: &quot;A String&quot;, # Identifier for auth config.
+                  &quot;oidcConfig&quot;: { # Configuration for OIDC Auth flow. # OIDC specific configuration.
+                    &quot;certificateAuthorityData&quot;: &quot;A String&quot;, # PEM-encoded CA for OIDC provider.
+                    &quot;clientId&quot;: &quot;A String&quot;, # ID for OIDC client application.
+                    &quot;deployCloudConsoleProxy&quot;: True or False, # Flag to denote if reverse proxy is used to connect to auth provider. This flag should be set to true when provider is not reachable by Google Cloud Console.
+                    &quot;extraParams&quot;: &quot;A String&quot;, # Comma-separated list of key-value pairs.
+                    &quot;groupPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to group name.
+                    &quot;groupsClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds group information.
+                    &quot;issuerUri&quot;: &quot;A String&quot;, # URI for the OIDC provider. This should point to the level below .well-known/openid-configuration.
+                    &quot;kubectlRedirectUri&quot;: &quot;A String&quot;, # Registered redirect uri to redirect users going through OAuth flow using kubectl plugin.
+                    &quot;scopes&quot;: &quot;A String&quot;, # Comma-separated list of identifiers.
+                    &quot;userClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds username.
+                    &quot;userPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to user name.
+                  },
+                  &quot;proxy&quot;: &quot;A String&quot;, # Proxy server address to use for auth method.
+                },
+              ],
+            },
+            &quot;state&quot;: &quot;A String&quot;, # Deployment state on this member
+          },
           &quot;metering&quot;: { # **Metering**: Per-Membership Feature State. # Metering-specific spec.
             &quot;lastMeasurementTime&quot;: &quot;A String&quot;, # The time stamp of the most recent measurement of the number of vCPUs in the cluster.
             &quot;preciseLastMeasuredClusterVcpuCapacity&quot;: 3.14, # The vCPUs capacity in the cluster according to the most recent measurement (1/1000 precision).
@@ -915,6 +1056,27 @@
         },
         &quot;version&quot;: &quot;A String&quot;, # Version of ACM installed.
       },
+      &quot;identityservice&quot;: { # **Anthos Identity Service**: Configuration for a single Membership. # Identity Service-specific spec.
+        &quot;authMethods&quot;: [ # A member may support multiple auth methods.
+          { # Configuration of an auth method for a member/cluster. Only one authentication method (e.g., OIDC and LDAP) can be set per AuthMethod.
+            &quot;name&quot;: &quot;A String&quot;, # Identifier for auth config.
+            &quot;oidcConfig&quot;: { # Configuration for OIDC Auth flow. # OIDC specific configuration.
+              &quot;certificateAuthorityData&quot;: &quot;A String&quot;, # PEM-encoded CA for OIDC provider.
+              &quot;clientId&quot;: &quot;A String&quot;, # ID for OIDC client application.
+              &quot;deployCloudConsoleProxy&quot;: True or False, # Flag to denote if reverse proxy is used to connect to auth provider. This flag should be set to true when provider is not reachable by Google Cloud Console.
+              &quot;extraParams&quot;: &quot;A String&quot;, # Comma-separated list of key-value pairs.
+              &quot;groupPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to group name.
+              &quot;groupsClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds group information.
+              &quot;issuerUri&quot;: &quot;A String&quot;, # URI for the OIDC provider. This should point to the level below .well-known/openid-configuration.
+              &quot;kubectlRedirectUri&quot;: &quot;A String&quot;, # Registered redirect uri to redirect users going through OAuth flow using kubectl plugin.
+              &quot;scopes&quot;: &quot;A String&quot;, # Comma-separated list of identifiers.
+              &quot;userClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds username.
+              &quot;userPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to user name.
+            },
+            &quot;proxy&quot;: &quot;A String&quot;, # Proxy server address to use for auth method.
+          },
+        ],
+      },
     },
   },
   &quot;membershipStates&quot;: { # Output only. Membership-specific Feature status. If this Feature does report any per-Membership status, this field may be unused. The keys indicate which Membership the state is for, in the form: `projects/{p}/locations/{l}/memberships/{m}` Where {p} is the project number, {l} is a valid location and {m} is a valid Membership in this project at that location. {p} MUST match the Feature&#x27;s project number.
@@ -1034,6 +1196,32 @@
           },
         },
       },
+      &quot;identityservice&quot;: { # **Anthos Identity Service**: State for a single Membership. # Identity Service-specific state.
+        &quot;failureReason&quot;: &quot;A String&quot;, # The reason of the failure.
+        &quot;installedVersion&quot;: &quot;A String&quot;, # Installed AIS version. This is the AIS version installed on this member. The values makes sense iff state is OK.
+        &quot;memberConfig&quot;: { # **Anthos Identity Service**: Configuration for a single Membership. # Last reconciled membership configuration
+          &quot;authMethods&quot;: [ # A member may support multiple auth methods.
+            { # Configuration of an auth method for a member/cluster. Only one authentication method (e.g., OIDC and LDAP) can be set per AuthMethod.
+              &quot;name&quot;: &quot;A String&quot;, # Identifier for auth config.
+              &quot;oidcConfig&quot;: { # Configuration for OIDC Auth flow. # OIDC specific configuration.
+                &quot;certificateAuthorityData&quot;: &quot;A String&quot;, # PEM-encoded CA for OIDC provider.
+                &quot;clientId&quot;: &quot;A String&quot;, # ID for OIDC client application.
+                &quot;deployCloudConsoleProxy&quot;: True or False, # Flag to denote if reverse proxy is used to connect to auth provider. This flag should be set to true when provider is not reachable by Google Cloud Console.
+                &quot;extraParams&quot;: &quot;A String&quot;, # Comma-separated list of key-value pairs.
+                &quot;groupPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to group name.
+                &quot;groupsClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds group information.
+                &quot;issuerUri&quot;: &quot;A String&quot;, # URI for the OIDC provider. This should point to the level below .well-known/openid-configuration.
+                &quot;kubectlRedirectUri&quot;: &quot;A String&quot;, # Registered redirect uri to redirect users going through OAuth flow using kubectl plugin.
+                &quot;scopes&quot;: &quot;A String&quot;, # Comma-separated list of identifiers.
+                &quot;userClaim&quot;: &quot;A String&quot;, # Claim in OIDC ID token that holds username.
+                &quot;userPrefix&quot;: &quot;A String&quot;, # Prefix to prepend to user name.
+              },
+              &quot;proxy&quot;: &quot;A String&quot;, # Proxy server address to use for auth method.
+            },
+          ],
+        },
+        &quot;state&quot;: &quot;A String&quot;, # Deployment state on this member
+      },
       &quot;metering&quot;: { # **Metering**: Per-Membership Feature State. # Metering-specific spec.
         &quot;lastMeasurementTime&quot;: &quot;A String&quot;, # The time stamp of the most recent measurement of the number of vCPUs in the cluster.
         &quot;preciseLastMeasuredClusterVcpuCapacity&quot;: 3.14, # The vCPUs capacity in the cluster according to the most recent measurement (1/1000 precision).
@@ -1106,7 +1294,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -1148,7 +1336,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.

docs/dyn/gkehub_v1beta.projects.locations.html

diff --git a/docs/dyn/gkehub_v1beta.projects.locations.html b/docs/dyn/gkehub_v1beta.projects.locations.html
index 36fccfb..d786412 100644
--- a/docs/dyn/gkehub_v1beta.projects.locations.html
+++ b/docs/dyn/gkehub_v1beta.projects.locations.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1beta.html">GKE Hub</a> . <a href="gkehub_v1beta.projects.html">projects</a> . <a href="gkehub_v1beta.projects.locations.html">locations</a></h1>
+<h1><a href="gkehub_v1beta.html">GKE Hub API</a> . <a href="gkehub_v1beta.projects.html">projects</a> . <a href="gkehub_v1beta.projects.locations.html">locations</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="gkehub_v1beta.projects.locations.features.html">features()</a></code>

docs/dyn/gkehub_v1beta.projects.locations.memberships.html

diff --git a/docs/dyn/gkehub_v1beta.projects.locations.memberships.html b/docs/dyn/gkehub_v1beta.projects.locations.memberships.html
index f1aefbf..2672d11 100644
--- a/docs/dyn/gkehub_v1beta.projects.locations.memberships.html
+++ b/docs/dyn/gkehub_v1beta.projects.locations.memberships.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1beta.html">GKE Hub</a> . <a href="gkehub_v1beta.projects.html">projects</a> . <a href="gkehub_v1beta.projects.locations.html">locations</a> . <a href="gkehub_v1beta.projects.locations.memberships.html">memberships</a></h1>
+<h1><a href="gkehub_v1beta.html">GKE Hub API</a> . <a href="gkehub_v1beta.projects.html">projects</a> . <a href="gkehub_v1beta.projects.locations.html">locations</a> . <a href="gkehub_v1beta.projects.locations.memberships.html">memberships</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="#close">close()</a></code></p>
@@ -107,7 +107,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -150,7 +150,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -192,7 +192,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.

docs/dyn/gkehub_v1beta.projects.locations.operations.html

diff --git a/docs/dyn/gkehub_v1beta.projects.locations.operations.html b/docs/dyn/gkehub_v1beta.projects.locations.operations.html
index 1303a5b..847bb37 100644
--- a/docs/dyn/gkehub_v1beta.projects.locations.operations.html
+++ b/docs/dyn/gkehub_v1beta.projects.locations.operations.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1beta.html">GKE Hub</a> . <a href="gkehub_v1beta.projects.html">projects</a> . <a href="gkehub_v1beta.projects.locations.html">locations</a> . <a href="gkehub_v1beta.projects.locations.operations.html">operations</a></h1>
+<h1><a href="gkehub_v1beta.html">GKE Hub API</a> . <a href="gkehub_v1beta.projects.html">projects</a> . <a href="gkehub_v1beta.projects.locations.html">locations</a> . <a href="gkehub_v1beta.projects.locations.operations.html">operations</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="#cancel">cancel(name, body=None, x__xgafv=None)</a></code></p>

docs/dyn/gkehub_v1beta1.html

diff --git a/docs/dyn/gkehub_v1beta1.html b/docs/dyn/gkehub_v1beta1.html
index ad73da0..1b820a1 100644
--- a/docs/dyn/gkehub_v1beta1.html
+++ b/docs/dyn/gkehub_v1beta1.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1beta1.html">GKE Hub</a></h1>
+<h1><a href="gkehub_v1beta1.html">GKE Hub API</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="gkehub_v1beta1.projects.html">projects()</a></code>

docs/dyn/gkehub_v1beta1.projects.html

diff --git a/docs/dyn/gkehub_v1beta1.projects.html b/docs/dyn/gkehub_v1beta1.projects.html
index 2c0b345..2ffe097 100644
--- a/docs/dyn/gkehub_v1beta1.projects.html
+++ b/docs/dyn/gkehub_v1beta1.projects.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1beta1.html">GKE Hub</a> . <a href="gkehub_v1beta1.projects.html">projects</a></h1>
+<h1><a href="gkehub_v1beta1.html">GKE Hub API</a> . <a href="gkehub_v1beta1.projects.html">projects</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="gkehub_v1beta1.projects.locations.html">locations()</a></code>

docs/dyn/gkehub_v1beta1.projects.locations.html

diff --git a/docs/dyn/gkehub_v1beta1.projects.locations.html b/docs/dyn/gkehub_v1beta1.projects.locations.html
index 82154b4..e530827 100644
--- a/docs/dyn/gkehub_v1beta1.projects.locations.html
+++ b/docs/dyn/gkehub_v1beta1.projects.locations.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1beta1.html">GKE Hub</a> . <a href="gkehub_v1beta1.projects.html">projects</a> . <a href="gkehub_v1beta1.projects.locations.html">locations</a></h1>
+<h1><a href="gkehub_v1beta1.html">GKE Hub API</a> . <a href="gkehub_v1beta1.projects.html">projects</a> . <a href="gkehub_v1beta1.projects.locations.html">locations</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="gkehub_v1beta1.projects.locations.memberships.html">memberships()</a></code>

docs/dyn/gkehub_v1beta1.projects.locations.memberships.html

diff --git a/docs/dyn/gkehub_v1beta1.projects.locations.memberships.html b/docs/dyn/gkehub_v1beta1.projects.locations.memberships.html
index 8fd71e7..1f84427 100644
--- a/docs/dyn/gkehub_v1beta1.projects.locations.memberships.html
+++ b/docs/dyn/gkehub_v1beta1.projects.locations.memberships.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1beta1.html">GKE Hub</a> . <a href="gkehub_v1beta1.projects.html">projects</a> . <a href="gkehub_v1beta1.projects.locations.html">locations</a> . <a href="gkehub_v1beta1.projects.locations.memberships.html">memberships</a></h1>
+<h1><a href="gkehub_v1beta1.html">GKE Hub API</a> . <a href="gkehub_v1beta1.projects.html">projects</a> . <a href="gkehub_v1beta1.projects.locations.html">locations</a> . <a href="gkehub_v1beta1.projects.locations.memberships.html">memberships</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="#close">close()</a></code></p>
@@ -399,7 +399,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -641,7 +641,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -683,7 +683,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.

docs/dyn/gkehub_v1beta1.projects.locations.operations.html

diff --git a/docs/dyn/gkehub_v1beta1.projects.locations.operations.html b/docs/dyn/gkehub_v1beta1.projects.locations.operations.html
index ca4f187..a1a7510 100644
--- a/docs/dyn/gkehub_v1beta1.projects.locations.operations.html
+++ b/docs/dyn/gkehub_v1beta1.projects.locations.operations.html
@@ -72,7 +72,7 @@
 
 </style>
 
-<h1><a href="gkehub_v1beta1.html">GKE Hub</a> . <a href="gkehub_v1beta1.projects.html">projects</a> . <a href="gkehub_v1beta1.projects.locations.html">locations</a> . <a href="gkehub_v1beta1.projects.locations.operations.html">operations</a></h1>
+<h1><a href="gkehub_v1beta1.html">GKE Hub API</a> . <a href="gkehub_v1beta1.projects.html">projects</a> . <a href="gkehub_v1beta1.projects.locations.html">locations</a> . <a href="gkehub_v1beta1.projects.locations.operations.html">operations</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="#cancel">cancel(name, body=None, x__xgafv=None)</a></code></p>

docs/dyn/iam_v1.projects.serviceAccounts.html

diff --git a/docs/dyn/iam_v1.projects.serviceAccounts.html b/docs/dyn/iam_v1.projects.serviceAccounts.html
index 6903bbc..82db416 100644
--- a/docs/dyn/iam_v1.projects.serviceAccounts.html
+++ b/docs/dyn/iam_v1.projects.serviceAccounts.html
@@ -286,7 +286,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -422,7 +422,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -464,7 +464,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/iap_v1.v1.html

diff --git a/docs/dyn/iap_v1.v1.html b/docs/dyn/iap_v1.v1.html
index 01ba78f..37bdd94 100644
--- a/docs/dyn/iap_v1.v1.html
+++ b/docs/dyn/iap_v1.v1.html
@@ -121,7 +121,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -211,7 +211,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
         "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -239,7 +239,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/iap_v1beta1.v1beta1.html

diff --git a/docs/dyn/iap_v1beta1.v1beta1.html b/docs/dyn/iap_v1beta1.v1beta1.html
index 670cd55..63cd328 100644
--- a/docs/dyn/iap_v1beta1.v1beta1.html
+++ b/docs/dyn/iap_v1beta1.v1beta1.html
@@ -115,7 +115,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -145,7 +145,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
         "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -173,7 +173,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/ideahub_v1alpha.ideas.html

diff --git a/docs/dyn/ideahub_v1alpha.ideas.html b/docs/dyn/ideahub_v1alpha.ideas.html
index 9fb7516..96df2f2 100644
--- a/docs/dyn/ideahub_v1alpha.ideas.html
+++ b/docs/dyn/ideahub_v1alpha.ideas.html
@@ -78,7 +78,7 @@
   <code><a href="#close">close()</a></code></p>
 <p class="firstline">Close httplib2 connections.</p>
 <p class="toc_element">
-  <code><a href="#list">list(creator_platform=None, creator_platformId=None, filter=None, orderBy=None, pageSize=None, pageToken=None, parent=None, x__xgafv=None)</a></code></p>
+  <code><a href="#list">list(filter=None, orderBy=None, pageSize=None, pageToken=None, parent=None, x__xgafv=None)</a></code></p>
 <p class="firstline">List ideas for a given Creator and filter and sort options.</p>
 <p class="toc_element">
   <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
@@ -90,16 +90,10 @@
 </div>
 
 <div class="method">
-    <code class="details" id="list">list(creator_platform=None, creator_platformId=None, filter=None, orderBy=None, pageSize=None, pageToken=None, parent=None, x__xgafv=None)</code>
+    <code class="details" id="list">list(filter=None, orderBy=None, pageSize=None, pageToken=None, parent=None, x__xgafv=None)</code>
   <pre>List ideas for a given Creator and filter and sort options.
 
 Args:
-  creator_platform: string, Identifies the platform from which this user is accessing Idea Hub.
-    Allowed values
-      UNKNOWN - 
-      BLOGGER - 
-      SITEKIT - 
-  creator_platformId: string, Identifies the platform account (blog/site/etc.) for which to fetch Ideas.
   filter: string, Allows filtering. Supported syntax: * Filter expressions are made up of one or more restrictions. * Restrictions are implicitly combined, as if the `AND` operator was always used. The `OR` operator is currently unsupported. * Supported functions: - `saved(bool)`: If set to true, fetches only saved ideas. If set to false, fetches all except saved ideas. Can&#x27;t be simultaneously used with `dismissed(bool)`. - `dismissed(bool)`: If set to true, fetches only dismissed ideas. Can&#x27;t be simultaneously used with `saved(bool)`. The `false` value is currently unsupported. Examples: * `saved(true)` * `saved(false)` * `dismissed(true)` The length of this field should be no more than 500 characters.
   orderBy: string, Order semantics described below.
   pageSize: integer, The maximum number of ideas per page. If unspecified, at most 10 ideas will be returned. The maximum value is 2000; values above 2000 will be coerced to 2000.

docs/dyn/ideahub_v1alpha.platforms.properties.ideas.html

diff --git a/docs/dyn/ideahub_v1alpha.platforms.properties.ideas.html b/docs/dyn/ideahub_v1alpha.platforms.properties.ideas.html
index fc92dca..ebd44cc 100644
--- a/docs/dyn/ideahub_v1alpha.platforms.properties.ideas.html
+++ b/docs/dyn/ideahub_v1alpha.platforms.properties.ideas.html
@@ -78,7 +78,7 @@
   <code><a href="#close">close()</a></code></p>
 <p class="firstline">Close httplib2 connections.</p>
 <p class="toc_element">
-  <code><a href="#list">list(parent, creator_platform=None, creator_platformId=None, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
+  <code><a href="#list">list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
 <p class="firstline">List ideas for a given Creator and filter and sort options.</p>
 <p class="toc_element">
   <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
@@ -90,17 +90,11 @@
 </div>
 
 <div class="method">
-    <code class="details" id="list">list(parent, creator_platform=None, creator_platformId=None, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)</code>
+    <code class="details" id="list">list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)</code>
   <pre>List ideas for a given Creator and filter and sort options.
 
 Args:
   parent: string, If defined, specifies the creator for which to filter by. Format: publishers/{publisher}/properties/{property} (required)
-  creator_platform: string, Identifies the platform from which this user is accessing Idea Hub.
-    Allowed values
-      UNKNOWN - 
-      BLOGGER - 
-      SITEKIT - 
-  creator_platformId: string, Identifies the platform account (blog/site/etc.) for which to fetch Ideas.
   filter: string, Allows filtering. Supported syntax: * Filter expressions are made up of one or more restrictions. * Restrictions are implicitly combined, as if the `AND` operator was always used. The `OR` operator is currently unsupported. * Supported functions: - `saved(bool)`: If set to true, fetches only saved ideas. If set to false, fetches all except saved ideas. Can&#x27;t be simultaneously used with `dismissed(bool)`. - `dismissed(bool)`: If set to true, fetches only dismissed ideas. Can&#x27;t be simultaneously used with `saved(bool)`. The `false` value is currently unsupported. Examples: * `saved(true)` * `saved(false)` * `dismissed(true)` The length of this field should be no more than 500 characters.
   orderBy: string, Order semantics described below.
   pageSize: integer, The maximum number of ideas per page. If unspecified, at most 10 ideas will be returned. The maximum value is 2000; values above 2000 will be coerced to 2000.

docs/dyn/metastore_v1alpha.projects.locations.services.backups.html

diff --git a/docs/dyn/metastore_v1alpha.projects.locations.services.backups.html b/docs/dyn/metastore_v1alpha.projects.locations.services.backups.html
index f541042..5019b58 100644
--- a/docs/dyn/metastore_v1alpha.projects.locations.services.backups.html
+++ b/docs/dyn/metastore_v1alpha.projects.locations.services.backups.html
@@ -361,7 +361,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted.Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -519,7 +519,7 @@
     The object takes the form of:
 
 { # Request message for SetIamPolicy method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the resource. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the resource. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted.Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -561,7 +561,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted.Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/metastore_v1alpha.projects.locations.services.databases.html

diff --git a/docs/dyn/metastore_v1alpha.projects.locations.services.databases.html b/docs/dyn/metastore_v1alpha.projects.locations.services.databases.html
index 885f78f..0b6aafb 100644
--- a/docs/dyn/metastore_v1alpha.projects.locations.services.databases.html
+++ b/docs/dyn/metastore_v1alpha.projects.locations.services.databases.html
@@ -112,7 +112,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted.Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -155,7 +155,7 @@
     The object takes the form of:
 
 { # Request message for SetIamPolicy method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the resource. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the resource. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted.Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -197,7 +197,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted.Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/metastore_v1alpha.projects.locations.services.databases.tables.html

diff --git a/docs/dyn/metastore_v1alpha.projects.locations.services.databases.tables.html b/docs/dyn/metastore_v1alpha.projects.locations.services.databases.tables.html
index 22a2cdc..5ecc776 100644
--- a/docs/dyn/metastore_v1alpha.projects.locations.services.databases.tables.html
+++ b/docs/dyn/metastore_v1alpha.projects.locations.services.databases.tables.html
@@ -107,7 +107,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted.Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -150,7 +150,7 @@
     The object takes the form of:
 
 { # Request message for SetIamPolicy method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the resource. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the resource. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted.Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -192,7 +192,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted.Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/metastore_v1alpha.projects.locations.services.html

diff --git a/docs/dyn/metastore_v1alpha.projects.locations.services.html b/docs/dyn/metastore_v1alpha.projects.locations.services.html
index b0eeccc..996880a 100644
--- a/docs/dyn/metastore_v1alpha.projects.locations.services.html
+++ b/docs/dyn/metastore_v1alpha.projects.locations.services.html
@@ -409,7 +409,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted.Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -705,7 +705,7 @@
     The object takes the form of:
 
 { # Request message for SetIamPolicy method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the resource. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the resource. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted.Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -747,7 +747,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted.Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/metastore_v1beta.projects.locations.services.backups.html

diff --git a/docs/dyn/metastore_v1beta.projects.locations.services.backups.html b/docs/dyn/metastore_v1beta.projects.locations.services.backups.html
index 97767ca..3660395 100644
--- a/docs/dyn/metastore_v1beta.projects.locations.services.backups.html
+++ b/docs/dyn/metastore_v1beta.projects.locations.services.backups.html
@@ -361,7 +361,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted.Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -519,7 +519,7 @@
     The object takes the form of:
 
 { # Request message for SetIamPolicy method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the resource. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the resource. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted.Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -561,7 +561,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted.Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/metastore_v1beta.projects.locations.services.html

diff --git a/docs/dyn/metastore_v1beta.projects.locations.services.html b/docs/dyn/metastore_v1beta.projects.locations.services.html
index f831b55..c7a3afa 100644
--- a/docs/dyn/metastore_v1beta.projects.locations.services.html
+++ b/docs/dyn/metastore_v1beta.projects.locations.services.html
@@ -404,7 +404,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted.Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -700,7 +700,7 @@
     The object takes the form of:
 
 { # Request message for SetIamPolicy method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the resource. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the resource. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted.Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -742,7 +742,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the IAM documentation (https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted.Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/networkmanagement_v1.projects.locations.global_.connectivityTests.html

diff --git a/docs/dyn/networkmanagement_v1.projects.locations.global_.connectivityTests.html b/docs/dyn/networkmanagement_v1.projects.locations.global_.connectivityTests.html
index 9ff0f97..3a4f684 100644
--- a/docs/dyn/networkmanagement_v1.projects.locations.global_.connectivityTests.html
+++ b/docs/dyn/networkmanagement_v1.projects.locations.global_.connectivityTests.html
@@ -619,7 +619,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -1185,7 +1185,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -1227,7 +1227,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/networkmanagement_v1beta1.projects.locations.global_.connectivityTests.html

diff --git a/docs/dyn/networkmanagement_v1beta1.projects.locations.global_.connectivityTests.html b/docs/dyn/networkmanagement_v1beta1.projects.locations.global_.connectivityTests.html
index c546555..5d54cb5 100644
--- a/docs/dyn/networkmanagement_v1beta1.projects.locations.global_.connectivityTests.html
+++ b/docs/dyn/networkmanagement_v1beta1.projects.locations.global_.connectivityTests.html
@@ -685,7 +685,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -1317,7 +1317,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -1359,7 +1359,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/networkservices_v1.projects.locations.edgeCacheKeysets.html

diff --git a/docs/dyn/networkservices_v1.projects.locations.edgeCacheKeysets.html b/docs/dyn/networkservices_v1.projects.locations.edgeCacheKeysets.html
index c09e59f..a9b8076 100644
--- a/docs/dyn/networkservices_v1.projects.locations.edgeCacheKeysets.html
+++ b/docs/dyn/networkservices_v1.projects.locations.edgeCacheKeysets.html
@@ -107,7 +107,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -150,7 +150,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -192,7 +192,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/networkservices_v1.projects.locations.edgeCacheOrigins.html

diff --git a/docs/dyn/networkservices_v1.projects.locations.edgeCacheOrigins.html b/docs/dyn/networkservices_v1.projects.locations.edgeCacheOrigins.html
index 27c9c57..7740ffc 100644
--- a/docs/dyn/networkservices_v1.projects.locations.edgeCacheOrigins.html
+++ b/docs/dyn/networkservices_v1.projects.locations.edgeCacheOrigins.html
@@ -107,7 +107,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -150,7 +150,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -192,7 +192,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/networkservices_v1.projects.locations.edgeCacheServices.html

diff --git a/docs/dyn/networkservices_v1.projects.locations.edgeCacheServices.html b/docs/dyn/networkservices_v1.projects.locations.edgeCacheServices.html
index b6d86f1..fe2939a 100644
--- a/docs/dyn/networkservices_v1.projects.locations.edgeCacheServices.html
+++ b/docs/dyn/networkservices_v1.projects.locations.edgeCacheServices.html
@@ -107,7 +107,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -150,7 +150,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -192,7 +192,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/networkservices_v1beta1.projects.locations.endpointPolicies.html

diff --git a/docs/dyn/networkservices_v1beta1.projects.locations.endpointPolicies.html b/docs/dyn/networkservices_v1beta1.projects.locations.endpointPolicies.html
index f026b73..88e8d6e 100644
--- a/docs/dyn/networkservices_v1beta1.projects.locations.endpointPolicies.html
+++ b/docs/dyn/networkservices_v1beta1.projects.locations.endpointPolicies.html
@@ -274,7 +274,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -452,7 +452,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -494,7 +494,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/notebooks_v1.projects.locations.instances.html

diff --git a/docs/dyn/notebooks_v1.projects.locations.instances.html b/docs/dyn/notebooks_v1.projects.locations.instances.html
index 9f85325..0115140 100644
--- a/docs/dyn/notebooks_v1.projects.locations.instances.html
+++ b/docs/dyn/notebooks_v1.projects.locations.instances.html
@@ -458,7 +458,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -885,7 +885,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
         "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -913,7 +913,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/ondemandscanning_v1.projects.locations.scans.vulnerabilities.html

diff --git a/docs/dyn/ondemandscanning_v1.projects.locations.scans.vulnerabilities.html b/docs/dyn/ondemandscanning_v1.projects.locations.scans.vulnerabilities.html
index 023892c..32c3e14 100644
--- a/docs/dyn/ondemandscanning_v1.projects.locations.scans.vulnerabilities.html
+++ b/docs/dyn/ondemandscanning_v1.projects.locations.scans.vulnerabilities.html
@@ -455,7 +455,7 @@
       },
       "vulnerability": { # An occurrence of a severity vulnerability on a resource. # Describes a security vulnerability.
         "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a scale of 0 - 10 where 0 indicates low severity and 10 indicates high severity.
-        "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is available, otherwise this is the note provider assigned severity.
+        "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is available, otherwise this is the note provider assigned severity. When there are multiple PackageIssues for this vulnerability, they can have different effective severities because some might be provided by the distro while others are provided by the language ecosystem for a language pack. For this reason, it is advised to use the effective severity on the PackageIssue level. In the case where multiple PackageIssues have differing effective severities, this field should be the highest severity for any of the PackageIssues.
         "fixAvailable": True or False, # Output only. Whether at least one of the affected packages has a fix available.
         "longDescription": "A String", # Output only. A detailed description of this vulnerability.
         "packageIssue": [ # Required. The set of affected locations and their fixes (if available) within the associated resource.
@@ -470,6 +470,7 @@
               "name": "A String", # Required only when version kind is NORMAL. The main part of the version name.
               "revision": "A String", # The iteration of the package build from the above version.
             },
+            "effectiveSeverity": "A String", # Output only. The distro or language system assigned severity for this vulnerability when that is available and note provider assigned severity when it is not available.
             "fixAvailable": True or False, # Output only. Whether a fix is available for this package.
             "fixedCpeUri": "A String", # The [CPE URI](https://cpe.mitre.org/specification/) this vulnerability was fixed in. It is possible for this to be different from the affected_cpe_uri.
             "fixedPackage": "A String", # The package this vulnerability was fixed in. It is possible for this to be different from the affected_package.
@@ -481,6 +482,7 @@
               "name": "A String", # Required only when version kind is NORMAL. The main part of the version name.
               "revision": "A String", # The iteration of the package build from the above version.
             },
+            "packageType": "A String", # The type of package (e.g. OS, MAVEN, GO).
           },
         ],
         "relatedUrls": [ # Output only. URLs related to this vulnerability.

docs/dyn/ondemandscanning_v1beta1.projects.locations.scans.vulnerabilities.html

diff --git a/docs/dyn/ondemandscanning_v1beta1.projects.locations.scans.vulnerabilities.html b/docs/dyn/ondemandscanning_v1beta1.projects.locations.scans.vulnerabilities.html
index d9f8913..2e1510b 100644
--- a/docs/dyn/ondemandscanning_v1beta1.projects.locations.scans.vulnerabilities.html
+++ b/docs/dyn/ondemandscanning_v1beta1.projects.locations.scans.vulnerabilities.html
@@ -455,7 +455,7 @@
       },
       "vulnerability": { # An occurrence of a severity vulnerability on a resource. # Describes a security vulnerability.
         "cvssScore": 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a scale of 0 - 10 where 0 indicates low severity and 10 indicates high severity.
-        "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is available, otherwise this is the note provider assigned severity.
+        "effectiveSeverity": "A String", # The distro assigned severity for this vulnerability when it is available, otherwise this is the note provider assigned severity. When there are multiple PackageIssues for this vulnerability, they can have different effective severities because some might be provided by the distro while others are provided by the language ecosystem for a language pack. For this reason, it is advised to use the effective severity on the PackageIssue level. In the case where multiple PackageIssues have differing effective severities, this field should be the highest severity for any of the PackageIssues.
         "fixAvailable": True or False, # Output only. Whether at least one of the affected packages has a fix available.
         "longDescription": "A String", # Output only. A detailed description of this vulnerability.
         "packageIssue": [ # Required. The set of affected locations and their fixes (if available) within the associated resource.
@@ -470,6 +470,7 @@
               "name": "A String", # Required only when version kind is NORMAL. The main part of the version name.
               "revision": "A String", # The iteration of the package build from the above version.
             },
+            "effectiveSeverity": "A String", # Output only. The distro or language system assigned severity for this vulnerability when that is available and note provider assigned severity when it is not available.
             "fixAvailable": True or False, # Output only. Whether a fix is available for this package.
             "fixedCpeUri": "A String", # The [CPE URI](https://cpe.mitre.org/specification/) this vulnerability was fixed in. It is possible for this to be different from the affected_cpe_uri.
             "fixedPackage": "A String", # The package this vulnerability was fixed in. It is possible for this to be different from the affected_package.
@@ -481,6 +482,7 @@
               "name": "A String", # Required only when version kind is NORMAL. The main part of the version name.
               "revision": "A String", # The iteration of the package build from the above version.
             },
+            "packageType": "A String", # The type of package (e.g. OS, MAVEN, GO).
           },
         ],
         "relatedUrls": [ # Output only. URLs related to this vulnerability.

docs/dyn/osconfig_v1.html

diff --git a/docs/dyn/osconfig_v1.html b/docs/dyn/osconfig_v1.html
index 8b35013..e1163a4 100644
--- a/docs/dyn/osconfig_v1.html
+++ b/docs/dyn/osconfig_v1.html
@@ -75,11 +75,6 @@
 <h1><a href="osconfig_v1.html">OS Config API</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
-  <code><a href="osconfig_v1.operations.html">operations()</a></code>
-</p>
-<p class="firstline">Returns the operations Resource.</p>
-
-<p class="toc_element">
   <code><a href="osconfig_v1.projects.html">projects()</a></code>
 </p>
 <p class="firstline">Returns the projects Resource.</p>

docs/dyn/people_v1.otherContacts.html

diff --git a/docs/dyn/people_v1.otherContacts.html b/docs/dyn/people_v1.otherContacts.html
index a2b7963..bcf5c8b 100644
--- a/docs/dyn/people_v1.otherContacts.html
+++ b/docs/dyn/people_v1.otherContacts.html
@@ -130,7 +130,7 @@
       "formattedType": "A String", # Output only. The type of the address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "formattedValue": "A String", # The unstructured value of the address. If this is not set by the user it will be automatically constructed from structured values.
       "metadata": { # Metadata about a field. # Metadata about the address.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -143,7 +143,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "poBox": "A String", # The P.O. box of the address.
@@ -158,7 +158,7 @@
     { # A person's age range.
       "ageRange": "A String", # The age range.
       "metadata": { # Metadata about a field. # Metadata about the age range.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -171,7 +171,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
     },
@@ -180,7 +180,7 @@
     { # A person's short biography.
       "contentType": "A String", # The content type of the biography.
       "metadata": { # Metadata about a field. # Metadata about the biography.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -193,7 +193,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The short biography.
@@ -207,7 +207,7 @@
         "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
       },
       "metadata": { # Metadata about a field. # Metadata about the birthday.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -220,7 +220,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "text": "A String", # A free-form string representing the user's birthday.
@@ -229,7 +229,7 @@
   "braggingRights": [ # **DEPRECATED**: No data will be returned The person's bragging rights.
     { # **DEPRECATED**: No data will be returned A person's bragging rights.
       "metadata": { # Metadata about a field. # Metadata about the bragging rights.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -242,7 +242,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The bragging rights; for example, `climbed mount everest`.
@@ -252,7 +252,7 @@
     { # A person's calendar URL.
       "formattedType": "A String", # Output only. The type of the calendar URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the calendar URL.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -265,7 +265,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the calendar URL. The type can be custom or one of these predefined values: * `home` * `freeBusy` * `work`
@@ -276,7 +276,7 @@
     { # Arbitrary client data that is populated by clients. Duplicate keys and values are allowed.
       "key": "A String", # The client specified key of the client data.
       "metadata": { # Metadata about a field. # Metadata about the client data.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -289,7 +289,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The client specified value of the client data.
@@ -299,7 +299,7 @@
     { # A person's cover photo. A large image shown on the person's profile page that represents who they are or what they care about.
       "default": True or False, # True if the cover photo is the default cover photo; false if the cover photo is a user-provided cover photo.
       "metadata": { # Metadata about a field. # Metadata about the cover photo.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -312,7 +312,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "url": "A String", # The URL of the cover photo.
@@ -323,7 +323,7 @@
       "displayName": "A String", # The display name of the email.
       "formattedType": "A String", # Output only. The type of the email address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the email address.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -336,7 +336,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the email address. The type can be custom or one of these predefined values: * `home` * `work` * `other`
@@ -353,7 +353,7 @@
       },
       "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the event.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -366,7 +366,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the event. The type can be custom or one of these predefined values: * `anniversary` * `other`
@@ -376,7 +376,7 @@
     { # An identifier from an external entity related to the person.
       "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the external ID.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -389,7 +389,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the external ID. The type can be custom or one of these predefined values: * `account` * `customer` * `loginId` * `network` * `organization`
@@ -399,7 +399,7 @@
   "fileAses": [ # The person's file-ases.
     { # The name that should be used to sort the person in a list.
       "metadata": { # Metadata about a field. # Metadata about the file-as.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -412,7 +412,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The file-as value
@@ -423,7 +423,7 @@
       "addressMeAs": "A String", # The type of pronouns that should be used to address the person. The value can be custom or one of these predefined values: * `male` * `female` * `other`
       "formattedValue": "A String", # Output only. The value of the gender translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale. Unspecified or custom value are not localized.
       "metadata": { # Metadata about a field. # Metadata about the gender.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -436,7 +436,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The gender for the person. The gender can be custom or one of these predefined values: * `male` * `female` * `unspecified`
@@ -447,7 +447,7 @@
       "formattedProtocol": "A String", # Output only. The protocol of the IM client formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "formattedType": "A String", # Output only. The type of the IM client translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the IM client.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -460,7 +460,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "protocol": "A String", # The protocol of the IM client. The protocol can be custom or one of these predefined values: * `aim` * `msn` * `yahoo` * `skype` * `qq` * `googleTalk` * `icq` * `jabber` * `netMeeting`
@@ -471,7 +471,7 @@
   "interests": [ # The person's interests.
     { # One of the person's interests.
       "metadata": { # Metadata about a field. # Metadata about the interest.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -484,7 +484,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The interest; for example, `stargazing`.
@@ -493,7 +493,7 @@
   "locales": [ # The person's locale preferences.
     { # A person's locale preference.
       "metadata": { # Metadata about a field. # Metadata about the locale.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -506,7 +506,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The well-formed [IETF BCP 47](https://tools.ietf.org/html/bcp47) language tag representing the locale.
@@ -520,7 +520,7 @@
       "floor": "A String", # The floor name or number.
       "floorSection": "A String", # The floor section in `floor_name`.
       "metadata": { # Metadata about a field. # Metadata about the location.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -533,7 +533,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the location. The type can be custom or one of these predefined values: * `desk` * `grewUp`
@@ -550,7 +550,7 @@
         "inViewerDomain": True or False, # True if the person is in the viewer's Google Workspace domain.
       },
       "metadata": { # Metadata about a field. # Metadata about the membership.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -563,7 +563,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
     },
@@ -596,7 +596,7 @@
     { # A person's miscellaneous keyword.
       "formattedType": "A String", # Output only. The type of the miscellaneous keyword translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the miscellaneous keyword.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -609,7 +609,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The miscellaneous keyword type.
@@ -625,7 +625,7 @@
       "honorificPrefix": "A String", # The honorific prefixes, such as `Mrs.` or `Dr.`
       "honorificSuffix": "A String", # The honorific suffixes, such as `Jr.`
       "metadata": { # Metadata about a field. # Metadata about the name.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -638,7 +638,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "middleName": "A String", # The middle name(s).
@@ -654,7 +654,7 @@
   "nicknames": [ # The person's nicknames.
     { # A person's nickname.
       "metadata": { # Metadata about a field. # Metadata about the nickname.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -667,7 +667,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the nickname.
@@ -677,7 +677,7 @@
   "occupations": [ # The person's occupations.
     { # A person's occupation.
       "metadata": { # Metadata about a field. # Metadata about the occupation.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -690,7 +690,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The occupation; for example, `carpenter`.
@@ -710,7 +710,7 @@
       "jobDescription": "A String", # The person's job description at the organization.
       "location": "A String", # The location of the organization office the person works at.
       "metadata": { # Metadata about a field. # Metadata about the organization.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -723,7 +723,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "name": "A String", # The name of the organization.
@@ -743,7 +743,7 @@
       "canonicalForm": "A String", # Output only. The canonicalized [ITU-T E.164](https://law.resource.org/pub/us/cfr/ibr/004/itu-t.E.164.1.2008.pdf) form of the phone number.
       "formattedType": "A String", # Output only. The type of the phone number translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the phone number.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -756,7 +756,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the phone number. The type can be custom or one of these predefined values: * `home` * `work` * `mobile` * `homeFax` * `workFax` * `otherFax` * `pager` * `workMobile` * `workPager` * `main` * `googleVoice` * `other`
@@ -767,7 +767,7 @@
     { # A person's photo. A picture shown next to the person's name to help others recognize the person.
       "default": True or False, # True if the photo is a default photo; false if the photo is a user-provided photo.
       "metadata": { # Metadata about a field. # Metadata about the photo.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -780,7 +780,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "url": "A String", # The URL of the photo. You can change the desired size by appending a query parameter `sz={size}` at the end of the url, where {size} is the size in pixels. Example: https://lh3.googleusercontent.com/-T_wVWLlmg7w/AAAAAAAAAAI/AAAAAAAABa8/00gzXvDBYqw/s100/photo.jpg?sz=50
@@ -790,7 +790,7 @@
     { # A person's relation to another person.
       "formattedType": "A String", # Output only. The type of the relation translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
       "metadata": { # Metadata about a field. # Metadata about the relation.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -803,7 +803,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "person": "A String", # The name of the other person this relation refers to.
@@ -814,7 +814,7 @@
     { # **DEPRECATED**: No data will be returned A person's relationship interest .
       "formattedValue": "A String", # Output only. The value of the relationship interest translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
       "metadata": { # Metadata about a field. # Metadata about the relationship interest.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -827,7 +827,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The kind of relationship the person is looking for. The value can be custom or one of these predefined values: * `friend` * `date` * `relationship` * `networking`
@@ -837,7 +837,7 @@
     { # **DEPRECATED**: No data will be returned A person's relationship status.
       "formattedValue": "A String", # Output only. The value of the relationship status translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the relationship status.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -850,7 +850,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The relationship status. The value can be custom or one of these predefined values: * `single` * `inARelationship` * `engaged` * `married` * `itsComplicated` * `openRelationship` * `widowed` * `inDomesticPartnership` * `inCivilUnion`
@@ -860,7 +860,7 @@
     { # **DEPRECATED**: Please use `person.locations` instead. A person's past or current residence.
       "current": True or False, # True if the residence is the person's current residence; false if the residence is a past residence.
       "metadata": { # Metadata about a field. # Metadata about the residence.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -873,7 +873,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The address of the residence.
@@ -884,7 +884,7 @@
     { # A person's SIP address. Session Initial Protocol addresses are used for VoIP communications to make voice or video calls over the internet.
       "formattedType": "A String", # Output only. The type of the SIP address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the SIP address.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -897,7 +897,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the SIP address. The type can be custom or or one of these predefined values: * `home` * `work` * `mobile` * `other`
@@ -907,7 +907,7 @@
   "skills": [ # The person's skills.
     { # A skill that the person has.
       "metadata": { # Metadata about a field. # Metadata about the skill.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -920,7 +920,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The skill; for example, `underwater basket weaving`.
@@ -929,7 +929,7 @@
   "taglines": [ # Output only. **DEPRECATED**: No data will be returned The person's taglines.
     { # **DEPRECATED**: No data will be returned A brief one-line description of the person.
       "metadata": { # Metadata about a field. # Metadata about the tagline.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -942,7 +942,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The tagline.
@@ -952,7 +952,7 @@
     { # A person's associated URLs.
       "formattedType": "A String", # Output only. The type of the URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the URL.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -965,7 +965,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the URL. The type can be custom or one of these predefined values: * `home` * `work` * `blog` * `profile` * `homePage` * `ftp` * `reservations` * `appInstallPage`: website for a Currents application. * `other`
@@ -976,7 +976,7 @@
     { # Arbitrary user data that is populated by the end users.
       "key": "A String", # The end user specified key of the user defined data.
       "metadata": { # Metadata about a field. # Metadata about the user defined data.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -989,7 +989,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The end user specified value of the user defined data.
@@ -1036,7 +1036,7 @@
           "formattedType": "A String", # Output only. The type of the address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "formattedValue": "A String", # The unstructured value of the address. If this is not set by the user it will be automatically constructed from structured values.
           "metadata": { # Metadata about a field. # Metadata about the address.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1049,7 +1049,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "poBox": "A String", # The P.O. box of the address.
@@ -1064,7 +1064,7 @@
         { # A person's age range.
           "ageRange": "A String", # The age range.
           "metadata": { # Metadata about a field. # Metadata about the age range.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1077,7 +1077,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
         },
@@ -1086,7 +1086,7 @@
         { # A person's short biography.
           "contentType": "A String", # The content type of the biography.
           "metadata": { # Metadata about a field. # Metadata about the biography.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1099,7 +1099,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The short biography.
@@ -1113,7 +1113,7 @@
             "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
           },
           "metadata": { # Metadata about a field. # Metadata about the birthday.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1126,7 +1126,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "text": "A String", # A free-form string representing the user's birthday.
@@ -1135,7 +1135,7 @@
       "braggingRights": [ # **DEPRECATED**: No data will be returned The person's bragging rights.
         { # **DEPRECATED**: No data will be returned A person's bragging rights.
           "metadata": { # Metadata about a field. # Metadata about the bragging rights.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1148,7 +1148,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The bragging rights; for example, `climbed mount everest`.
@@ -1158,7 +1158,7 @@
         { # A person's calendar URL.
           "formattedType": "A String", # Output only. The type of the calendar URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the calendar URL.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1171,7 +1171,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the calendar URL. The type can be custom or one of these predefined values: * `home` * `freeBusy` * `work`
@@ -1182,7 +1182,7 @@
         { # Arbitrary client data that is populated by clients. Duplicate keys and values are allowed.
           "key": "A String", # The client specified key of the client data.
           "metadata": { # Metadata about a field. # Metadata about the client data.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1195,7 +1195,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The client specified value of the client data.
@@ -1205,7 +1205,7 @@
         { # A person's cover photo. A large image shown on the person's profile page that represents who they are or what they care about.
           "default": True or False, # True if the cover photo is the default cover photo; false if the cover photo is a user-provided cover photo.
           "metadata": { # Metadata about a field. # Metadata about the cover photo.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1218,7 +1218,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "url": "A String", # The URL of the cover photo.
@@ -1229,7 +1229,7 @@
           "displayName": "A String", # The display name of the email.
           "formattedType": "A String", # Output only. The type of the email address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the email address.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1242,7 +1242,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the email address. The type can be custom or one of these predefined values: * `home` * `work` * `other`
@@ -1259,7 +1259,7 @@
           },
           "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the event.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1272,7 +1272,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the event. The type can be custom or one of these predefined values: * `anniversary` * `other`
@@ -1282,7 +1282,7 @@
         { # An identifier from an external entity related to the person.
           "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the external ID.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1295,7 +1295,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the external ID. The type can be custom or one of these predefined values: * `account` * `customer` * `loginId` * `network` * `organization`
@@ -1305,7 +1305,7 @@
       "fileAses": [ # The person's file-ases.
         { # The name that should be used to sort the person in a list.
           "metadata": { # Metadata about a field. # Metadata about the file-as.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1318,7 +1318,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The file-as value
@@ -1329,7 +1329,7 @@
           "addressMeAs": "A String", # The type of pronouns that should be used to address the person. The value can be custom or one of these predefined values: * `male` * `female` * `other`
           "formattedValue": "A String", # Output only. The value of the gender translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale. Unspecified or custom value are not localized.
           "metadata": { # Metadata about a field. # Metadata about the gender.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1342,7 +1342,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The gender for the person. The gender can be custom or one of these predefined values: * `male` * `female` * `unspecified`
@@ -1353,7 +1353,7 @@
           "formattedProtocol": "A String", # Output only. The protocol of the IM client formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "formattedType": "A String", # Output only. The type of the IM client translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the IM client.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1366,7 +1366,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "protocol": "A String", # The protocol of the IM client. The protocol can be custom or one of these predefined values: * `aim` * `msn` * `yahoo` * `skype` * `qq` * `googleTalk` * `icq` * `jabber` * `netMeeting`
@@ -1377,7 +1377,7 @@
       "interests": [ # The person's interests.
         { # One of the person's interests.
           "metadata": { # Metadata about a field. # Metadata about the interest.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1390,7 +1390,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The interest; for example, `stargazing`.
@@ -1399,7 +1399,7 @@
       "locales": [ # The person's locale preferences.
         { # A person's locale preference.
           "metadata": { # Metadata about a field. # Metadata about the locale.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1412,7 +1412,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The well-formed [IETF BCP 47](https://tools.ietf.org/html/bcp47) language tag representing the locale.
@@ -1426,7 +1426,7 @@
           "floor": "A String", # The floor name or number.
           "floorSection": "A String", # The floor section in `floor_name`.
           "metadata": { # Metadata about a field. # Metadata about the location.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1439,7 +1439,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the location. The type can be custom or one of these predefined values: * `desk` * `grewUp`
@@ -1456,7 +1456,7 @@
             "inViewerDomain": True or False, # True if the person is in the viewer's Google Workspace domain.
           },
           "metadata": { # Metadata about a field. # Metadata about the membership.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1469,7 +1469,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
         },
@@ -1502,7 +1502,7 @@
         { # A person's miscellaneous keyword.
           "formattedType": "A String", # Output only. The type of the miscellaneous keyword translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the miscellaneous keyword.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1515,7 +1515,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The miscellaneous keyword type.
@@ -1531,7 +1531,7 @@
           "honorificPrefix": "A String", # The honorific prefixes, such as `Mrs.` or `Dr.`
           "honorificSuffix": "A String", # The honorific suffixes, such as `Jr.`
           "metadata": { # Metadata about a field. # Metadata about the name.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1544,7 +1544,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "middleName": "A String", # The middle name(s).
@@ -1560,7 +1560,7 @@
       "nicknames": [ # The person's nicknames.
         { # A person's nickname.
           "metadata": { # Metadata about a field. # Metadata about the nickname.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1573,7 +1573,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the nickname.
@@ -1583,7 +1583,7 @@
       "occupations": [ # The person's occupations.
         { # A person's occupation.
           "metadata": { # Metadata about a field. # Metadata about the occupation.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1596,7 +1596,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The occupation; for example, `carpenter`.
@@ -1616,7 +1616,7 @@
           "jobDescription": "A String", # The person's job description at the organization.
           "location": "A String", # The location of the organization office the person works at.
           "metadata": { # Metadata about a field. # Metadata about the organization.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1629,7 +1629,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "name": "A String", # The name of the organization.
@@ -1649,7 +1649,7 @@
           "canonicalForm": "A String", # Output only. The canonicalized [ITU-T E.164](https://law.resource.org/pub/us/cfr/ibr/004/itu-t.E.164.1.2008.pdf) form of the phone number.
           "formattedType": "A String", # Output only. The type of the phone number translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the phone number.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1662,7 +1662,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the phone number. The type can be custom or one of these predefined values: * `home` * `work` * `mobile` * `homeFax` * `workFax` * `otherFax` * `pager` * `workMobile` * `workPager` * `main` * `googleVoice` * `other`
@@ -1673,7 +1673,7 @@
         { # A person's photo. A picture shown next to the person's name to help others recognize the person.
           "default": True or False, # True if the photo is a default photo; false if the photo is a user-provided photo.
           "metadata": { # Metadata about a field. # Metadata about the photo.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1686,7 +1686,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "url": "A String", # The URL of the photo. You can change the desired size by appending a query parameter `sz={size}` at the end of the url, where {size} is the size in pixels. Example: https://lh3.googleusercontent.com/-T_wVWLlmg7w/AAAAAAAAAAI/AAAAAAAABa8/00gzXvDBYqw/s100/photo.jpg?sz=50
@@ -1696,7 +1696,7 @@
         { # A person's relation to another person.
           "formattedType": "A String", # Output only. The type of the relation translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
           "metadata": { # Metadata about a field. # Metadata about the relation.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1709,7 +1709,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "person": "A String", # The name of the other person this relation refers to.
@@ -1720,7 +1720,7 @@
         { # **DEPRECATED**: No data will be returned A person's relationship interest .
           "formattedValue": "A String", # Output only. The value of the relationship interest translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
           "metadata": { # Metadata about a field. # Metadata about the relationship interest.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1733,7 +1733,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The kind of relationship the person is looking for. The value can be custom or one of these predefined values: * `friend` * `date` * `relationship` * `networking`
@@ -1743,7 +1743,7 @@
         { # **DEPRECATED**: No data will be returned A person's relationship status.
           "formattedValue": "A String", # Output only. The value of the relationship status translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the relationship status.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1756,7 +1756,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The relationship status. The value can be custom or one of these predefined values: * `single` * `inARelationship` * `engaged` * `married` * `itsComplicated` * `openRelationship` * `widowed` * `inDomesticPartnership` * `inCivilUnion`
@@ -1766,7 +1766,7 @@
         { # **DEPRECATED**: Please use `person.locations` instead. A person's past or current residence.
           "current": True or False, # True if the residence is the person's current residence; false if the residence is a past residence.
           "metadata": { # Metadata about a field. # Metadata about the residence.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1779,7 +1779,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The address of the residence.
@@ -1790,7 +1790,7 @@
         { # A person's SIP address. Session Initial Protocol addresses are used for VoIP communications to make voice or video calls over the internet.
           "formattedType": "A String", # Output only. The type of the SIP address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the SIP address.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1803,7 +1803,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the SIP address. The type can be custom or or one of these predefined values: * `home` * `work` * `mobile` * `other`
@@ -1813,7 +1813,7 @@
       "skills": [ # The person's skills.
         { # A skill that the person has.
           "metadata": { # Metadata about a field. # Metadata about the skill.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1826,7 +1826,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The skill; for example, `underwater basket weaving`.
@@ -1835,7 +1835,7 @@
       "taglines": [ # Output only. **DEPRECATED**: No data will be returned The person's taglines.
         { # **DEPRECATED**: No data will be returned A brief one-line description of the person.
           "metadata": { # Metadata about a field. # Metadata about the tagline.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1848,7 +1848,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The tagline.
@@ -1858,7 +1858,7 @@
         { # A person's associated URLs.
           "formattedType": "A String", # Output only. The type of the URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the URL.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1871,7 +1871,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the URL. The type can be custom or one of these predefined values: * `home` * `work` * `blog` * `profile` * `homePage` * `ftp` * `reservations` * `appInstallPage`: website for a Currents application. * `other`
@@ -1882,7 +1882,7 @@
         { # Arbitrary user data that is populated by the end users.
           "key": "A String", # The end user specified key of the user defined data.
           "metadata": { # Metadata about a field. # Metadata about the user defined data.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1895,7 +1895,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The end user specified value of the user defined data.
@@ -1950,7 +1950,7 @@
             "formattedType": "A String", # Output only. The type of the address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "formattedValue": "A String", # The unstructured value of the address. If this is not set by the user it will be automatically constructed from structured values.
             "metadata": { # Metadata about a field. # Metadata about the address.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1963,7 +1963,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "poBox": "A String", # The P.O. box of the address.
@@ -1978,7 +1978,7 @@
           { # A person's age range.
             "ageRange": "A String", # The age range.
             "metadata": { # Metadata about a field. # Metadata about the age range.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1991,7 +1991,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
           },
@@ -2000,7 +2000,7 @@
           { # A person's short biography.
             "contentType": "A String", # The content type of the biography.
             "metadata": { # Metadata about a field. # Metadata about the biography.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2013,7 +2013,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The short biography.
@@ -2027,7 +2027,7 @@
               "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
             },
             "metadata": { # Metadata about a field. # Metadata about the birthday.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2040,7 +2040,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "text": "A String", # A free-form string representing the user's birthday.
@@ -2049,7 +2049,7 @@
         "braggingRights": [ # **DEPRECATED**: No data will be returned The person's bragging rights.
           { # **DEPRECATED**: No data will be returned A person's bragging rights.
             "metadata": { # Metadata about a field. # Metadata about the bragging rights.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2062,7 +2062,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The bragging rights; for example, `climbed mount everest`.
@@ -2072,7 +2072,7 @@
           { # A person's calendar URL.
             "formattedType": "A String", # Output only. The type of the calendar URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the calendar URL.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2085,7 +2085,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the calendar URL. The type can be custom or one of these predefined values: * `home` * `freeBusy` * `work`
@@ -2096,7 +2096,7 @@
           { # Arbitrary client data that is populated by clients. Duplicate keys and values are allowed.
             "key": "A String", # The client specified key of the client data.
             "metadata": { # Metadata about a field. # Metadata about the client data.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2109,7 +2109,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The client specified value of the client data.
@@ -2119,7 +2119,7 @@
           { # A person's cover photo. A large image shown on the person's profile page that represents who they are or what they care about.
             "default": True or False, # True if the cover photo is the default cover photo; false if the cover photo is a user-provided cover photo.
             "metadata": { # Metadata about a field. # Metadata about the cover photo.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2132,7 +2132,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "url": "A String", # The URL of the cover photo.
@@ -2143,7 +2143,7 @@
             "displayName": "A String", # The display name of the email.
             "formattedType": "A String", # Output only. The type of the email address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the email address.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2156,7 +2156,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the email address. The type can be custom or one of these predefined values: * `home` * `work` * `other`
@@ -2173,7 +2173,7 @@
             },
             "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the event.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2186,7 +2186,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the event. The type can be custom or one of these predefined values: * `anniversary` * `other`
@@ -2196,7 +2196,7 @@
           { # An identifier from an external entity related to the person.
             "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the external ID.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2209,7 +2209,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the external ID. The type can be custom or one of these predefined values: * `account` * `customer` * `loginId` * `network` * `organization`
@@ -2219,7 +2219,7 @@
         "fileAses": [ # The person's file-ases.
           { # The name that should be used to sort the person in a list.
             "metadata": { # Metadata about a field. # Metadata about the file-as.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2232,7 +2232,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The file-as value
@@ -2243,7 +2243,7 @@
             "addressMeAs": "A String", # The type of pronouns that should be used to address the person. The value can be custom or one of these predefined values: * `male` * `female` * `other`
             "formattedValue": "A String", # Output only. The value of the gender translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale. Unspecified or custom value are not localized.
             "metadata": { # Metadata about a field. # Metadata about the gender.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2256,7 +2256,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The gender for the person. The gender can be custom or one of these predefined values: * `male` * `female` * `unspecified`
@@ -2267,7 +2267,7 @@
             "formattedProtocol": "A String", # Output only. The protocol of the IM client formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "formattedType": "A String", # Output only. The type of the IM client translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the IM client.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2280,7 +2280,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "protocol": "A String", # The protocol of the IM client. The protocol can be custom or one of these predefined values: * `aim` * `msn` * `yahoo` * `skype` * `qq` * `googleTalk` * `icq` * `jabber` * `netMeeting`
@@ -2291,7 +2291,7 @@
         "interests": [ # The person's interests.
           { # One of the person's interests.
             "metadata": { # Metadata about a field. # Metadata about the interest.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2304,7 +2304,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The interest; for example, `stargazing`.
@@ -2313,7 +2313,7 @@
         "locales": [ # The person's locale preferences.
           { # A person's locale preference.
             "metadata": { # Metadata about a field. # Metadata about the locale.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2326,7 +2326,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The well-formed [IETF BCP 47](https://tools.ietf.org/html/bcp47) language tag representing the locale.
@@ -2340,7 +2340,7 @@
             "floor": "A String", # The floor name or number.
             "floorSection": "A String", # The floor section in `floor_name`.
             "metadata": { # Metadata about a field. # Metadata about the location.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2353,7 +2353,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the location. The type can be custom or one of these predefined values: * `desk` * `grewUp`
@@ -2370,7 +2370,7 @@
               "inViewerDomain": True or False, # True if the person is in the viewer's Google Workspace domain.
             },
             "metadata": { # Metadata about a field. # Metadata about the membership.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2383,7 +2383,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
           },
@@ -2416,7 +2416,7 @@
           { # A person's miscellaneous keyword.
             "formattedType": "A String", # Output only. The type of the miscellaneous keyword translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the miscellaneous keyword.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2429,7 +2429,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The miscellaneous keyword type.
@@ -2445,7 +2445,7 @@
             "honorificPrefix": "A String", # The honorific prefixes, such as `Mrs.` or `Dr.`
             "honorificSuffix": "A String", # The honorific suffixes, such as `Jr.`
             "metadata": { # Metadata about a field. # Metadata about the name.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2458,7 +2458,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "middleName": "A String", # The middle name(s).
@@ -2474,7 +2474,7 @@
         "nicknames": [ # The person's nicknames.
           { # A person's nickname.
             "metadata": { # Metadata about a field. # Metadata about the nickname.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2487,7 +2487,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the nickname.
@@ -2497,7 +2497,7 @@
         "occupations": [ # The person's occupations.
           { # A person's occupation.
             "metadata": { # Metadata about a field. # Metadata about the occupation.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2510,7 +2510,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The occupation; for example, `carpenter`.
@@ -2530,7 +2530,7 @@
             "jobDescription": "A String", # The person's job description at the organization.
             "location": "A String", # The location of the organization office the person works at.
             "metadata": { # Metadata about a field. # Metadata about the organization.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2543,7 +2543,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "name": "A String", # The name of the organization.
@@ -2563,7 +2563,7 @@
             "canonicalForm": "A String", # Output only. The canonicalized [ITU-T E.164](https://law.resource.org/pub/us/cfr/ibr/004/itu-t.E.164.1.2008.pdf) form of the phone number.
             "formattedType": "A String", # Output only. The type of the phone number translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the phone number.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2576,7 +2576,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the phone number. The type can be custom or one of these predefined values: * `home` * `work` * `mobile` * `homeFax` * `workFax` * `otherFax` * `pager` * `workMobile` * `workPager` * `main` * `googleVoice` * `other`
@@ -2587,7 +2587,7 @@
           { # A person's photo. A picture shown next to the person's name to help others recognize the person.
             "default": True or False, # True if the photo is a default photo; false if the photo is a user-provided photo.
             "metadata": { # Metadata about a field. # Metadata about the photo.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2600,7 +2600,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "url": "A String", # The URL of the photo. You can change the desired size by appending a query parameter `sz={size}` at the end of the url, where {size} is the size in pixels. Example: https://lh3.googleusercontent.com/-T_wVWLlmg7w/AAAAAAAAAAI/AAAAAAAABa8/00gzXvDBYqw/s100/photo.jpg?sz=50
@@ -2610,7 +2610,7 @@
           { # A person's relation to another person.
             "formattedType": "A String", # Output only. The type of the relation translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
             "metadata": { # Metadata about a field. # Metadata about the relation.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2623,7 +2623,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "person": "A String", # The name of the other person this relation refers to.
@@ -2634,7 +2634,7 @@
           { # **DEPRECATED**: No data will be returned A person's relationship interest .
             "formattedValue": "A String", # Output only. The value of the relationship interest translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
             "metadata": { # Metadata about a field. # Metadata about the relationship interest.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2647,7 +2647,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The kind of relationship the person is looking for. The value can be custom or one of these predefined values: * `friend` * `date` * `relationship` * `networking`
@@ -2657,7 +2657,7 @@
           { # **DEPRECATED**: No data will be returned A person's relationship status.
             "formattedValue": "A String", # Output only. The value of the relationship status translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the relationship status.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2670,7 +2670,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The relationship status. The value can be custom or one of these predefined values: * `single` * `inARelationship` * `engaged` * `married` * `itsComplicated` * `openRelationship` * `widowed` * `inDomesticPartnership` * `inCivilUnion`
@@ -2680,7 +2680,7 @@
           { # **DEPRECATED**: Please use `person.locations` instead. A person's past or current residence.
             "current": True or False, # True if the residence is the person's current residence; false if the residence is a past residence.
             "metadata": { # Metadata about a field. # Metadata about the residence.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2693,7 +2693,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The address of the residence.
@@ -2704,7 +2704,7 @@
           { # A person's SIP address. Session Initial Protocol addresses are used for VoIP communications to make voice or video calls over the internet.
             "formattedType": "A String", # Output only. The type of the SIP address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the SIP address.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2717,7 +2717,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the SIP address. The type can be custom or or one of these predefined values: * `home` * `work` * `mobile` * `other`
@@ -2727,7 +2727,7 @@
         "skills": [ # The person's skills.
           { # A skill that the person has.
             "metadata": { # Metadata about a field. # Metadata about the skill.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2740,7 +2740,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The skill; for example, `underwater basket weaving`.
@@ -2749,7 +2749,7 @@
         "taglines": [ # Output only. **DEPRECATED**: No data will be returned The person's taglines.
           { # **DEPRECATED**: No data will be returned A brief one-line description of the person.
             "metadata": { # Metadata about a field. # Metadata about the tagline.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2762,7 +2762,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The tagline.
@@ -2772,7 +2772,7 @@
           { # A person's associated URLs.
             "formattedType": "A String", # Output only. The type of the URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the URL.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2785,7 +2785,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the URL. The type can be custom or one of these predefined values: * `home` * `work` * `blog` * `profile` * `homePage` * `ftp` * `reservations` * `appInstallPage`: website for a Currents application. * `other`
@@ -2796,7 +2796,7 @@
           { # Arbitrary user data that is populated by the end users.
             "key": "A String", # The end user specified key of the user defined data.
             "metadata": { # Metadata about a field. # Metadata about the user defined data.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2809,7 +2809,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The end user specified value of the user defined data.

docs/dyn/people_v1.people.connections.html

diff --git a/docs/dyn/people_v1.people.connections.html b/docs/dyn/people_v1.people.connections.html
index eacaed0..ab5d025 100644
--- a/docs/dyn/people_v1.people.connections.html
+++ b/docs/dyn/people_v1.people.connections.html
@@ -133,7 +133,7 @@
           "formattedType": "A String", # Output only. The type of the address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "formattedValue": "A String", # The unstructured value of the address. If this is not set by the user it will be automatically constructed from structured values.
           "metadata": { # Metadata about a field. # Metadata about the address.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -146,7 +146,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "poBox": "A String", # The P.O. box of the address.
@@ -161,7 +161,7 @@
         { # A person's age range.
           "ageRange": "A String", # The age range.
           "metadata": { # Metadata about a field. # Metadata about the age range.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -174,7 +174,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
         },
@@ -183,7 +183,7 @@
         { # A person's short biography.
           "contentType": "A String", # The content type of the biography.
           "metadata": { # Metadata about a field. # Metadata about the biography.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -196,7 +196,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The short biography.
@@ -210,7 +210,7 @@
             "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
           },
           "metadata": { # Metadata about a field. # Metadata about the birthday.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -223,7 +223,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "text": "A String", # A free-form string representing the user's birthday.
@@ -232,7 +232,7 @@
       "braggingRights": [ # **DEPRECATED**: No data will be returned The person's bragging rights.
         { # **DEPRECATED**: No data will be returned A person's bragging rights.
           "metadata": { # Metadata about a field. # Metadata about the bragging rights.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -245,7 +245,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The bragging rights; for example, `climbed mount everest`.
@@ -255,7 +255,7 @@
         { # A person's calendar URL.
           "formattedType": "A String", # Output only. The type of the calendar URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the calendar URL.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -268,7 +268,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the calendar URL. The type can be custom or one of these predefined values: * `home` * `freeBusy` * `work`
@@ -279,7 +279,7 @@
         { # Arbitrary client data that is populated by clients. Duplicate keys and values are allowed.
           "key": "A String", # The client specified key of the client data.
           "metadata": { # Metadata about a field. # Metadata about the client data.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -292,7 +292,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The client specified value of the client data.
@@ -302,7 +302,7 @@
         { # A person's cover photo. A large image shown on the person's profile page that represents who they are or what they care about.
           "default": True or False, # True if the cover photo is the default cover photo; false if the cover photo is a user-provided cover photo.
           "metadata": { # Metadata about a field. # Metadata about the cover photo.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -315,7 +315,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "url": "A String", # The URL of the cover photo.
@@ -326,7 +326,7 @@
           "displayName": "A String", # The display name of the email.
           "formattedType": "A String", # Output only. The type of the email address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the email address.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -339,7 +339,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the email address. The type can be custom or one of these predefined values: * `home` * `work` * `other`
@@ -356,7 +356,7 @@
           },
           "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the event.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -369,7 +369,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the event. The type can be custom or one of these predefined values: * `anniversary` * `other`
@@ -379,7 +379,7 @@
         { # An identifier from an external entity related to the person.
           "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the external ID.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -392,7 +392,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the external ID. The type can be custom or one of these predefined values: * `account` * `customer` * `loginId` * `network` * `organization`
@@ -402,7 +402,7 @@
       "fileAses": [ # The person's file-ases.
         { # The name that should be used to sort the person in a list.
           "metadata": { # Metadata about a field. # Metadata about the file-as.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -415,7 +415,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The file-as value
@@ -426,7 +426,7 @@
           "addressMeAs": "A String", # The type of pronouns that should be used to address the person. The value can be custom or one of these predefined values: * `male` * `female` * `other`
           "formattedValue": "A String", # Output only. The value of the gender translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale. Unspecified or custom value are not localized.
           "metadata": { # Metadata about a field. # Metadata about the gender.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -439,7 +439,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The gender for the person. The gender can be custom or one of these predefined values: * `male` * `female` * `unspecified`
@@ -450,7 +450,7 @@
           "formattedProtocol": "A String", # Output only. The protocol of the IM client formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "formattedType": "A String", # Output only. The type of the IM client translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the IM client.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -463,7 +463,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "protocol": "A String", # The protocol of the IM client. The protocol can be custom or one of these predefined values: * `aim` * `msn` * `yahoo` * `skype` * `qq` * `googleTalk` * `icq` * `jabber` * `netMeeting`
@@ -474,7 +474,7 @@
       "interests": [ # The person's interests.
         { # One of the person's interests.
           "metadata": { # Metadata about a field. # Metadata about the interest.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -487,7 +487,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The interest; for example, `stargazing`.
@@ -496,7 +496,7 @@
       "locales": [ # The person's locale preferences.
         { # A person's locale preference.
           "metadata": { # Metadata about a field. # Metadata about the locale.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -509,7 +509,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The well-formed [IETF BCP 47](https://tools.ietf.org/html/bcp47) language tag representing the locale.
@@ -523,7 +523,7 @@
           "floor": "A String", # The floor name or number.
           "floorSection": "A String", # The floor section in `floor_name`.
           "metadata": { # Metadata about a field. # Metadata about the location.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -536,7 +536,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the location. The type can be custom or one of these predefined values: * `desk` * `grewUp`
@@ -553,7 +553,7 @@
             "inViewerDomain": True or False, # True if the person is in the viewer's Google Workspace domain.
           },
           "metadata": { # Metadata about a field. # Metadata about the membership.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -566,7 +566,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
         },
@@ -599,7 +599,7 @@
         { # A person's miscellaneous keyword.
           "formattedType": "A String", # Output only. The type of the miscellaneous keyword translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the miscellaneous keyword.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -612,7 +612,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The miscellaneous keyword type.
@@ -628,7 +628,7 @@
           "honorificPrefix": "A String", # The honorific prefixes, such as `Mrs.` or `Dr.`
           "honorificSuffix": "A String", # The honorific suffixes, such as `Jr.`
           "metadata": { # Metadata about a field. # Metadata about the name.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -641,7 +641,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "middleName": "A String", # The middle name(s).
@@ -657,7 +657,7 @@
       "nicknames": [ # The person's nicknames.
         { # A person's nickname.
           "metadata": { # Metadata about a field. # Metadata about the nickname.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -670,7 +670,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the nickname.
@@ -680,7 +680,7 @@
       "occupations": [ # The person's occupations.
         { # A person's occupation.
           "metadata": { # Metadata about a field. # Metadata about the occupation.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -693,7 +693,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The occupation; for example, `carpenter`.
@@ -713,7 +713,7 @@
           "jobDescription": "A String", # The person's job description at the organization.
           "location": "A String", # The location of the organization office the person works at.
           "metadata": { # Metadata about a field. # Metadata about the organization.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -726,7 +726,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "name": "A String", # The name of the organization.
@@ -746,7 +746,7 @@
           "canonicalForm": "A String", # Output only. The canonicalized [ITU-T E.164](https://law.resource.org/pub/us/cfr/ibr/004/itu-t.E.164.1.2008.pdf) form of the phone number.
           "formattedType": "A String", # Output only. The type of the phone number translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the phone number.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -759,7 +759,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the phone number. The type can be custom or one of these predefined values: * `home` * `work` * `mobile` * `homeFax` * `workFax` * `otherFax` * `pager` * `workMobile` * `workPager` * `main` * `googleVoice` * `other`
@@ -770,7 +770,7 @@
         { # A person's photo. A picture shown next to the person's name to help others recognize the person.
           "default": True or False, # True if the photo is a default photo; false if the photo is a user-provided photo.
           "metadata": { # Metadata about a field. # Metadata about the photo.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -783,7 +783,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "url": "A String", # The URL of the photo. You can change the desired size by appending a query parameter `sz={size}` at the end of the url, where {size} is the size in pixels. Example: https://lh3.googleusercontent.com/-T_wVWLlmg7w/AAAAAAAAAAI/AAAAAAAABa8/00gzXvDBYqw/s100/photo.jpg?sz=50
@@ -793,7 +793,7 @@
         { # A person's relation to another person.
           "formattedType": "A String", # Output only. The type of the relation translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
           "metadata": { # Metadata about a field. # Metadata about the relation.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -806,7 +806,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "person": "A String", # The name of the other person this relation refers to.
@@ -817,7 +817,7 @@
         { # **DEPRECATED**: No data will be returned A person's relationship interest .
           "formattedValue": "A String", # Output only. The value of the relationship interest translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
           "metadata": { # Metadata about a field. # Metadata about the relationship interest.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -830,7 +830,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The kind of relationship the person is looking for. The value can be custom or one of these predefined values: * `friend` * `date` * `relationship` * `networking`
@@ -840,7 +840,7 @@
         { # **DEPRECATED**: No data will be returned A person's relationship status.
           "formattedValue": "A String", # Output only. The value of the relationship status translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the relationship status.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -853,7 +853,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The relationship status. The value can be custom or one of these predefined values: * `single` * `inARelationship` * `engaged` * `married` * `itsComplicated` * `openRelationship` * `widowed` * `inDomesticPartnership` * `inCivilUnion`
@@ -863,7 +863,7 @@
         { # **DEPRECATED**: Please use `person.locations` instead. A person's past or current residence.
           "current": True or False, # True if the residence is the person's current residence; false if the residence is a past residence.
           "metadata": { # Metadata about a field. # Metadata about the residence.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -876,7 +876,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The address of the residence.
@@ -887,7 +887,7 @@
         { # A person's SIP address. Session Initial Protocol addresses are used for VoIP communications to make voice or video calls over the internet.
           "formattedType": "A String", # Output only. The type of the SIP address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the SIP address.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -900,7 +900,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the SIP address. The type can be custom or or one of these predefined values: * `home` * `work` * `mobile` * `other`
@@ -910,7 +910,7 @@
       "skills": [ # The person's skills.
         { # A skill that the person has.
           "metadata": { # Metadata about a field. # Metadata about the skill.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -923,7 +923,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The skill; for example, `underwater basket weaving`.
@@ -932,7 +932,7 @@
       "taglines": [ # Output only. **DEPRECATED**: No data will be returned The person's taglines.
         { # **DEPRECATED**: No data will be returned A brief one-line description of the person.
           "metadata": { # Metadata about a field. # Metadata about the tagline.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -945,7 +945,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The tagline.
@@ -955,7 +955,7 @@
         { # A person's associated URLs.
           "formattedType": "A String", # Output only. The type of the URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the URL.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -968,7 +968,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the URL. The type can be custom or one of these predefined values: * `home` * `work` * `blog` * `profile` * `homePage` * `ftp` * `reservations` * `appInstallPage`: website for a Currents application. * `other`
@@ -979,7 +979,7 @@
         { # Arbitrary user data that is populated by the end users.
           "key": "A String", # The end user specified key of the user defined data.
           "metadata": { # Metadata about a field. # Metadata about the user defined data.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -992,7 +992,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The end user specified value of the user defined data.

docs/dyn/people_v1.people.html

diff --git a/docs/dyn/people_v1.people.html b/docs/dyn/people_v1.people.html
index 6e8aaf7..f332040 100644
--- a/docs/dyn/people_v1.people.html
+++ b/docs/dyn/people_v1.people.html
@@ -149,7 +149,7 @@
             "formattedType": "A String", # Output only. The type of the address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "formattedValue": "A String", # The unstructured value of the address. If this is not set by the user it will be automatically constructed from structured values.
             "metadata": { # Metadata about a field. # Metadata about the address.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -162,7 +162,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "poBox": "A String", # The P.O. box of the address.
@@ -177,7 +177,7 @@
           { # A person's age range.
             "ageRange": "A String", # The age range.
             "metadata": { # Metadata about a field. # Metadata about the age range.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -190,7 +190,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
           },
@@ -199,7 +199,7 @@
           { # A person's short biography.
             "contentType": "A String", # The content type of the biography.
             "metadata": { # Metadata about a field. # Metadata about the biography.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -212,7 +212,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The short biography.
@@ -226,7 +226,7 @@
               "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
             },
             "metadata": { # Metadata about a field. # Metadata about the birthday.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -239,7 +239,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "text": "A String", # A free-form string representing the user's birthday.
@@ -248,7 +248,7 @@
         "braggingRights": [ # **DEPRECATED**: No data will be returned The person's bragging rights.
           { # **DEPRECATED**: No data will be returned A person's bragging rights.
             "metadata": { # Metadata about a field. # Metadata about the bragging rights.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -261,7 +261,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The bragging rights; for example, `climbed mount everest`.
@@ -271,7 +271,7 @@
           { # A person's calendar URL.
             "formattedType": "A String", # Output only. The type of the calendar URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the calendar URL.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -284,7 +284,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the calendar URL. The type can be custom or one of these predefined values: * `home` * `freeBusy` * `work`
@@ -295,7 +295,7 @@
           { # Arbitrary client data that is populated by clients. Duplicate keys and values are allowed.
             "key": "A String", # The client specified key of the client data.
             "metadata": { # Metadata about a field. # Metadata about the client data.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -308,7 +308,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The client specified value of the client data.
@@ -318,7 +318,7 @@
           { # A person's cover photo. A large image shown on the person's profile page that represents who they are or what they care about.
             "default": True or False, # True if the cover photo is the default cover photo; false if the cover photo is a user-provided cover photo.
             "metadata": { # Metadata about a field. # Metadata about the cover photo.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -331,7 +331,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "url": "A String", # The URL of the cover photo.
@@ -342,7 +342,7 @@
             "displayName": "A String", # The display name of the email.
             "formattedType": "A String", # Output only. The type of the email address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the email address.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -355,7 +355,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the email address. The type can be custom or one of these predefined values: * `home` * `work` * `other`
@@ -372,7 +372,7 @@
             },
             "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the event.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -385,7 +385,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the event. The type can be custom or one of these predefined values: * `anniversary` * `other`
@@ -395,7 +395,7 @@
           { # An identifier from an external entity related to the person.
             "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the external ID.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -408,7 +408,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the external ID. The type can be custom or one of these predefined values: * `account` * `customer` * `loginId` * `network` * `organization`
@@ -418,7 +418,7 @@
         "fileAses": [ # The person's file-ases.
           { # The name that should be used to sort the person in a list.
             "metadata": { # Metadata about a field. # Metadata about the file-as.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -431,7 +431,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The file-as value
@@ -442,7 +442,7 @@
             "addressMeAs": "A String", # The type of pronouns that should be used to address the person. The value can be custom or one of these predefined values: * `male` * `female` * `other`
             "formattedValue": "A String", # Output only. The value of the gender translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale. Unspecified or custom value are not localized.
             "metadata": { # Metadata about a field. # Metadata about the gender.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -455,7 +455,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The gender for the person. The gender can be custom or one of these predefined values: * `male` * `female` * `unspecified`
@@ -466,7 +466,7 @@
             "formattedProtocol": "A String", # Output only. The protocol of the IM client formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "formattedType": "A String", # Output only. The type of the IM client translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the IM client.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -479,7 +479,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "protocol": "A String", # The protocol of the IM client. The protocol can be custom or one of these predefined values: * `aim` * `msn` * `yahoo` * `skype` * `qq` * `googleTalk` * `icq` * `jabber` * `netMeeting`
@@ -490,7 +490,7 @@
         "interests": [ # The person's interests.
           { # One of the person's interests.
             "metadata": { # Metadata about a field. # Metadata about the interest.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -503,7 +503,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The interest; for example, `stargazing`.
@@ -512,7 +512,7 @@
         "locales": [ # The person's locale preferences.
           { # A person's locale preference.
             "metadata": { # Metadata about a field. # Metadata about the locale.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -525,7 +525,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The well-formed [IETF BCP 47](https://tools.ietf.org/html/bcp47) language tag representing the locale.
@@ -539,7 +539,7 @@
             "floor": "A String", # The floor name or number.
             "floorSection": "A String", # The floor section in `floor_name`.
             "metadata": { # Metadata about a field. # Metadata about the location.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -552,7 +552,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the location. The type can be custom or one of these predefined values: * `desk` * `grewUp`
@@ -569,7 +569,7 @@
               "inViewerDomain": True or False, # True if the person is in the viewer's Google Workspace domain.
             },
             "metadata": { # Metadata about a field. # Metadata about the membership.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -582,7 +582,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
           },
@@ -615,7 +615,7 @@
           { # A person's miscellaneous keyword.
             "formattedType": "A String", # Output only. The type of the miscellaneous keyword translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the miscellaneous keyword.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -628,7 +628,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The miscellaneous keyword type.
@@ -644,7 +644,7 @@
             "honorificPrefix": "A String", # The honorific prefixes, such as `Mrs.` or `Dr.`
             "honorificSuffix": "A String", # The honorific suffixes, such as `Jr.`
             "metadata": { # Metadata about a field. # Metadata about the name.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -657,7 +657,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "middleName": "A String", # The middle name(s).
@@ -673,7 +673,7 @@
         "nicknames": [ # The person's nicknames.
           { # A person's nickname.
             "metadata": { # Metadata about a field. # Metadata about the nickname.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -686,7 +686,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the nickname.
@@ -696,7 +696,7 @@
         "occupations": [ # The person's occupations.
           { # A person's occupation.
             "metadata": { # Metadata about a field. # Metadata about the occupation.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -709,7 +709,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The occupation; for example, `carpenter`.
@@ -729,7 +729,7 @@
             "jobDescription": "A String", # The person's job description at the organization.
             "location": "A String", # The location of the organization office the person works at.
             "metadata": { # Metadata about a field. # Metadata about the organization.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -742,7 +742,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "name": "A String", # The name of the organization.
@@ -762,7 +762,7 @@
             "canonicalForm": "A String", # Output only. The canonicalized [ITU-T E.164](https://law.resource.org/pub/us/cfr/ibr/004/itu-t.E.164.1.2008.pdf) form of the phone number.
             "formattedType": "A String", # Output only. The type of the phone number translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the phone number.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -775,7 +775,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the phone number. The type can be custom or one of these predefined values: * `home` * `work` * `mobile` * `homeFax` * `workFax` * `otherFax` * `pager` * `workMobile` * `workPager` * `main` * `googleVoice` * `other`
@@ -786,7 +786,7 @@
           { # A person's photo. A picture shown next to the person's name to help others recognize the person.
             "default": True or False, # True if the photo is a default photo; false if the photo is a user-provided photo.
             "metadata": { # Metadata about a field. # Metadata about the photo.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -799,7 +799,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "url": "A String", # The URL of the photo. You can change the desired size by appending a query parameter `sz={size}` at the end of the url, where {size} is the size in pixels. Example: https://lh3.googleusercontent.com/-T_wVWLlmg7w/AAAAAAAAAAI/AAAAAAAABa8/00gzXvDBYqw/s100/photo.jpg?sz=50
@@ -809,7 +809,7 @@
           { # A person's relation to another person.
             "formattedType": "A String", # Output only. The type of the relation translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
             "metadata": { # Metadata about a field. # Metadata about the relation.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -822,7 +822,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "person": "A String", # The name of the other person this relation refers to.
@@ -833,7 +833,7 @@
           { # **DEPRECATED**: No data will be returned A person's relationship interest .
             "formattedValue": "A String", # Output only. The value of the relationship interest translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
             "metadata": { # Metadata about a field. # Metadata about the relationship interest.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -846,7 +846,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The kind of relationship the person is looking for. The value can be custom or one of these predefined values: * `friend` * `date` * `relationship` * `networking`
@@ -856,7 +856,7 @@
           { # **DEPRECATED**: No data will be returned A person's relationship status.
             "formattedValue": "A String", # Output only. The value of the relationship status translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the relationship status.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -869,7 +869,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The relationship status. The value can be custom or one of these predefined values: * `single` * `inARelationship` * `engaged` * `married` * `itsComplicated` * `openRelationship` * `widowed` * `inDomesticPartnership` * `inCivilUnion`
@@ -879,7 +879,7 @@
           { # **DEPRECATED**: Please use `person.locations` instead. A person's past or current residence.
             "current": True or False, # True if the residence is the person's current residence; false if the residence is a past residence.
             "metadata": { # Metadata about a field. # Metadata about the residence.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -892,7 +892,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The address of the residence.
@@ -903,7 +903,7 @@
           { # A person's SIP address. Session Initial Protocol addresses are used for VoIP communications to make voice or video calls over the internet.
             "formattedType": "A String", # Output only. The type of the SIP address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the SIP address.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -916,7 +916,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the SIP address. The type can be custom or or one of these predefined values: * `home` * `work` * `mobile` * `other`
@@ -926,7 +926,7 @@
         "skills": [ # The person's skills.
           { # A skill that the person has.
             "metadata": { # Metadata about a field. # Metadata about the skill.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -939,7 +939,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The skill; for example, `underwater basket weaving`.
@@ -948,7 +948,7 @@
         "taglines": [ # Output only. **DEPRECATED**: No data will be returned The person's taglines.
           { # **DEPRECATED**: No data will be returned A brief one-line description of the person.
             "metadata": { # Metadata about a field. # Metadata about the tagline.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -961,7 +961,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The tagline.
@@ -971,7 +971,7 @@
           { # A person's associated URLs.
             "formattedType": "A String", # Output only. The type of the URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the URL.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -984,7 +984,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the URL. The type can be custom or one of these predefined values: * `home` * `work` * `blog` * `profile` * `homePage` * `ftp` * `reservations` * `appInstallPage`: website for a Currents application. * `other`
@@ -995,7 +995,7 @@
           { # Arbitrary user data that is populated by the end users.
             "key": "A String", # The end user specified key of the user defined data.
             "metadata": { # Metadata about a field. # Metadata about the user defined data.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1008,7 +1008,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The end user specified value of the user defined data.
@@ -1031,7 +1031,7 @@
 Returns:
   An object of the form:
 
-    { # If not successful, returns BatchCreateContactsErrorDetails.contacts which contains a list of errors for each invalid contact. The response to a request to create a batch of contacts.
+    { # If not successful, returns BatchCreateContactsErrorDetails which contains a list of errors for each invalid contact. The response to a request to create a batch of contacts.
   "createdPeople": [ # The contacts that were created, unless the request `read_mask` is empty.
     { # The response for a single person
       "httpStatusCode": 42, # **DEPRECATED** (Please use status instead) [HTTP 1.1 status code] (http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html).
@@ -1045,7 +1045,7 @@
             "formattedType": "A String", # Output only. The type of the address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "formattedValue": "A String", # The unstructured value of the address. If this is not set by the user it will be automatically constructed from structured values.
             "metadata": { # Metadata about a field. # Metadata about the address.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1058,7 +1058,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "poBox": "A String", # The P.O. box of the address.
@@ -1073,7 +1073,7 @@
           { # A person's age range.
             "ageRange": "A String", # The age range.
             "metadata": { # Metadata about a field. # Metadata about the age range.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1086,7 +1086,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
           },
@@ -1095,7 +1095,7 @@
           { # A person's short biography.
             "contentType": "A String", # The content type of the biography.
             "metadata": { # Metadata about a field. # Metadata about the biography.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1108,7 +1108,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The short biography.
@@ -1122,7 +1122,7 @@
               "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
             },
             "metadata": { # Metadata about a field. # Metadata about the birthday.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1135,7 +1135,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "text": "A String", # A free-form string representing the user's birthday.
@@ -1144,7 +1144,7 @@
         "braggingRights": [ # **DEPRECATED**: No data will be returned The person's bragging rights.
           { # **DEPRECATED**: No data will be returned A person's bragging rights.
             "metadata": { # Metadata about a field. # Metadata about the bragging rights.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1157,7 +1157,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The bragging rights; for example, `climbed mount everest`.
@@ -1167,7 +1167,7 @@
           { # A person's calendar URL.
             "formattedType": "A String", # Output only. The type of the calendar URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the calendar URL.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1180,7 +1180,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the calendar URL. The type can be custom or one of these predefined values: * `home` * `freeBusy` * `work`
@@ -1191,7 +1191,7 @@
           { # Arbitrary client data that is populated by clients. Duplicate keys and values are allowed.
             "key": "A String", # The client specified key of the client data.
             "metadata": { # Metadata about a field. # Metadata about the client data.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1204,7 +1204,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The client specified value of the client data.
@@ -1214,7 +1214,7 @@
           { # A person's cover photo. A large image shown on the person's profile page that represents who they are or what they care about.
             "default": True or False, # True if the cover photo is the default cover photo; false if the cover photo is a user-provided cover photo.
             "metadata": { # Metadata about a field. # Metadata about the cover photo.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1227,7 +1227,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "url": "A String", # The URL of the cover photo.
@@ -1238,7 +1238,7 @@
             "displayName": "A String", # The display name of the email.
             "formattedType": "A String", # Output only. The type of the email address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the email address.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1251,7 +1251,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the email address. The type can be custom or one of these predefined values: * `home` * `work` * `other`
@@ -1268,7 +1268,7 @@
             },
             "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the event.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1281,7 +1281,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the event. The type can be custom or one of these predefined values: * `anniversary` * `other`
@@ -1291,7 +1291,7 @@
           { # An identifier from an external entity related to the person.
             "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the external ID.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1304,7 +1304,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the external ID. The type can be custom or one of these predefined values: * `account` * `customer` * `loginId` * `network` * `organization`
@@ -1314,7 +1314,7 @@
         "fileAses": [ # The person's file-ases.
           { # The name that should be used to sort the person in a list.
             "metadata": { # Metadata about a field. # Metadata about the file-as.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1327,7 +1327,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The file-as value
@@ -1338,7 +1338,7 @@
             "addressMeAs": "A String", # The type of pronouns that should be used to address the person. The value can be custom or one of these predefined values: * `male` * `female` * `other`
             "formattedValue": "A String", # Output only. The value of the gender translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale. Unspecified or custom value are not localized.
             "metadata": { # Metadata about a field. # Metadata about the gender.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1351,7 +1351,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The gender for the person. The gender can be custom or one of these predefined values: * `male` * `female` * `unspecified`
@@ -1362,7 +1362,7 @@
             "formattedProtocol": "A String", # Output only. The protocol of the IM client formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "formattedType": "A String", # Output only. The type of the IM client translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the IM client.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1375,7 +1375,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "protocol": "A String", # The protocol of the IM client. The protocol can be custom or one of these predefined values: * `aim` * `msn` * `yahoo` * `skype` * `qq` * `googleTalk` * `icq` * `jabber` * `netMeeting`
@@ -1386,7 +1386,7 @@
         "interests": [ # The person's interests.
           { # One of the person's interests.
             "metadata": { # Metadata about a field. # Metadata about the interest.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1399,7 +1399,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The interest; for example, `stargazing`.
@@ -1408,7 +1408,7 @@
         "locales": [ # The person's locale preferences.
           { # A person's locale preference.
             "metadata": { # Metadata about a field. # Metadata about the locale.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1421,7 +1421,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The well-formed [IETF BCP 47](https://tools.ietf.org/html/bcp47) language tag representing the locale.
@@ -1435,7 +1435,7 @@
             "floor": "A String", # The floor name or number.
             "floorSection": "A String", # The floor section in `floor_name`.
             "metadata": { # Metadata about a field. # Metadata about the location.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1448,7 +1448,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the location. The type can be custom or one of these predefined values: * `desk` * `grewUp`
@@ -1465,7 +1465,7 @@
               "inViewerDomain": True or False, # True if the person is in the viewer's Google Workspace domain.
             },
             "metadata": { # Metadata about a field. # Metadata about the membership.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1478,7 +1478,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
           },
@@ -1511,7 +1511,7 @@
           { # A person's miscellaneous keyword.
             "formattedType": "A String", # Output only. The type of the miscellaneous keyword translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the miscellaneous keyword.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1524,7 +1524,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The miscellaneous keyword type.
@@ -1540,7 +1540,7 @@
             "honorificPrefix": "A String", # The honorific prefixes, such as `Mrs.` or `Dr.`
             "honorificSuffix": "A String", # The honorific suffixes, such as `Jr.`
             "metadata": { # Metadata about a field. # Metadata about the name.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1553,7 +1553,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "middleName": "A String", # The middle name(s).
@@ -1569,7 +1569,7 @@
         "nicknames": [ # The person's nicknames.
           { # A person's nickname.
             "metadata": { # Metadata about a field. # Metadata about the nickname.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1582,7 +1582,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the nickname.
@@ -1592,7 +1592,7 @@
         "occupations": [ # The person's occupations.
           { # A person's occupation.
             "metadata": { # Metadata about a field. # Metadata about the occupation.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1605,7 +1605,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The occupation; for example, `carpenter`.
@@ -1625,7 +1625,7 @@
             "jobDescription": "A String", # The person's job description at the organization.
             "location": "A String", # The location of the organization office the person works at.
             "metadata": { # Metadata about a field. # Metadata about the organization.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1638,7 +1638,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "name": "A String", # The name of the organization.
@@ -1658,7 +1658,7 @@
             "canonicalForm": "A String", # Output only. The canonicalized [ITU-T E.164](https://law.resource.org/pub/us/cfr/ibr/004/itu-t.E.164.1.2008.pdf) form of the phone number.
             "formattedType": "A String", # Output only. The type of the phone number translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the phone number.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1671,7 +1671,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the phone number. The type can be custom or one of these predefined values: * `home` * `work` * `mobile` * `homeFax` * `workFax` * `otherFax` * `pager` * `workMobile` * `workPager` * `main` * `googleVoice` * `other`
@@ -1682,7 +1682,7 @@
           { # A person's photo. A picture shown next to the person's name to help others recognize the person.
             "default": True or False, # True if the photo is a default photo; false if the photo is a user-provided photo.
             "metadata": { # Metadata about a field. # Metadata about the photo.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1695,7 +1695,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "url": "A String", # The URL of the photo. You can change the desired size by appending a query parameter `sz={size}` at the end of the url, where {size} is the size in pixels. Example: https://lh3.googleusercontent.com/-T_wVWLlmg7w/AAAAAAAAAAI/AAAAAAAABa8/00gzXvDBYqw/s100/photo.jpg?sz=50
@@ -1705,7 +1705,7 @@
           { # A person's relation to another person.
             "formattedType": "A String", # Output only. The type of the relation translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
             "metadata": { # Metadata about a field. # Metadata about the relation.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1718,7 +1718,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "person": "A String", # The name of the other person this relation refers to.
@@ -1729,7 +1729,7 @@
           { # **DEPRECATED**: No data will be returned A person's relationship interest .
             "formattedValue": "A String", # Output only. The value of the relationship interest translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
             "metadata": { # Metadata about a field. # Metadata about the relationship interest.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1742,7 +1742,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The kind of relationship the person is looking for. The value can be custom or one of these predefined values: * `friend` * `date` * `relationship` * `networking`
@@ -1752,7 +1752,7 @@
           { # **DEPRECATED**: No data will be returned A person's relationship status.
             "formattedValue": "A String", # Output only. The value of the relationship status translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the relationship status.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1765,7 +1765,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The relationship status. The value can be custom or one of these predefined values: * `single` * `inARelationship` * `engaged` * `married` * `itsComplicated` * `openRelationship` * `widowed` * `inDomesticPartnership` * `inCivilUnion`
@@ -1775,7 +1775,7 @@
           { # **DEPRECATED**: Please use `person.locations` instead. A person's past or current residence.
             "current": True or False, # True if the residence is the person's current residence; false if the residence is a past residence.
             "metadata": { # Metadata about a field. # Metadata about the residence.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1788,7 +1788,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The address of the residence.
@@ -1799,7 +1799,7 @@
           { # A person's SIP address. Session Initial Protocol addresses are used for VoIP communications to make voice or video calls over the internet.
             "formattedType": "A String", # Output only. The type of the SIP address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the SIP address.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1812,7 +1812,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the SIP address. The type can be custom or or one of these predefined values: * `home` * `work` * `mobile` * `other`
@@ -1822,7 +1822,7 @@
         "skills": [ # The person's skills.
           { # A skill that the person has.
             "metadata": { # Metadata about a field. # Metadata about the skill.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1835,7 +1835,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The skill; for example, `underwater basket weaving`.
@@ -1844,7 +1844,7 @@
         "taglines": [ # Output only. **DEPRECATED**: No data will be returned The person's taglines.
           { # **DEPRECATED**: No data will be returned A brief one-line description of the person.
             "metadata": { # Metadata about a field. # Metadata about the tagline.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1857,7 +1857,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The tagline.
@@ -1867,7 +1867,7 @@
           { # A person's associated URLs.
             "formattedType": "A String", # Output only. The type of the URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the URL.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1880,7 +1880,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the URL. The type can be custom or one of these predefined values: * `home` * `work` * `blog` * `profile` * `homePage` * `ftp` * `reservations` * `appInstallPage`: website for a Currents application. * `other`
@@ -1891,7 +1891,7 @@
           { # Arbitrary user data that is populated by the end users.
             "key": "A String", # The end user specified key of the user defined data.
             "metadata": { # Metadata about a field. # Metadata about the user defined data.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1904,7 +1904,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The end user specified value of the user defined data.
@@ -1972,7 +1972,7 @@
           "formattedType": "A String", # Output only. The type of the address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "formattedValue": "A String", # The unstructured value of the address. If this is not set by the user it will be automatically constructed from structured values.
           "metadata": { # Metadata about a field. # Metadata about the address.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -1985,7 +1985,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "poBox": "A String", # The P.O. box of the address.
@@ -2000,7 +2000,7 @@
         { # A person's age range.
           "ageRange": "A String", # The age range.
           "metadata": { # Metadata about a field. # Metadata about the age range.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2013,7 +2013,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
         },
@@ -2022,7 +2022,7 @@
         { # A person's short biography.
           "contentType": "A String", # The content type of the biography.
           "metadata": { # Metadata about a field. # Metadata about the biography.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2035,7 +2035,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The short biography.
@@ -2049,7 +2049,7 @@
             "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
           },
           "metadata": { # Metadata about a field. # Metadata about the birthday.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2062,7 +2062,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "text": "A String", # A free-form string representing the user's birthday.
@@ -2071,7 +2071,7 @@
       "braggingRights": [ # **DEPRECATED**: No data will be returned The person's bragging rights.
         { # **DEPRECATED**: No data will be returned A person's bragging rights.
           "metadata": { # Metadata about a field. # Metadata about the bragging rights.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2084,7 +2084,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The bragging rights; for example, `climbed mount everest`.
@@ -2094,7 +2094,7 @@
         { # A person's calendar URL.
           "formattedType": "A String", # Output only. The type of the calendar URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the calendar URL.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2107,7 +2107,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the calendar URL. The type can be custom or one of these predefined values: * `home` * `freeBusy` * `work`
@@ -2118,7 +2118,7 @@
         { # Arbitrary client data that is populated by clients. Duplicate keys and values are allowed.
           "key": "A String", # The client specified key of the client data.
           "metadata": { # Metadata about a field. # Metadata about the client data.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2131,7 +2131,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The client specified value of the client data.
@@ -2141,7 +2141,7 @@
         { # A person's cover photo. A large image shown on the person's profile page that represents who they are or what they care about.
           "default": True or False, # True if the cover photo is the default cover photo; false if the cover photo is a user-provided cover photo.
           "metadata": { # Metadata about a field. # Metadata about the cover photo.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2154,7 +2154,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "url": "A String", # The URL of the cover photo.
@@ -2165,7 +2165,7 @@
           "displayName": "A String", # The display name of the email.
           "formattedType": "A String", # Output only. The type of the email address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the email address.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2178,7 +2178,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the email address. The type can be custom or one of these predefined values: * `home` * `work` * `other`
@@ -2195,7 +2195,7 @@
           },
           "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the event.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2208,7 +2208,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the event. The type can be custom or one of these predefined values: * `anniversary` * `other`
@@ -2218,7 +2218,7 @@
         { # An identifier from an external entity related to the person.
           "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the external ID.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2231,7 +2231,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the external ID. The type can be custom or one of these predefined values: * `account` * `customer` * `loginId` * `network` * `organization`
@@ -2241,7 +2241,7 @@
       "fileAses": [ # The person's file-ases.
         { # The name that should be used to sort the person in a list.
           "metadata": { # Metadata about a field. # Metadata about the file-as.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2254,7 +2254,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The file-as value
@@ -2265,7 +2265,7 @@
           "addressMeAs": "A String", # The type of pronouns that should be used to address the person. The value can be custom or one of these predefined values: * `male` * `female` * `other`
           "formattedValue": "A String", # Output only. The value of the gender translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale. Unspecified or custom value are not localized.
           "metadata": { # Metadata about a field. # Metadata about the gender.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2278,7 +2278,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The gender for the person. The gender can be custom or one of these predefined values: * `male` * `female` * `unspecified`
@@ -2289,7 +2289,7 @@
           "formattedProtocol": "A String", # Output only. The protocol of the IM client formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "formattedType": "A String", # Output only. The type of the IM client translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the IM client.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2302,7 +2302,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "protocol": "A String", # The protocol of the IM client. The protocol can be custom or one of these predefined values: * `aim` * `msn` * `yahoo` * `skype` * `qq` * `googleTalk` * `icq` * `jabber` * `netMeeting`
@@ -2313,7 +2313,7 @@
       "interests": [ # The person's interests.
         { # One of the person's interests.
           "metadata": { # Metadata about a field. # Metadata about the interest.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2326,7 +2326,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The interest; for example, `stargazing`.
@@ -2335,7 +2335,7 @@
       "locales": [ # The person's locale preferences.
         { # A person's locale preference.
           "metadata": { # Metadata about a field. # Metadata about the locale.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2348,7 +2348,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The well-formed [IETF BCP 47](https://tools.ietf.org/html/bcp47) language tag representing the locale.
@@ -2362,7 +2362,7 @@
           "floor": "A String", # The floor name or number.
           "floorSection": "A String", # The floor section in `floor_name`.
           "metadata": { # Metadata about a field. # Metadata about the location.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2375,7 +2375,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the location. The type can be custom or one of these predefined values: * `desk` * `grewUp`
@@ -2392,7 +2392,7 @@
             "inViewerDomain": True or False, # True if the person is in the viewer's Google Workspace domain.
           },
           "metadata": { # Metadata about a field. # Metadata about the membership.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2405,7 +2405,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
         },
@@ -2438,7 +2438,7 @@
         { # A person's miscellaneous keyword.
           "formattedType": "A String", # Output only. The type of the miscellaneous keyword translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the miscellaneous keyword.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2451,7 +2451,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The miscellaneous keyword type.
@@ -2467,7 +2467,7 @@
           "honorificPrefix": "A String", # The honorific prefixes, such as `Mrs.` or `Dr.`
           "honorificSuffix": "A String", # The honorific suffixes, such as `Jr.`
           "metadata": { # Metadata about a field. # Metadata about the name.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2480,7 +2480,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "middleName": "A String", # The middle name(s).
@@ -2496,7 +2496,7 @@
       "nicknames": [ # The person's nicknames.
         { # A person's nickname.
           "metadata": { # Metadata about a field. # Metadata about the nickname.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2509,7 +2509,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the nickname.
@@ -2519,7 +2519,7 @@
       "occupations": [ # The person's occupations.
         { # A person's occupation.
           "metadata": { # Metadata about a field. # Metadata about the occupation.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2532,7 +2532,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The occupation; for example, `carpenter`.
@@ -2552,7 +2552,7 @@
           "jobDescription": "A String", # The person's job description at the organization.
           "location": "A String", # The location of the organization office the person works at.
           "metadata": { # Metadata about a field. # Metadata about the organization.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2565,7 +2565,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "name": "A String", # The name of the organization.
@@ -2585,7 +2585,7 @@
           "canonicalForm": "A String", # Output only. The canonicalized [ITU-T E.164](https://law.resource.org/pub/us/cfr/ibr/004/itu-t.E.164.1.2008.pdf) form of the phone number.
           "formattedType": "A String", # Output only. The type of the phone number translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the phone number.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2598,7 +2598,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the phone number. The type can be custom or one of these predefined values: * `home` * `work` * `mobile` * `homeFax` * `workFax` * `otherFax` * `pager` * `workMobile` * `workPager` * `main` * `googleVoice` * `other`
@@ -2609,7 +2609,7 @@
         { # A person's photo. A picture shown next to the person's name to help others recognize the person.
           "default": True or False, # True if the photo is a default photo; false if the photo is a user-provided photo.
           "metadata": { # Metadata about a field. # Metadata about the photo.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2622,7 +2622,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "url": "A String", # The URL of the photo. You can change the desired size by appending a query parameter `sz={size}` at the end of the url, where {size} is the size in pixels. Example: https://lh3.googleusercontent.com/-T_wVWLlmg7w/AAAAAAAAAAI/AAAAAAAABa8/00gzXvDBYqw/s100/photo.jpg?sz=50
@@ -2632,7 +2632,7 @@
         { # A person's relation to another person.
           "formattedType": "A String", # Output only. The type of the relation translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
           "metadata": { # Metadata about a field. # Metadata about the relation.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2645,7 +2645,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "person": "A String", # The name of the other person this relation refers to.
@@ -2656,7 +2656,7 @@
         { # **DEPRECATED**: No data will be returned A person's relationship interest .
           "formattedValue": "A String", # Output only. The value of the relationship interest translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
           "metadata": { # Metadata about a field. # Metadata about the relationship interest.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2669,7 +2669,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The kind of relationship the person is looking for. The value can be custom or one of these predefined values: * `friend` * `date` * `relationship` * `networking`
@@ -2679,7 +2679,7 @@
         { # **DEPRECATED**: No data will be returned A person's relationship status.
           "formattedValue": "A String", # Output only. The value of the relationship status translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the relationship status.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2692,7 +2692,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The relationship status. The value can be custom or one of these predefined values: * `single` * `inARelationship` * `engaged` * `married` * `itsComplicated` * `openRelationship` * `widowed` * `inDomesticPartnership` * `inCivilUnion`
@@ -2702,7 +2702,7 @@
         { # **DEPRECATED**: Please use `person.locations` instead. A person's past or current residence.
           "current": True or False, # True if the residence is the person's current residence; false if the residence is a past residence.
           "metadata": { # Metadata about a field. # Metadata about the residence.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2715,7 +2715,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The address of the residence.
@@ -2726,7 +2726,7 @@
         { # A person's SIP address. Session Initial Protocol addresses are used for VoIP communications to make voice or video calls over the internet.
           "formattedType": "A String", # Output only. The type of the SIP address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the SIP address.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2739,7 +2739,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the SIP address. The type can be custom or or one of these predefined values: * `home` * `work` * `mobile` * `other`
@@ -2749,7 +2749,7 @@
       "skills": [ # The person's skills.
         { # A skill that the person has.
           "metadata": { # Metadata about a field. # Metadata about the skill.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2762,7 +2762,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The skill; for example, `underwater basket weaving`.
@@ -2771,7 +2771,7 @@
       "taglines": [ # Output only. **DEPRECATED**: No data will be returned The person's taglines.
         { # **DEPRECATED**: No data will be returned A brief one-line description of the person.
           "metadata": { # Metadata about a field. # Metadata about the tagline.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2784,7 +2784,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The tagline.
@@ -2794,7 +2794,7 @@
         { # A person's associated URLs.
           "formattedType": "A String", # Output only. The type of the URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the URL.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2807,7 +2807,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the URL. The type can be custom or one of these predefined values: * `home` * `work` * `blog` * `profile` * `homePage` * `ftp` * `reservations` * `appInstallPage`: website for a Currents application. * `other`
@@ -2818,7 +2818,7 @@
         { # Arbitrary user data that is populated by the end users.
           "key": "A String", # The end user specified key of the user defined data.
           "metadata": { # Metadata about a field. # Metadata about the user defined data.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2831,7 +2831,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The end user specified value of the user defined data.
@@ -2854,7 +2854,7 @@
 Returns:
   An object of the form:
 
-    { # If not successful, returns BatchUpdateContactsErrorDetails.contacts, a list of errors corresponding to each contact. The response to a request to update a batch of contacts.
+    { # If not successful, returns BatchUpdateContactsErrorDetails, a list of errors corresponding to each contact. The response to a request to update a batch of contacts.
   "updateResult": { # A map of resource names to the contacts that were updated, unless the request `read_mask` is empty.
     "a_key": { # The response for a single person
       "httpStatusCode": 42, # **DEPRECATED** (Please use status instead) [HTTP 1.1 status code] (http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html).
@@ -2868,7 +2868,7 @@
             "formattedType": "A String", # Output only. The type of the address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "formattedValue": "A String", # The unstructured value of the address. If this is not set by the user it will be automatically constructed from structured values.
             "metadata": { # Metadata about a field. # Metadata about the address.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2881,7 +2881,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "poBox": "A String", # The P.O. box of the address.
@@ -2896,7 +2896,7 @@
           { # A person's age range.
             "ageRange": "A String", # The age range.
             "metadata": { # Metadata about a field. # Metadata about the age range.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2909,7 +2909,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
           },
@@ -2918,7 +2918,7 @@
           { # A person's short biography.
             "contentType": "A String", # The content type of the biography.
             "metadata": { # Metadata about a field. # Metadata about the biography.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2931,7 +2931,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The short biography.
@@ -2945,7 +2945,7 @@
               "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
             },
             "metadata": { # Metadata about a field. # Metadata about the birthday.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2958,7 +2958,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "text": "A String", # A free-form string representing the user's birthday.
@@ -2967,7 +2967,7 @@
         "braggingRights": [ # **DEPRECATED**: No data will be returned The person's bragging rights.
           { # **DEPRECATED**: No data will be returned A person's bragging rights.
             "metadata": { # Metadata about a field. # Metadata about the bragging rights.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -2980,7 +2980,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The bragging rights; for example, `climbed mount everest`.
@@ -2990,7 +2990,7 @@
           { # A person's calendar URL.
             "formattedType": "A String", # Output only. The type of the calendar URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the calendar URL.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3003,7 +3003,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the calendar URL. The type can be custom or one of these predefined values: * `home` * `freeBusy` * `work`
@@ -3014,7 +3014,7 @@
           { # Arbitrary client data that is populated by clients. Duplicate keys and values are allowed.
             "key": "A String", # The client specified key of the client data.
             "metadata": { # Metadata about a field. # Metadata about the client data.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3027,7 +3027,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The client specified value of the client data.
@@ -3037,7 +3037,7 @@
           { # A person's cover photo. A large image shown on the person's profile page that represents who they are or what they care about.
             "default": True or False, # True if the cover photo is the default cover photo; false if the cover photo is a user-provided cover photo.
             "metadata": { # Metadata about a field. # Metadata about the cover photo.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3050,7 +3050,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "url": "A String", # The URL of the cover photo.
@@ -3061,7 +3061,7 @@
             "displayName": "A String", # The display name of the email.
             "formattedType": "A String", # Output only. The type of the email address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the email address.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3074,7 +3074,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the email address. The type can be custom or one of these predefined values: * `home` * `work` * `other`
@@ -3091,7 +3091,7 @@
             },
             "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the event.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3104,7 +3104,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the event. The type can be custom or one of these predefined values: * `anniversary` * `other`
@@ -3114,7 +3114,7 @@
           { # An identifier from an external entity related to the person.
             "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the external ID.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3127,7 +3127,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the external ID. The type can be custom or one of these predefined values: * `account` * `customer` * `loginId` * `network` * `organization`
@@ -3137,7 +3137,7 @@
         "fileAses": [ # The person's file-ases.
           { # The name that should be used to sort the person in a list.
             "metadata": { # Metadata about a field. # Metadata about the file-as.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3150,7 +3150,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The file-as value
@@ -3161,7 +3161,7 @@
             "addressMeAs": "A String", # The type of pronouns that should be used to address the person. The value can be custom or one of these predefined values: * `male` * `female` * `other`
             "formattedValue": "A String", # Output only. The value of the gender translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale. Unspecified or custom value are not localized.
             "metadata": { # Metadata about a field. # Metadata about the gender.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3174,7 +3174,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The gender for the person. The gender can be custom or one of these predefined values: * `male` * `female` * `unspecified`
@@ -3185,7 +3185,7 @@
             "formattedProtocol": "A String", # Output only. The protocol of the IM client formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "formattedType": "A String", # Output only. The type of the IM client translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the IM client.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3198,7 +3198,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "protocol": "A String", # The protocol of the IM client. The protocol can be custom or one of these predefined values: * `aim` * `msn` * `yahoo` * `skype` * `qq` * `googleTalk` * `icq` * `jabber` * `netMeeting`
@@ -3209,7 +3209,7 @@
         "interests": [ # The person's interests.
           { # One of the person's interests.
             "metadata": { # Metadata about a field. # Metadata about the interest.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3222,7 +3222,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The interest; for example, `stargazing`.
@@ -3231,7 +3231,7 @@
         "locales": [ # The person's locale preferences.
           { # A person's locale preference.
             "metadata": { # Metadata about a field. # Metadata about the locale.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3244,7 +3244,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The well-formed [IETF BCP 47](https://tools.ietf.org/html/bcp47) language tag representing the locale.
@@ -3258,7 +3258,7 @@
             "floor": "A String", # The floor name or number.
             "floorSection": "A String", # The floor section in `floor_name`.
             "metadata": { # Metadata about a field. # Metadata about the location.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3271,7 +3271,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the location. The type can be custom or one of these predefined values: * `desk` * `grewUp`
@@ -3288,7 +3288,7 @@
               "inViewerDomain": True or False, # True if the person is in the viewer's Google Workspace domain.
             },
             "metadata": { # Metadata about a field. # Metadata about the membership.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3301,7 +3301,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
           },
@@ -3334,7 +3334,7 @@
           { # A person's miscellaneous keyword.
             "formattedType": "A String", # Output only. The type of the miscellaneous keyword translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the miscellaneous keyword.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3347,7 +3347,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The miscellaneous keyword type.
@@ -3363,7 +3363,7 @@
             "honorificPrefix": "A String", # The honorific prefixes, such as `Mrs.` or `Dr.`
             "honorificSuffix": "A String", # The honorific suffixes, such as `Jr.`
             "metadata": { # Metadata about a field. # Metadata about the name.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3376,7 +3376,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "middleName": "A String", # The middle name(s).
@@ -3392,7 +3392,7 @@
         "nicknames": [ # The person's nicknames.
           { # A person's nickname.
             "metadata": { # Metadata about a field. # Metadata about the nickname.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3405,7 +3405,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the nickname.
@@ -3415,7 +3415,7 @@
         "occupations": [ # The person's occupations.
           { # A person's occupation.
             "metadata": { # Metadata about a field. # Metadata about the occupation.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3428,7 +3428,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The occupation; for example, `carpenter`.
@@ -3448,7 +3448,7 @@
             "jobDescription": "A String", # The person's job description at the organization.
             "location": "A String", # The location of the organization office the person works at.
             "metadata": { # Metadata about a field. # Metadata about the organization.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3461,7 +3461,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "name": "A String", # The name of the organization.
@@ -3481,7 +3481,7 @@
             "canonicalForm": "A String", # Output only. The canonicalized [ITU-T E.164](https://law.resource.org/pub/us/cfr/ibr/004/itu-t.E.164.1.2008.pdf) form of the phone number.
             "formattedType": "A String", # Output only. The type of the phone number translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the phone number.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3494,7 +3494,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the phone number. The type can be custom or one of these predefined values: * `home` * `work` * `mobile` * `homeFax` * `workFax` * `otherFax` * `pager` * `workMobile` * `workPager` * `main` * `googleVoice` * `other`
@@ -3505,7 +3505,7 @@
           { # A person's photo. A picture shown next to the person's name to help others recognize the person.
             "default": True or False, # True if the photo is a default photo; false if the photo is a user-provided photo.
             "metadata": { # Metadata about a field. # Metadata about the photo.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3518,7 +3518,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "url": "A String", # The URL of the photo. You can change the desired size by appending a query parameter `sz={size}` at the end of the url, where {size} is the size in pixels. Example: https://lh3.googleusercontent.com/-T_wVWLlmg7w/AAAAAAAAAAI/AAAAAAAABa8/00gzXvDBYqw/s100/photo.jpg?sz=50
@@ -3528,7 +3528,7 @@
           { # A person's relation to another person.
             "formattedType": "A String", # Output only. The type of the relation translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
             "metadata": { # Metadata about a field. # Metadata about the relation.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3541,7 +3541,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "person": "A String", # The name of the other person this relation refers to.
@@ -3552,7 +3552,7 @@
           { # **DEPRECATED**: No data will be returned A person's relationship interest .
             "formattedValue": "A String", # Output only. The value of the relationship interest translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
             "metadata": { # Metadata about a field. # Metadata about the relationship interest.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3565,7 +3565,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The kind of relationship the person is looking for. The value can be custom or one of these predefined values: * `friend` * `date` * `relationship` * `networking`
@@ -3575,7 +3575,7 @@
           { # **DEPRECATED**: No data will be returned A person's relationship status.
             "formattedValue": "A String", # Output only. The value of the relationship status translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the relationship status.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3588,7 +3588,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The relationship status. The value can be custom or one of these predefined values: * `single` * `inARelationship` * `engaged` * `married` * `itsComplicated` * `openRelationship` * `widowed` * `inDomesticPartnership` * `inCivilUnion`
@@ -3598,7 +3598,7 @@
           { # **DEPRECATED**: Please use `person.locations` instead. A person's past or current residence.
             "current": True or False, # True if the residence is the person's current residence; false if the residence is a past residence.
             "metadata": { # Metadata about a field. # Metadata about the residence.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3611,7 +3611,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The address of the residence.
@@ -3622,7 +3622,7 @@
           { # A person's SIP address. Session Initial Protocol addresses are used for VoIP communications to make voice or video calls over the internet.
             "formattedType": "A String", # Output only. The type of the SIP address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the SIP address.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3635,7 +3635,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the SIP address. The type can be custom or or one of these predefined values: * `home` * `work` * `mobile` * `other`
@@ -3645,7 +3645,7 @@
         "skills": [ # The person's skills.
           { # A skill that the person has.
             "metadata": { # Metadata about a field. # Metadata about the skill.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3658,7 +3658,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The skill; for example, `underwater basket weaving`.
@@ -3667,7 +3667,7 @@
         "taglines": [ # Output only. **DEPRECATED**: No data will be returned The person's taglines.
           { # **DEPRECATED**: No data will be returned A brief one-line description of the person.
             "metadata": { # Metadata about a field. # Metadata about the tagline.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3680,7 +3680,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The tagline.
@@ -3690,7 +3690,7 @@
           { # A person's associated URLs.
             "formattedType": "A String", # Output only. The type of the URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the URL.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3703,7 +3703,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the URL. The type can be custom or one of these predefined values: * `home` * `work` * `blog` * `profile` * `homePage` * `ftp` * `reservations` * `appInstallPage`: website for a Currents application. * `other`
@@ -3714,7 +3714,7 @@
           { # Arbitrary user data that is populated by the end users.
             "key": "A String", # The end user specified key of the user defined data.
             "metadata": { # Metadata about a field. # Metadata about the user defined data.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3727,7 +3727,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The end user specified value of the user defined data.
@@ -3772,7 +3772,7 @@
       "formattedType": "A String", # Output only. The type of the address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "formattedValue": "A String", # The unstructured value of the address. If this is not set by the user it will be automatically constructed from structured values.
       "metadata": { # Metadata about a field. # Metadata about the address.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3785,7 +3785,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "poBox": "A String", # The P.O. box of the address.
@@ -3800,7 +3800,7 @@
     { # A person's age range.
       "ageRange": "A String", # The age range.
       "metadata": { # Metadata about a field. # Metadata about the age range.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3813,7 +3813,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
     },
@@ -3822,7 +3822,7 @@
     { # A person's short biography.
       "contentType": "A String", # The content type of the biography.
       "metadata": { # Metadata about a field. # Metadata about the biography.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3835,7 +3835,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The short biography.
@@ -3849,7 +3849,7 @@
         "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
       },
       "metadata": { # Metadata about a field. # Metadata about the birthday.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3862,7 +3862,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "text": "A String", # A free-form string representing the user's birthday.
@@ -3871,7 +3871,7 @@
   "braggingRights": [ # **DEPRECATED**: No data will be returned The person's bragging rights.
     { # **DEPRECATED**: No data will be returned A person's bragging rights.
       "metadata": { # Metadata about a field. # Metadata about the bragging rights.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3884,7 +3884,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The bragging rights; for example, `climbed mount everest`.
@@ -3894,7 +3894,7 @@
     { # A person's calendar URL.
       "formattedType": "A String", # Output only. The type of the calendar URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the calendar URL.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3907,7 +3907,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the calendar URL. The type can be custom or one of these predefined values: * `home` * `freeBusy` * `work`
@@ -3918,7 +3918,7 @@
     { # Arbitrary client data that is populated by clients. Duplicate keys and values are allowed.
       "key": "A String", # The client specified key of the client data.
       "metadata": { # Metadata about a field. # Metadata about the client data.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3931,7 +3931,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The client specified value of the client data.
@@ -3941,7 +3941,7 @@
     { # A person's cover photo. A large image shown on the person's profile page that represents who they are or what they care about.
       "default": True or False, # True if the cover photo is the default cover photo; false if the cover photo is a user-provided cover photo.
       "metadata": { # Metadata about a field. # Metadata about the cover photo.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3954,7 +3954,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "url": "A String", # The URL of the cover photo.
@@ -3965,7 +3965,7 @@
       "displayName": "A String", # The display name of the email.
       "formattedType": "A String", # Output only. The type of the email address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the email address.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -3978,7 +3978,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the email address. The type can be custom or one of these predefined values: * `home` * `work` * `other`
@@ -3995,7 +3995,7 @@
       },
       "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the event.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4008,7 +4008,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the event. The type can be custom or one of these predefined values: * `anniversary` * `other`
@@ -4018,7 +4018,7 @@
     { # An identifier from an external entity related to the person.
       "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the external ID.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4031,7 +4031,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the external ID. The type can be custom or one of these predefined values: * `account` * `customer` * `loginId` * `network` * `organization`
@@ -4041,7 +4041,7 @@
   "fileAses": [ # The person's file-ases.
     { # The name that should be used to sort the person in a list.
       "metadata": { # Metadata about a field. # Metadata about the file-as.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4054,7 +4054,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The file-as value
@@ -4065,7 +4065,7 @@
       "addressMeAs": "A String", # The type of pronouns that should be used to address the person. The value can be custom or one of these predefined values: * `male` * `female` * `other`
       "formattedValue": "A String", # Output only. The value of the gender translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale. Unspecified or custom value are not localized.
       "metadata": { # Metadata about a field. # Metadata about the gender.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4078,7 +4078,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The gender for the person. The gender can be custom or one of these predefined values: * `male` * `female` * `unspecified`
@@ -4089,7 +4089,7 @@
       "formattedProtocol": "A String", # Output only. The protocol of the IM client formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "formattedType": "A String", # Output only. The type of the IM client translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the IM client.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4102,7 +4102,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "protocol": "A String", # The protocol of the IM client. The protocol can be custom or one of these predefined values: * `aim` * `msn` * `yahoo` * `skype` * `qq` * `googleTalk` * `icq` * `jabber` * `netMeeting`
@@ -4113,7 +4113,7 @@
   "interests": [ # The person's interests.
     { # One of the person's interests.
       "metadata": { # Metadata about a field. # Metadata about the interest.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4126,7 +4126,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The interest; for example, `stargazing`.
@@ -4135,7 +4135,7 @@
   "locales": [ # The person's locale preferences.
     { # A person's locale preference.
       "metadata": { # Metadata about a field. # Metadata about the locale.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4148,7 +4148,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The well-formed [IETF BCP 47](https://tools.ietf.org/html/bcp47) language tag representing the locale.
@@ -4162,7 +4162,7 @@
       "floor": "A String", # The floor name or number.
       "floorSection": "A String", # The floor section in `floor_name`.
       "metadata": { # Metadata about a field. # Metadata about the location.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4175,7 +4175,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the location. The type can be custom or one of these predefined values: * `desk` * `grewUp`
@@ -4192,7 +4192,7 @@
         "inViewerDomain": True or False, # True if the person is in the viewer's Google Workspace domain.
       },
       "metadata": { # Metadata about a field. # Metadata about the membership.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4205,7 +4205,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
     },
@@ -4238,7 +4238,7 @@
     { # A person's miscellaneous keyword.
       "formattedType": "A String", # Output only. The type of the miscellaneous keyword translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the miscellaneous keyword.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4251,7 +4251,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The miscellaneous keyword type.
@@ -4267,7 +4267,7 @@
       "honorificPrefix": "A String", # The honorific prefixes, such as `Mrs.` or `Dr.`
       "honorificSuffix": "A String", # The honorific suffixes, such as `Jr.`
       "metadata": { # Metadata about a field. # Metadata about the name.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4280,7 +4280,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "middleName": "A String", # The middle name(s).
@@ -4296,7 +4296,7 @@
   "nicknames": [ # The person's nicknames.
     { # A person's nickname.
       "metadata": { # Metadata about a field. # Metadata about the nickname.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4309,7 +4309,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the nickname.
@@ -4319,7 +4319,7 @@
   "occupations": [ # The person's occupations.
     { # A person's occupation.
       "metadata": { # Metadata about a field. # Metadata about the occupation.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4332,7 +4332,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The occupation; for example, `carpenter`.
@@ -4352,7 +4352,7 @@
       "jobDescription": "A String", # The person's job description at the organization.
       "location": "A String", # The location of the organization office the person works at.
       "metadata": { # Metadata about a field. # Metadata about the organization.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4365,7 +4365,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "name": "A String", # The name of the organization.
@@ -4385,7 +4385,7 @@
       "canonicalForm": "A String", # Output only. The canonicalized [ITU-T E.164](https://law.resource.org/pub/us/cfr/ibr/004/itu-t.E.164.1.2008.pdf) form of the phone number.
       "formattedType": "A String", # Output only. The type of the phone number translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the phone number.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4398,7 +4398,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the phone number. The type can be custom or one of these predefined values: * `home` * `work` * `mobile` * `homeFax` * `workFax` * `otherFax` * `pager` * `workMobile` * `workPager` * `main` * `googleVoice` * `other`
@@ -4409,7 +4409,7 @@
     { # A person's photo. A picture shown next to the person's name to help others recognize the person.
       "default": True or False, # True if the photo is a default photo; false if the photo is a user-provided photo.
       "metadata": { # Metadata about a field. # Metadata about the photo.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4422,7 +4422,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "url": "A String", # The URL of the photo. You can change the desired size by appending a query parameter `sz={size}` at the end of the url, where {size} is the size in pixels. Example: https://lh3.googleusercontent.com/-T_wVWLlmg7w/AAAAAAAAAAI/AAAAAAAABa8/00gzXvDBYqw/s100/photo.jpg?sz=50
@@ -4432,7 +4432,7 @@
     { # A person's relation to another person.
       "formattedType": "A String", # Output only. The type of the relation translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
       "metadata": { # Metadata about a field. # Metadata about the relation.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4445,7 +4445,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "person": "A String", # The name of the other person this relation refers to.
@@ -4456,7 +4456,7 @@
     { # **DEPRECATED**: No data will be returned A person's relationship interest .
       "formattedValue": "A String", # Output only. The value of the relationship interest translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
       "metadata": { # Metadata about a field. # Metadata about the relationship interest.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4469,7 +4469,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The kind of relationship the person is looking for. The value can be custom or one of these predefined values: * `friend` * `date` * `relationship` * `networking`
@@ -4479,7 +4479,7 @@
     { # **DEPRECATED**: No data will be returned A person's relationship status.
       "formattedValue": "A String", # Output only. The value of the relationship status translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the relationship status.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4492,7 +4492,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The relationship status. The value can be custom or one of these predefined values: * `single` * `inARelationship` * `engaged` * `married` * `itsComplicated` * `openRelationship` * `widowed` * `inDomesticPartnership` * `inCivilUnion`
@@ -4502,7 +4502,7 @@
     { # **DEPRECATED**: Please use `person.locations` instead. A person's past or current residence.
       "current": True or False, # True if the residence is the person's current residence; false if the residence is a past residence.
       "metadata": { # Metadata about a field. # Metadata about the residence.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4515,7 +4515,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The address of the residence.
@@ -4526,7 +4526,7 @@
     { # A person's SIP address. Session Initial Protocol addresses are used for VoIP communications to make voice or video calls over the internet.
       "formattedType": "A String", # Output only. The type of the SIP address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the SIP address.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4539,7 +4539,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the SIP address. The type can be custom or or one of these predefined values: * `home` * `work` * `mobile` * `other`
@@ -4549,7 +4549,7 @@
   "skills": [ # The person's skills.
     { # A skill that the person has.
       "metadata": { # Metadata about a field. # Metadata about the skill.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4562,7 +4562,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The skill; for example, `underwater basket weaving`.
@@ -4571,7 +4571,7 @@
   "taglines": [ # Output only. **DEPRECATED**: No data will be returned The person's taglines.
     { # **DEPRECATED**: No data will be returned A brief one-line description of the person.
       "metadata": { # Metadata about a field. # Metadata about the tagline.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4584,7 +4584,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The tagline.
@@ -4594,7 +4594,7 @@
     { # A person's associated URLs.
       "formattedType": "A String", # Output only. The type of the URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the URL.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4607,7 +4607,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the URL. The type can be custom or one of these predefined values: * `home` * `work` * `blog` * `profile` * `homePage` * `ftp` * `reservations` * `appInstallPage`: website for a Currents application. * `other`
@@ -4618,7 +4618,7 @@
     { # Arbitrary user data that is populated by the end users.
       "key": "A String", # The end user specified key of the user defined data.
       "metadata": { # Metadata about a field. # Metadata about the user defined data.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4631,7 +4631,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The end user specified value of the user defined data.
@@ -4664,7 +4664,7 @@
       "formattedType": "A String", # Output only. The type of the address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "formattedValue": "A String", # The unstructured value of the address. If this is not set by the user it will be automatically constructed from structured values.
       "metadata": { # Metadata about a field. # Metadata about the address.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4677,7 +4677,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "poBox": "A String", # The P.O. box of the address.
@@ -4692,7 +4692,7 @@
     { # A person's age range.
       "ageRange": "A String", # The age range.
       "metadata": { # Metadata about a field. # Metadata about the age range.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4705,7 +4705,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
     },
@@ -4714,7 +4714,7 @@
     { # A person's short biography.
       "contentType": "A String", # The content type of the biography.
       "metadata": { # Metadata about a field. # Metadata about the biography.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4727,7 +4727,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The short biography.
@@ -4741,7 +4741,7 @@
         "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
       },
       "metadata": { # Metadata about a field. # Metadata about the birthday.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4754,7 +4754,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "text": "A String", # A free-form string representing the user's birthday.
@@ -4763,7 +4763,7 @@
   "braggingRights": [ # **DEPRECATED**: No data will be returned The person's bragging rights.
     { # **DEPRECATED**: No data will be returned A person's bragging rights.
       "metadata": { # Metadata about a field. # Metadata about the bragging rights.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4776,7 +4776,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The bragging rights; for example, `climbed mount everest`.
@@ -4786,7 +4786,7 @@
     { # A person's calendar URL.
       "formattedType": "A String", # Output only. The type of the calendar URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the calendar URL.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4799,7 +4799,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the calendar URL. The type can be custom or one of these predefined values: * `home` * `freeBusy` * `work`
@@ -4810,7 +4810,7 @@
     { # Arbitrary client data that is populated by clients. Duplicate keys and values are allowed.
       "key": "A String", # The client specified key of the client data.
       "metadata": { # Metadata about a field. # Metadata about the client data.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4823,7 +4823,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The client specified value of the client data.
@@ -4833,7 +4833,7 @@
     { # A person's cover photo. A large image shown on the person's profile page that represents who they are or what they care about.
       "default": True or False, # True if the cover photo is the default cover photo; false if the cover photo is a user-provided cover photo.
       "metadata": { # Metadata about a field. # Metadata about the cover photo.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4846,7 +4846,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "url": "A String", # The URL of the cover photo.
@@ -4857,7 +4857,7 @@
       "displayName": "A String", # The display name of the email.
       "formattedType": "A String", # Output only. The type of the email address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the email address.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4870,7 +4870,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the email address. The type can be custom or one of these predefined values: * `home` * `work` * `other`
@@ -4887,7 +4887,7 @@
       },
       "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the event.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4900,7 +4900,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the event. The type can be custom or one of these predefined values: * `anniversary` * `other`
@@ -4910,7 +4910,7 @@
     { # An identifier from an external entity related to the person.
       "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the external ID.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4923,7 +4923,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the external ID. The type can be custom or one of these predefined values: * `account` * `customer` * `loginId` * `network` * `organization`
@@ -4933,7 +4933,7 @@
   "fileAses": [ # The person's file-ases.
     { # The name that should be used to sort the person in a list.
       "metadata": { # Metadata about a field. # Metadata about the file-as.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4946,7 +4946,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The file-as value
@@ -4957,7 +4957,7 @@
       "addressMeAs": "A String", # The type of pronouns that should be used to address the person. The value can be custom or one of these predefined values: * `male` * `female` * `other`
       "formattedValue": "A String", # Output only. The value of the gender translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale. Unspecified or custom value are not localized.
       "metadata": { # Metadata about a field. # Metadata about the gender.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4970,7 +4970,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The gender for the person. The gender can be custom or one of these predefined values: * `male` * `female` * `unspecified`
@@ -4981,7 +4981,7 @@
       "formattedProtocol": "A String", # Output only. The protocol of the IM client formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "formattedType": "A String", # Output only. The type of the IM client translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the IM client.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -4994,7 +4994,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "protocol": "A String", # The protocol of the IM client. The protocol can be custom or one of these predefined values: * `aim` * `msn` * `yahoo` * `skype` * `qq` * `googleTalk` * `icq` * `jabber` * `netMeeting`
@@ -5005,7 +5005,7 @@
   "interests": [ # The person's interests.
     { # One of the person's interests.
       "metadata": { # Metadata about a field. # Metadata about the interest.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5018,7 +5018,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The interest; for example, `stargazing`.
@@ -5027,7 +5027,7 @@
   "locales": [ # The person's locale preferences.
     { # A person's locale preference.
       "metadata": { # Metadata about a field. # Metadata about the locale.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5040,7 +5040,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The well-formed [IETF BCP 47](https://tools.ietf.org/html/bcp47) language tag representing the locale.
@@ -5054,7 +5054,7 @@
       "floor": "A String", # The floor name or number.
       "floorSection": "A String", # The floor section in `floor_name`.
       "metadata": { # Metadata about a field. # Metadata about the location.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5067,7 +5067,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the location. The type can be custom or one of these predefined values: * `desk` * `grewUp`
@@ -5084,7 +5084,7 @@
         "inViewerDomain": True or False, # True if the person is in the viewer's Google Workspace domain.
       },
       "metadata": { # Metadata about a field. # Metadata about the membership.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5097,7 +5097,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
     },
@@ -5130,7 +5130,7 @@
     { # A person's miscellaneous keyword.
       "formattedType": "A String", # Output only. The type of the miscellaneous keyword translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the miscellaneous keyword.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5143,7 +5143,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The miscellaneous keyword type.
@@ -5159,7 +5159,7 @@
       "honorificPrefix": "A String", # The honorific prefixes, such as `Mrs.` or `Dr.`
       "honorificSuffix": "A String", # The honorific suffixes, such as `Jr.`
       "metadata": { # Metadata about a field. # Metadata about the name.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5172,7 +5172,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "middleName": "A String", # The middle name(s).
@@ -5188,7 +5188,7 @@
   "nicknames": [ # The person's nicknames.
     { # A person's nickname.
       "metadata": { # Metadata about a field. # Metadata about the nickname.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5201,7 +5201,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the nickname.
@@ -5211,7 +5211,7 @@
   "occupations": [ # The person's occupations.
     { # A person's occupation.
       "metadata": { # Metadata about a field. # Metadata about the occupation.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5224,7 +5224,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The occupation; for example, `carpenter`.
@@ -5244,7 +5244,7 @@
       "jobDescription": "A String", # The person's job description at the organization.
       "location": "A String", # The location of the organization office the person works at.
       "metadata": { # Metadata about a field. # Metadata about the organization.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5257,7 +5257,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "name": "A String", # The name of the organization.
@@ -5277,7 +5277,7 @@
       "canonicalForm": "A String", # Output only. The canonicalized [ITU-T E.164](https://law.resource.org/pub/us/cfr/ibr/004/itu-t.E.164.1.2008.pdf) form of the phone number.
       "formattedType": "A String", # Output only. The type of the phone number translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the phone number.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5290,7 +5290,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the phone number. The type can be custom or one of these predefined values: * `home` * `work` * `mobile` * `homeFax` * `workFax` * `otherFax` * `pager` * `workMobile` * `workPager` * `main` * `googleVoice` * `other`
@@ -5301,7 +5301,7 @@
     { # A person's photo. A picture shown next to the person's name to help others recognize the person.
       "default": True or False, # True if the photo is a default photo; false if the photo is a user-provided photo.
       "metadata": { # Metadata about a field. # Metadata about the photo.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5314,7 +5314,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "url": "A String", # The URL of the photo. You can change the desired size by appending a query parameter `sz={size}` at the end of the url, where {size} is the size in pixels. Example: https://lh3.googleusercontent.com/-T_wVWLlmg7w/AAAAAAAAAAI/AAAAAAAABa8/00gzXvDBYqw/s100/photo.jpg?sz=50
@@ -5324,7 +5324,7 @@
     { # A person's relation to another person.
       "formattedType": "A String", # Output only. The type of the relation translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
       "metadata": { # Metadata about a field. # Metadata about the relation.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5337,7 +5337,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "person": "A String", # The name of the other person this relation refers to.
@@ -5348,7 +5348,7 @@
     { # **DEPRECATED**: No data will be returned A person's relationship interest .
       "formattedValue": "A String", # Output only. The value of the relationship interest translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
       "metadata": { # Metadata about a field. # Metadata about the relationship interest.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5361,7 +5361,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The kind of relationship the person is looking for. The value can be custom or one of these predefined values: * `friend` * `date` * `relationship` * `networking`
@@ -5371,7 +5371,7 @@
     { # **DEPRECATED**: No data will be returned A person's relationship status.
       "formattedValue": "A String", # Output only. The value of the relationship status translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the relationship status.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5384,7 +5384,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The relationship status. The value can be custom or one of these predefined values: * `single` * `inARelationship` * `engaged` * `married` * `itsComplicated` * `openRelationship` * `widowed` * `inDomesticPartnership` * `inCivilUnion`
@@ -5394,7 +5394,7 @@
     { # **DEPRECATED**: Please use `person.locations` instead. A person's past or current residence.
       "current": True or False, # True if the residence is the person's current residence; false if the residence is a past residence.
       "metadata": { # Metadata about a field. # Metadata about the residence.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5407,7 +5407,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The address of the residence.
@@ -5418,7 +5418,7 @@
     { # A person's SIP address. Session Initial Protocol addresses are used for VoIP communications to make voice or video calls over the internet.
       "formattedType": "A String", # Output only. The type of the SIP address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the SIP address.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5431,7 +5431,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the SIP address. The type can be custom or or one of these predefined values: * `home` * `work` * `mobile` * `other`
@@ -5441,7 +5441,7 @@
   "skills": [ # The person's skills.
     { # A skill that the person has.
       "metadata": { # Metadata about a field. # Metadata about the skill.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5454,7 +5454,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The skill; for example, `underwater basket weaving`.
@@ -5463,7 +5463,7 @@
   "taglines": [ # Output only. **DEPRECATED**: No data will be returned The person's taglines.
     { # **DEPRECATED**: No data will be returned A brief one-line description of the person.
       "metadata": { # Metadata about a field. # Metadata about the tagline.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5476,7 +5476,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The tagline.
@@ -5486,7 +5486,7 @@
     { # A person's associated URLs.
       "formattedType": "A String", # Output only. The type of the URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the URL.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5499,7 +5499,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the URL. The type can be custom or one of these predefined values: * `home` * `work` * `blog` * `profile` * `homePage` * `ftp` * `reservations` * `appInstallPage`: website for a Currents application. * `other`
@@ -5510,7 +5510,7 @@
     { # Arbitrary user data that is populated by the end users.
       "key": "A String", # The end user specified key of the user defined data.
       "metadata": { # Metadata about a field. # Metadata about the user defined data.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5523,7 +5523,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The end user specified value of the user defined data.
@@ -5582,7 +5582,7 @@
         "formattedType": "A String", # Output only. The type of the address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
         "formattedValue": "A String", # The unstructured value of the address. If this is not set by the user it will be automatically constructed from structured values.
         "metadata": { # Metadata about a field. # Metadata about the address.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5595,7 +5595,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "poBox": "A String", # The P.O. box of the address.
@@ -5610,7 +5610,7 @@
       { # A person's age range.
         "ageRange": "A String", # The age range.
         "metadata": { # Metadata about a field. # Metadata about the age range.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5623,7 +5623,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
       },
@@ -5632,7 +5632,7 @@
       { # A person's short biography.
         "contentType": "A String", # The content type of the biography.
         "metadata": { # Metadata about a field. # Metadata about the biography.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5645,7 +5645,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The short biography.
@@ -5659,7 +5659,7 @@
           "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
         },
         "metadata": { # Metadata about a field. # Metadata about the birthday.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5672,7 +5672,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "text": "A String", # A free-form string representing the user's birthday.
@@ -5681,7 +5681,7 @@
     "braggingRights": [ # **DEPRECATED**: No data will be returned The person's bragging rights.
       { # **DEPRECATED**: No data will be returned A person's bragging rights.
         "metadata": { # Metadata about a field. # Metadata about the bragging rights.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5694,7 +5694,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The bragging rights; for example, `climbed mount everest`.
@@ -5704,7 +5704,7 @@
       { # A person's calendar URL.
         "formattedType": "A String", # Output only. The type of the calendar URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
         "metadata": { # Metadata about a field. # Metadata about the calendar URL.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5717,7 +5717,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "type": "A String", # The type of the calendar URL. The type can be custom or one of these predefined values: * `home` * `freeBusy` * `work`
@@ -5728,7 +5728,7 @@
       { # Arbitrary client data that is populated by clients. Duplicate keys and values are allowed.
         "key": "A String", # The client specified key of the client data.
         "metadata": { # Metadata about a field. # Metadata about the client data.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5741,7 +5741,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The client specified value of the client data.
@@ -5751,7 +5751,7 @@
       { # A person's cover photo. A large image shown on the person's profile page that represents who they are or what they care about.
         "default": True or False, # True if the cover photo is the default cover photo; false if the cover photo is a user-provided cover photo.
         "metadata": { # Metadata about a field. # Metadata about the cover photo.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5764,7 +5764,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "url": "A String", # The URL of the cover photo.
@@ -5775,7 +5775,7 @@
         "displayName": "A String", # The display name of the email.
         "formattedType": "A String", # Output only. The type of the email address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
         "metadata": { # Metadata about a field. # Metadata about the email address.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5788,7 +5788,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "type": "A String", # The type of the email address. The type can be custom or one of these predefined values: * `home` * `work` * `other`
@@ -5805,7 +5805,7 @@
         },
         "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
         "metadata": { # Metadata about a field. # Metadata about the event.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5818,7 +5818,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "type": "A String", # The type of the event. The type can be custom or one of these predefined values: * `anniversary` * `other`
@@ -5828,7 +5828,7 @@
       { # An identifier from an external entity related to the person.
         "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
         "metadata": { # Metadata about a field. # Metadata about the external ID.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5841,7 +5841,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "type": "A String", # The type of the external ID. The type can be custom or one of these predefined values: * `account` * `customer` * `loginId` * `network` * `organization`
@@ -5851,7 +5851,7 @@
     "fileAses": [ # The person's file-ases.
       { # The name that should be used to sort the person in a list.
         "metadata": { # Metadata about a field. # Metadata about the file-as.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5864,7 +5864,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The file-as value
@@ -5875,7 +5875,7 @@
         "addressMeAs": "A String", # The type of pronouns that should be used to address the person. The value can be custom or one of these predefined values: * `male` * `female` * `other`
         "formattedValue": "A String", # Output only. The value of the gender translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale. Unspecified or custom value are not localized.
         "metadata": { # Metadata about a field. # Metadata about the gender.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5888,7 +5888,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The gender for the person. The gender can be custom or one of these predefined values: * `male` * `female` * `unspecified`
@@ -5899,7 +5899,7 @@
         "formattedProtocol": "A String", # Output only. The protocol of the IM client formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
         "formattedType": "A String", # Output only. The type of the IM client translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
         "metadata": { # Metadata about a field. # Metadata about the IM client.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5912,7 +5912,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "protocol": "A String", # The protocol of the IM client. The protocol can be custom or one of these predefined values: * `aim` * `msn` * `yahoo` * `skype` * `qq` * `googleTalk` * `icq` * `jabber` * `netMeeting`
@@ -5923,7 +5923,7 @@
     "interests": [ # The person's interests.
       { # One of the person's interests.
         "metadata": { # Metadata about a field. # Metadata about the interest.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5936,7 +5936,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The interest; for example, `stargazing`.
@@ -5945,7 +5945,7 @@
     "locales": [ # The person's locale preferences.
       { # A person's locale preference.
         "metadata": { # Metadata about a field. # Metadata about the locale.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5958,7 +5958,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The well-formed [IETF BCP 47](https://tools.ietf.org/html/bcp47) language tag representing the locale.
@@ -5972,7 +5972,7 @@
         "floor": "A String", # The floor name or number.
         "floorSection": "A String", # The floor section in `floor_name`.
         "metadata": { # Metadata about a field. # Metadata about the location.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -5985,7 +5985,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "type": "A String", # The type of the location. The type can be custom or one of these predefined values: * `desk` * `grewUp`
@@ -6002,7 +6002,7 @@
           "inViewerDomain": True or False, # True if the person is in the viewer's Google Workspace domain.
         },
         "metadata": { # Metadata about a field. # Metadata about the membership.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6015,7 +6015,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
       },
@@ -6048,7 +6048,7 @@
       { # A person's miscellaneous keyword.
         "formattedType": "A String", # Output only. The type of the miscellaneous keyword translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
         "metadata": { # Metadata about a field. # Metadata about the miscellaneous keyword.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6061,7 +6061,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "type": "A String", # The miscellaneous keyword type.
@@ -6077,7 +6077,7 @@
         "honorificPrefix": "A String", # The honorific prefixes, such as `Mrs.` or `Dr.`
         "honorificSuffix": "A String", # The honorific suffixes, such as `Jr.`
         "metadata": { # Metadata about a field. # Metadata about the name.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6090,7 +6090,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "middleName": "A String", # The middle name(s).
@@ -6106,7 +6106,7 @@
     "nicknames": [ # The person's nicknames.
       { # A person's nickname.
         "metadata": { # Metadata about a field. # Metadata about the nickname.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6119,7 +6119,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "type": "A String", # The type of the nickname.
@@ -6129,7 +6129,7 @@
     "occupations": [ # The person's occupations.
       { # A person's occupation.
         "metadata": { # Metadata about a field. # Metadata about the occupation.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6142,7 +6142,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The occupation; for example, `carpenter`.
@@ -6162,7 +6162,7 @@
         "jobDescription": "A String", # The person's job description at the organization.
         "location": "A String", # The location of the organization office the person works at.
         "metadata": { # Metadata about a field. # Metadata about the organization.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6175,7 +6175,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "name": "A String", # The name of the organization.
@@ -6195,7 +6195,7 @@
         "canonicalForm": "A String", # Output only. The canonicalized [ITU-T E.164](https://law.resource.org/pub/us/cfr/ibr/004/itu-t.E.164.1.2008.pdf) form of the phone number.
         "formattedType": "A String", # Output only. The type of the phone number translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
         "metadata": { # Metadata about a field. # Metadata about the phone number.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6208,7 +6208,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "type": "A String", # The type of the phone number. The type can be custom or one of these predefined values: * `home` * `work` * `mobile` * `homeFax` * `workFax` * `otherFax` * `pager` * `workMobile` * `workPager` * `main` * `googleVoice` * `other`
@@ -6219,7 +6219,7 @@
       { # A person's photo. A picture shown next to the person's name to help others recognize the person.
         "default": True or False, # True if the photo is a default photo; false if the photo is a user-provided photo.
         "metadata": { # Metadata about a field. # Metadata about the photo.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6232,7 +6232,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "url": "A String", # The URL of the photo. You can change the desired size by appending a query parameter `sz={size}` at the end of the url, where {size} is the size in pixels. Example: https://lh3.googleusercontent.com/-T_wVWLlmg7w/AAAAAAAAAAI/AAAAAAAABa8/00gzXvDBYqw/s100/photo.jpg?sz=50
@@ -6242,7 +6242,7 @@
       { # A person's relation to another person.
         "formattedType": "A String", # Output only. The type of the relation translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
         "metadata": { # Metadata about a field. # Metadata about the relation.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6255,7 +6255,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "person": "A String", # The name of the other person this relation refers to.
@@ -6266,7 +6266,7 @@
       { # **DEPRECATED**: No data will be returned A person's relationship interest .
         "formattedValue": "A String", # Output only. The value of the relationship interest translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
         "metadata": { # Metadata about a field. # Metadata about the relationship interest.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6279,7 +6279,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The kind of relationship the person is looking for. The value can be custom or one of these predefined values: * `friend` * `date` * `relationship` * `networking`
@@ -6289,7 +6289,7 @@
       { # **DEPRECATED**: No data will be returned A person's relationship status.
         "formattedValue": "A String", # Output only. The value of the relationship status translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
         "metadata": { # Metadata about a field. # Metadata about the relationship status.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6302,7 +6302,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The relationship status. The value can be custom or one of these predefined values: * `single` * `inARelationship` * `engaged` * `married` * `itsComplicated` * `openRelationship` * `widowed` * `inDomesticPartnership` * `inCivilUnion`
@@ -6312,7 +6312,7 @@
       { # **DEPRECATED**: Please use `person.locations` instead. A person's past or current residence.
         "current": True or False, # True if the residence is the person's current residence; false if the residence is a past residence.
         "metadata": { # Metadata about a field. # Metadata about the residence.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6325,7 +6325,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The address of the residence.
@@ -6336,7 +6336,7 @@
       { # A person's SIP address. Session Initial Protocol addresses are used for VoIP communications to make voice or video calls over the internet.
         "formattedType": "A String", # Output only. The type of the SIP address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
         "metadata": { # Metadata about a field. # Metadata about the SIP address.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6349,7 +6349,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "type": "A String", # The type of the SIP address. The type can be custom or or one of these predefined values: * `home` * `work` * `mobile` * `other`
@@ -6359,7 +6359,7 @@
     "skills": [ # The person's skills.
       { # A skill that the person has.
         "metadata": { # Metadata about a field. # Metadata about the skill.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6372,7 +6372,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The skill; for example, `underwater basket weaving`.
@@ -6381,7 +6381,7 @@
     "taglines": [ # Output only. **DEPRECATED**: No data will be returned The person's taglines.
       { # **DEPRECATED**: No data will be returned A brief one-line description of the person.
         "metadata": { # Metadata about a field. # Metadata about the tagline.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6394,7 +6394,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The tagline.
@@ -6404,7 +6404,7 @@
       { # A person's associated URLs.
         "formattedType": "A String", # Output only. The type of the URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
         "metadata": { # Metadata about a field. # Metadata about the URL.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6417,7 +6417,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "type": "A String", # The type of the URL. The type can be custom or one of these predefined values: * `home` * `work` * `blog` * `profile` * `homePage` * `ftp` * `reservations` * `appInstallPage`: website for a Currents application. * `other`
@@ -6428,7 +6428,7 @@
       { # Arbitrary user data that is populated by the end users.
         "key": "A String", # The end user specified key of the user defined data.
         "metadata": { # Metadata about a field. # Metadata about the user defined data.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6441,7 +6441,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The end user specified value of the user defined data.
@@ -6483,7 +6483,7 @@
       "formattedType": "A String", # Output only. The type of the address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "formattedValue": "A String", # The unstructured value of the address. If this is not set by the user it will be automatically constructed from structured values.
       "metadata": { # Metadata about a field. # Metadata about the address.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6496,7 +6496,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "poBox": "A String", # The P.O. box of the address.
@@ -6511,7 +6511,7 @@
     { # A person's age range.
       "ageRange": "A String", # The age range.
       "metadata": { # Metadata about a field. # Metadata about the age range.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6524,7 +6524,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
     },
@@ -6533,7 +6533,7 @@
     { # A person's short biography.
       "contentType": "A String", # The content type of the biography.
       "metadata": { # Metadata about a field. # Metadata about the biography.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6546,7 +6546,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The short biography.
@@ -6560,7 +6560,7 @@
         "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
       },
       "metadata": { # Metadata about a field. # Metadata about the birthday.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6573,7 +6573,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "text": "A String", # A free-form string representing the user's birthday.
@@ -6582,7 +6582,7 @@
   "braggingRights": [ # **DEPRECATED**: No data will be returned The person's bragging rights.
     { # **DEPRECATED**: No data will be returned A person's bragging rights.
       "metadata": { # Metadata about a field. # Metadata about the bragging rights.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6595,7 +6595,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The bragging rights; for example, `climbed mount everest`.
@@ -6605,7 +6605,7 @@
     { # A person's calendar URL.
       "formattedType": "A String", # Output only. The type of the calendar URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the calendar URL.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6618,7 +6618,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the calendar URL. The type can be custom or one of these predefined values: * `home` * `freeBusy` * `work`
@@ -6629,7 +6629,7 @@
     { # Arbitrary client data that is populated by clients. Duplicate keys and values are allowed.
       "key": "A String", # The client specified key of the client data.
       "metadata": { # Metadata about a field. # Metadata about the client data.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6642,7 +6642,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The client specified value of the client data.
@@ -6652,7 +6652,7 @@
     { # A person's cover photo. A large image shown on the person's profile page that represents who they are or what they care about.
       "default": True or False, # True if the cover photo is the default cover photo; false if the cover photo is a user-provided cover photo.
       "metadata": { # Metadata about a field. # Metadata about the cover photo.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6665,7 +6665,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "url": "A String", # The URL of the cover photo.
@@ -6676,7 +6676,7 @@
       "displayName": "A String", # The display name of the email.
       "formattedType": "A String", # Output only. The type of the email address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the email address.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6689,7 +6689,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the email address. The type can be custom or one of these predefined values: * `home` * `work` * `other`
@@ -6706,7 +6706,7 @@
       },
       "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the event.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6719,7 +6719,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the event. The type can be custom or one of these predefined values: * `anniversary` * `other`
@@ -6729,7 +6729,7 @@
     { # An identifier from an external entity related to the person.
       "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the external ID.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6742,7 +6742,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the external ID. The type can be custom or one of these predefined values: * `account` * `customer` * `loginId` * `network` * `organization`
@@ -6752,7 +6752,7 @@
   "fileAses": [ # The person's file-ases.
     { # The name that should be used to sort the person in a list.
       "metadata": { # Metadata about a field. # Metadata about the file-as.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6765,7 +6765,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The file-as value
@@ -6776,7 +6776,7 @@
       "addressMeAs": "A String", # The type of pronouns that should be used to address the person. The value can be custom or one of these predefined values: * `male` * `female` * `other`
       "formattedValue": "A String", # Output only. The value of the gender translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale. Unspecified or custom value are not localized.
       "metadata": { # Metadata about a field. # Metadata about the gender.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6789,7 +6789,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The gender for the person. The gender can be custom or one of these predefined values: * `male` * `female` * `unspecified`
@@ -6800,7 +6800,7 @@
       "formattedProtocol": "A String", # Output only. The protocol of the IM client formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "formattedType": "A String", # Output only. The type of the IM client translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the IM client.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6813,7 +6813,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "protocol": "A String", # The protocol of the IM client. The protocol can be custom or one of these predefined values: * `aim` * `msn` * `yahoo` * `skype` * `qq` * `googleTalk` * `icq` * `jabber` * `netMeeting`
@@ -6824,7 +6824,7 @@
   "interests": [ # The person's interests.
     { # One of the person's interests.
       "metadata": { # Metadata about a field. # Metadata about the interest.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6837,7 +6837,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The interest; for example, `stargazing`.
@@ -6846,7 +6846,7 @@
   "locales": [ # The person's locale preferences.
     { # A person's locale preference.
       "metadata": { # Metadata about a field. # Metadata about the locale.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6859,7 +6859,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The well-formed [IETF BCP 47](https://tools.ietf.org/html/bcp47) language tag representing the locale.
@@ -6873,7 +6873,7 @@
       "floor": "A String", # The floor name or number.
       "floorSection": "A String", # The floor section in `floor_name`.
       "metadata": { # Metadata about a field. # Metadata about the location.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6886,7 +6886,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the location. The type can be custom or one of these predefined values: * `desk` * `grewUp`
@@ -6903,7 +6903,7 @@
         "inViewerDomain": True or False, # True if the person is in the viewer's Google Workspace domain.
       },
       "metadata": { # Metadata about a field. # Metadata about the membership.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6916,7 +6916,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
     },
@@ -6949,7 +6949,7 @@
     { # A person's miscellaneous keyword.
       "formattedType": "A String", # Output only. The type of the miscellaneous keyword translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the miscellaneous keyword.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6962,7 +6962,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The miscellaneous keyword type.
@@ -6978,7 +6978,7 @@
       "honorificPrefix": "A String", # The honorific prefixes, such as `Mrs.` or `Dr.`
       "honorificSuffix": "A String", # The honorific suffixes, such as `Jr.`
       "metadata": { # Metadata about a field. # Metadata about the name.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -6991,7 +6991,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "middleName": "A String", # The middle name(s).
@@ -7007,7 +7007,7 @@
   "nicknames": [ # The person's nicknames.
     { # A person's nickname.
       "metadata": { # Metadata about a field. # Metadata about the nickname.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7020,7 +7020,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the nickname.
@@ -7030,7 +7030,7 @@
   "occupations": [ # The person's occupations.
     { # A person's occupation.
       "metadata": { # Metadata about a field. # Metadata about the occupation.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7043,7 +7043,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The occupation; for example, `carpenter`.
@@ -7063,7 +7063,7 @@
       "jobDescription": "A String", # The person's job description at the organization.
       "location": "A String", # The location of the organization office the person works at.
       "metadata": { # Metadata about a field. # Metadata about the organization.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7076,7 +7076,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "name": "A String", # The name of the organization.
@@ -7096,7 +7096,7 @@
       "canonicalForm": "A String", # Output only. The canonicalized [ITU-T E.164](https://law.resource.org/pub/us/cfr/ibr/004/itu-t.E.164.1.2008.pdf) form of the phone number.
       "formattedType": "A String", # Output only. The type of the phone number translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the phone number.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7109,7 +7109,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the phone number. The type can be custom or one of these predefined values: * `home` * `work` * `mobile` * `homeFax` * `workFax` * `otherFax` * `pager` * `workMobile` * `workPager` * `main` * `googleVoice` * `other`
@@ -7120,7 +7120,7 @@
     { # A person's photo. A picture shown next to the person's name to help others recognize the person.
       "default": True or False, # True if the photo is a default photo; false if the photo is a user-provided photo.
       "metadata": { # Metadata about a field. # Metadata about the photo.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7133,7 +7133,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "url": "A String", # The URL of the photo. You can change the desired size by appending a query parameter `sz={size}` at the end of the url, where {size} is the size in pixels. Example: https://lh3.googleusercontent.com/-T_wVWLlmg7w/AAAAAAAAAAI/AAAAAAAABa8/00gzXvDBYqw/s100/photo.jpg?sz=50
@@ -7143,7 +7143,7 @@
     { # A person's relation to another person.
       "formattedType": "A String", # Output only. The type of the relation translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
       "metadata": { # Metadata about a field. # Metadata about the relation.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7156,7 +7156,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "person": "A String", # The name of the other person this relation refers to.
@@ -7167,7 +7167,7 @@
     { # **DEPRECATED**: No data will be returned A person's relationship interest .
       "formattedValue": "A String", # Output only. The value of the relationship interest translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
       "metadata": { # Metadata about a field. # Metadata about the relationship interest.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7180,7 +7180,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The kind of relationship the person is looking for. The value can be custom or one of these predefined values: * `friend` * `date` * `relationship` * `networking`
@@ -7190,7 +7190,7 @@
     { # **DEPRECATED**: No data will be returned A person's relationship status.
       "formattedValue": "A String", # Output only. The value of the relationship status translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the relationship status.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7203,7 +7203,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The relationship status. The value can be custom or one of these predefined values: * `single` * `inARelationship` * `engaged` * `married` * `itsComplicated` * `openRelationship` * `widowed` * `inDomesticPartnership` * `inCivilUnion`
@@ -7213,7 +7213,7 @@
     { # **DEPRECATED**: Please use `person.locations` instead. A person's past or current residence.
       "current": True or False, # True if the residence is the person's current residence; false if the residence is a past residence.
       "metadata": { # Metadata about a field. # Metadata about the residence.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7226,7 +7226,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The address of the residence.
@@ -7237,7 +7237,7 @@
     { # A person's SIP address. Session Initial Protocol addresses are used for VoIP communications to make voice or video calls over the internet.
       "formattedType": "A String", # Output only. The type of the SIP address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the SIP address.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7250,7 +7250,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the SIP address. The type can be custom or or one of these predefined values: * `home` * `work` * `mobile` * `other`
@@ -7260,7 +7260,7 @@
   "skills": [ # The person's skills.
     { # A skill that the person has.
       "metadata": { # Metadata about a field. # Metadata about the skill.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7273,7 +7273,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The skill; for example, `underwater basket weaving`.
@@ -7282,7 +7282,7 @@
   "taglines": [ # Output only. **DEPRECATED**: No data will be returned The person's taglines.
     { # **DEPRECATED**: No data will be returned A brief one-line description of the person.
       "metadata": { # Metadata about a field. # Metadata about the tagline.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7295,7 +7295,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The tagline.
@@ -7305,7 +7305,7 @@
     { # A person's associated URLs.
       "formattedType": "A String", # Output only. The type of the URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the URL.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7318,7 +7318,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the URL. The type can be custom or one of these predefined values: * `home` * `work` * `blog` * `profile` * `homePage` * `ftp` * `reservations` * `appInstallPage`: website for a Currents application. * `other`
@@ -7329,7 +7329,7 @@
     { # Arbitrary user data that is populated by the end users.
       "key": "A String", # The end user specified key of the user defined data.
       "metadata": { # Metadata about a field. # Metadata about the user defined data.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7342,7 +7342,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The end user specified value of the user defined data.
@@ -7387,7 +7387,7 @@
             "formattedType": "A String", # Output only. The type of the address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "formattedValue": "A String", # The unstructured value of the address. If this is not set by the user it will be automatically constructed from structured values.
             "metadata": { # Metadata about a field. # Metadata about the address.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7400,7 +7400,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "poBox": "A String", # The P.O. box of the address.
@@ -7415,7 +7415,7 @@
           { # A person's age range.
             "ageRange": "A String", # The age range.
             "metadata": { # Metadata about a field. # Metadata about the age range.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7428,7 +7428,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
           },
@@ -7437,7 +7437,7 @@
           { # A person's short biography.
             "contentType": "A String", # The content type of the biography.
             "metadata": { # Metadata about a field. # Metadata about the biography.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7450,7 +7450,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The short biography.
@@ -7464,7 +7464,7 @@
               "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
             },
             "metadata": { # Metadata about a field. # Metadata about the birthday.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7477,7 +7477,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "text": "A String", # A free-form string representing the user's birthday.
@@ -7486,7 +7486,7 @@
         "braggingRights": [ # **DEPRECATED**: No data will be returned The person's bragging rights.
           { # **DEPRECATED**: No data will be returned A person's bragging rights.
             "metadata": { # Metadata about a field. # Metadata about the bragging rights.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7499,7 +7499,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The bragging rights; for example, `climbed mount everest`.
@@ -7509,7 +7509,7 @@
           { # A person's calendar URL.
             "formattedType": "A String", # Output only. The type of the calendar URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the calendar URL.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7522,7 +7522,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the calendar URL. The type can be custom or one of these predefined values: * `home` * `freeBusy` * `work`
@@ -7533,7 +7533,7 @@
           { # Arbitrary client data that is populated by clients. Duplicate keys and values are allowed.
             "key": "A String", # The client specified key of the client data.
             "metadata": { # Metadata about a field. # Metadata about the client data.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7546,7 +7546,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The client specified value of the client data.
@@ -7556,7 +7556,7 @@
           { # A person's cover photo. A large image shown on the person's profile page that represents who they are or what they care about.
             "default": True or False, # True if the cover photo is the default cover photo; false if the cover photo is a user-provided cover photo.
             "metadata": { # Metadata about a field. # Metadata about the cover photo.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7569,7 +7569,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "url": "A String", # The URL of the cover photo.
@@ -7580,7 +7580,7 @@
             "displayName": "A String", # The display name of the email.
             "formattedType": "A String", # Output only. The type of the email address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the email address.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7593,7 +7593,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the email address. The type can be custom or one of these predefined values: * `home` * `work` * `other`
@@ -7610,7 +7610,7 @@
             },
             "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the event.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7623,7 +7623,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the event. The type can be custom or one of these predefined values: * `anniversary` * `other`
@@ -7633,7 +7633,7 @@
           { # An identifier from an external entity related to the person.
             "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the external ID.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7646,7 +7646,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the external ID. The type can be custom or one of these predefined values: * `account` * `customer` * `loginId` * `network` * `organization`
@@ -7656,7 +7656,7 @@
         "fileAses": [ # The person's file-ases.
           { # The name that should be used to sort the person in a list.
             "metadata": { # Metadata about a field. # Metadata about the file-as.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7669,7 +7669,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The file-as value
@@ -7680,7 +7680,7 @@
             "addressMeAs": "A String", # The type of pronouns that should be used to address the person. The value can be custom or one of these predefined values: * `male` * `female` * `other`
             "formattedValue": "A String", # Output only. The value of the gender translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale. Unspecified or custom value are not localized.
             "metadata": { # Metadata about a field. # Metadata about the gender.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7693,7 +7693,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The gender for the person. The gender can be custom or one of these predefined values: * `male` * `female` * `unspecified`
@@ -7704,7 +7704,7 @@
             "formattedProtocol": "A String", # Output only. The protocol of the IM client formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "formattedType": "A String", # Output only. The type of the IM client translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the IM client.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7717,7 +7717,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "protocol": "A String", # The protocol of the IM client. The protocol can be custom or one of these predefined values: * `aim` * `msn` * `yahoo` * `skype` * `qq` * `googleTalk` * `icq` * `jabber` * `netMeeting`
@@ -7728,7 +7728,7 @@
         "interests": [ # The person's interests.
           { # One of the person's interests.
             "metadata": { # Metadata about a field. # Metadata about the interest.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7741,7 +7741,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The interest; for example, `stargazing`.
@@ -7750,7 +7750,7 @@
         "locales": [ # The person's locale preferences.
           { # A person's locale preference.
             "metadata": { # Metadata about a field. # Metadata about the locale.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7763,7 +7763,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The well-formed [IETF BCP 47](https://tools.ietf.org/html/bcp47) language tag representing the locale.
@@ -7777,7 +7777,7 @@
             "floor": "A String", # The floor name or number.
             "floorSection": "A String", # The floor section in `floor_name`.
             "metadata": { # Metadata about a field. # Metadata about the location.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7790,7 +7790,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the location. The type can be custom or one of these predefined values: * `desk` * `grewUp`
@@ -7807,7 +7807,7 @@
               "inViewerDomain": True or False, # True if the person is in the viewer's Google Workspace domain.
             },
             "metadata": { # Metadata about a field. # Metadata about the membership.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7820,7 +7820,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
           },
@@ -7853,7 +7853,7 @@
           { # A person's miscellaneous keyword.
             "formattedType": "A String", # Output only. The type of the miscellaneous keyword translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the miscellaneous keyword.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7866,7 +7866,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The miscellaneous keyword type.
@@ -7882,7 +7882,7 @@
             "honorificPrefix": "A String", # The honorific prefixes, such as `Mrs.` or `Dr.`
             "honorificSuffix": "A String", # The honorific suffixes, such as `Jr.`
             "metadata": { # Metadata about a field. # Metadata about the name.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7895,7 +7895,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "middleName": "A String", # The middle name(s).
@@ -7911,7 +7911,7 @@
         "nicknames": [ # The person's nicknames.
           { # A person's nickname.
             "metadata": { # Metadata about a field. # Metadata about the nickname.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7924,7 +7924,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the nickname.
@@ -7934,7 +7934,7 @@
         "occupations": [ # The person's occupations.
           { # A person's occupation.
             "metadata": { # Metadata about a field. # Metadata about the occupation.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7947,7 +7947,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The occupation; for example, `carpenter`.
@@ -7967,7 +7967,7 @@
             "jobDescription": "A String", # The person's job description at the organization.
             "location": "A String", # The location of the organization office the person works at.
             "metadata": { # Metadata about a field. # Metadata about the organization.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -7980,7 +7980,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "name": "A String", # The name of the organization.
@@ -8000,7 +8000,7 @@
             "canonicalForm": "A String", # Output only. The canonicalized [ITU-T E.164](https://law.resource.org/pub/us/cfr/ibr/004/itu-t.E.164.1.2008.pdf) form of the phone number.
             "formattedType": "A String", # Output only. The type of the phone number translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the phone number.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8013,7 +8013,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the phone number. The type can be custom or one of these predefined values: * `home` * `work` * `mobile` * `homeFax` * `workFax` * `otherFax` * `pager` * `workMobile` * `workPager` * `main` * `googleVoice` * `other`
@@ -8024,7 +8024,7 @@
           { # A person's photo. A picture shown next to the person's name to help others recognize the person.
             "default": True or False, # True if the photo is a default photo; false if the photo is a user-provided photo.
             "metadata": { # Metadata about a field. # Metadata about the photo.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8037,7 +8037,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "url": "A String", # The URL of the photo. You can change the desired size by appending a query parameter `sz={size}` at the end of the url, where {size} is the size in pixels. Example: https://lh3.googleusercontent.com/-T_wVWLlmg7w/AAAAAAAAAAI/AAAAAAAABa8/00gzXvDBYqw/s100/photo.jpg?sz=50
@@ -8047,7 +8047,7 @@
           { # A person's relation to another person.
             "formattedType": "A String", # Output only. The type of the relation translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
             "metadata": { # Metadata about a field. # Metadata about the relation.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8060,7 +8060,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "person": "A String", # The name of the other person this relation refers to.
@@ -8071,7 +8071,7 @@
           { # **DEPRECATED**: No data will be returned A person's relationship interest .
             "formattedValue": "A String", # Output only. The value of the relationship interest translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
             "metadata": { # Metadata about a field. # Metadata about the relationship interest.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8084,7 +8084,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The kind of relationship the person is looking for. The value can be custom or one of these predefined values: * `friend` * `date` * `relationship` * `networking`
@@ -8094,7 +8094,7 @@
           { # **DEPRECATED**: No data will be returned A person's relationship status.
             "formattedValue": "A String", # Output only. The value of the relationship status translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the relationship status.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8107,7 +8107,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The relationship status. The value can be custom or one of these predefined values: * `single` * `inARelationship` * `engaged` * `married` * `itsComplicated` * `openRelationship` * `widowed` * `inDomesticPartnership` * `inCivilUnion`
@@ -8117,7 +8117,7 @@
           { # **DEPRECATED**: Please use `person.locations` instead. A person's past or current residence.
             "current": True or False, # True if the residence is the person's current residence; false if the residence is a past residence.
             "metadata": { # Metadata about a field. # Metadata about the residence.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8130,7 +8130,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The address of the residence.
@@ -8141,7 +8141,7 @@
           { # A person's SIP address. Session Initial Protocol addresses are used for VoIP communications to make voice or video calls over the internet.
             "formattedType": "A String", # Output only. The type of the SIP address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the SIP address.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8154,7 +8154,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the SIP address. The type can be custom or or one of these predefined values: * `home` * `work` * `mobile` * `other`
@@ -8164,7 +8164,7 @@
         "skills": [ # The person's skills.
           { # A skill that the person has.
             "metadata": { # Metadata about a field. # Metadata about the skill.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8177,7 +8177,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The skill; for example, `underwater basket weaving`.
@@ -8186,7 +8186,7 @@
         "taglines": [ # Output only. **DEPRECATED**: No data will be returned The person's taglines.
           { # **DEPRECATED**: No data will be returned A brief one-line description of the person.
             "metadata": { # Metadata about a field. # Metadata about the tagline.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8199,7 +8199,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The tagline.
@@ -8209,7 +8209,7 @@
           { # A person's associated URLs.
             "formattedType": "A String", # Output only. The type of the URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the URL.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8222,7 +8222,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the URL. The type can be custom or one of these predefined values: * `home` * `work` * `blog` * `profile` * `homePage` * `ftp` * `reservations` * `appInstallPage`: website for a Currents application. * `other`
@@ -8233,7 +8233,7 @@
           { # Arbitrary user data that is populated by the end users.
             "key": "A String", # The end user specified key of the user defined data.
             "metadata": { # Metadata about a field. # Metadata about the user defined data.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8246,7 +8246,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The end user specified value of the user defined data.
@@ -8309,7 +8309,7 @@
           "formattedType": "A String", # Output only. The type of the address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "formattedValue": "A String", # The unstructured value of the address. If this is not set by the user it will be automatically constructed from structured values.
           "metadata": { # Metadata about a field. # Metadata about the address.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8322,7 +8322,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "poBox": "A String", # The P.O. box of the address.
@@ -8337,7 +8337,7 @@
         { # A person's age range.
           "ageRange": "A String", # The age range.
           "metadata": { # Metadata about a field. # Metadata about the age range.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8350,7 +8350,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
         },
@@ -8359,7 +8359,7 @@
         { # A person's short biography.
           "contentType": "A String", # The content type of the biography.
           "metadata": { # Metadata about a field. # Metadata about the biography.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8372,7 +8372,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The short biography.
@@ -8386,7 +8386,7 @@
             "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
           },
           "metadata": { # Metadata about a field. # Metadata about the birthday.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8399,7 +8399,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "text": "A String", # A free-form string representing the user's birthday.
@@ -8408,7 +8408,7 @@
       "braggingRights": [ # **DEPRECATED**: No data will be returned The person's bragging rights.
         { # **DEPRECATED**: No data will be returned A person's bragging rights.
           "metadata": { # Metadata about a field. # Metadata about the bragging rights.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8421,7 +8421,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The bragging rights; for example, `climbed mount everest`.
@@ -8431,7 +8431,7 @@
         { # A person's calendar URL.
           "formattedType": "A String", # Output only. The type of the calendar URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the calendar URL.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8444,7 +8444,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the calendar URL. The type can be custom or one of these predefined values: * `home` * `freeBusy` * `work`
@@ -8455,7 +8455,7 @@
         { # Arbitrary client data that is populated by clients. Duplicate keys and values are allowed.
           "key": "A String", # The client specified key of the client data.
           "metadata": { # Metadata about a field. # Metadata about the client data.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8468,7 +8468,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The client specified value of the client data.
@@ -8478,7 +8478,7 @@
         { # A person's cover photo. A large image shown on the person's profile page that represents who they are or what they care about.
           "default": True or False, # True if the cover photo is the default cover photo; false if the cover photo is a user-provided cover photo.
           "metadata": { # Metadata about a field. # Metadata about the cover photo.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8491,7 +8491,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "url": "A String", # The URL of the cover photo.
@@ -8502,7 +8502,7 @@
           "displayName": "A String", # The display name of the email.
           "formattedType": "A String", # Output only. The type of the email address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the email address.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8515,7 +8515,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the email address. The type can be custom or one of these predefined values: * `home` * `work` * `other`
@@ -8532,7 +8532,7 @@
           },
           "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the event.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8545,7 +8545,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the event. The type can be custom or one of these predefined values: * `anniversary` * `other`
@@ -8555,7 +8555,7 @@
         { # An identifier from an external entity related to the person.
           "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the external ID.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8568,7 +8568,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the external ID. The type can be custom or one of these predefined values: * `account` * `customer` * `loginId` * `network` * `organization`
@@ -8578,7 +8578,7 @@
       "fileAses": [ # The person's file-ases.
         { # The name that should be used to sort the person in a list.
           "metadata": { # Metadata about a field. # Metadata about the file-as.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8591,7 +8591,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The file-as value
@@ -8602,7 +8602,7 @@
           "addressMeAs": "A String", # The type of pronouns that should be used to address the person. The value can be custom or one of these predefined values: * `male` * `female` * `other`
           "formattedValue": "A String", # Output only. The value of the gender translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale. Unspecified or custom value are not localized.
           "metadata": { # Metadata about a field. # Metadata about the gender.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8615,7 +8615,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The gender for the person. The gender can be custom or one of these predefined values: * `male` * `female` * `unspecified`
@@ -8626,7 +8626,7 @@
           "formattedProtocol": "A String", # Output only. The protocol of the IM client formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "formattedType": "A String", # Output only. The type of the IM client translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the IM client.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8639,7 +8639,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "protocol": "A String", # The protocol of the IM client. The protocol can be custom or one of these predefined values: * `aim` * `msn` * `yahoo` * `skype` * `qq` * `googleTalk` * `icq` * `jabber` * `netMeeting`
@@ -8650,7 +8650,7 @@
       "interests": [ # The person's interests.
         { # One of the person's interests.
           "metadata": { # Metadata about a field. # Metadata about the interest.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8663,7 +8663,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The interest; for example, `stargazing`.
@@ -8672,7 +8672,7 @@
       "locales": [ # The person's locale preferences.
         { # A person's locale preference.
           "metadata": { # Metadata about a field. # Metadata about the locale.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8685,7 +8685,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The well-formed [IETF BCP 47](https://tools.ietf.org/html/bcp47) language tag representing the locale.
@@ -8699,7 +8699,7 @@
           "floor": "A String", # The floor name or number.
           "floorSection": "A String", # The floor section in `floor_name`.
           "metadata": { # Metadata about a field. # Metadata about the location.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8712,7 +8712,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the location. The type can be custom or one of these predefined values: * `desk` * `grewUp`
@@ -8729,7 +8729,7 @@
             "inViewerDomain": True or False, # True if the person is in the viewer's Google Workspace domain.
           },
           "metadata": { # Metadata about a field. # Metadata about the membership.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8742,7 +8742,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
         },
@@ -8775,7 +8775,7 @@
         { # A person's miscellaneous keyword.
           "formattedType": "A String", # Output only. The type of the miscellaneous keyword translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the miscellaneous keyword.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8788,7 +8788,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The miscellaneous keyword type.
@@ -8804,7 +8804,7 @@
           "honorificPrefix": "A String", # The honorific prefixes, such as `Mrs.` or `Dr.`
           "honorificSuffix": "A String", # The honorific suffixes, such as `Jr.`
           "metadata": { # Metadata about a field. # Metadata about the name.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8817,7 +8817,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "middleName": "A String", # The middle name(s).
@@ -8833,7 +8833,7 @@
       "nicknames": [ # The person's nicknames.
         { # A person's nickname.
           "metadata": { # Metadata about a field. # Metadata about the nickname.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8846,7 +8846,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the nickname.
@@ -8856,7 +8856,7 @@
       "occupations": [ # The person's occupations.
         { # A person's occupation.
           "metadata": { # Metadata about a field. # Metadata about the occupation.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8869,7 +8869,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The occupation; for example, `carpenter`.
@@ -8889,7 +8889,7 @@
           "jobDescription": "A String", # The person's job description at the organization.
           "location": "A String", # The location of the organization office the person works at.
           "metadata": { # Metadata about a field. # Metadata about the organization.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8902,7 +8902,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "name": "A String", # The name of the organization.
@@ -8922,7 +8922,7 @@
           "canonicalForm": "A String", # Output only. The canonicalized [ITU-T E.164](https://law.resource.org/pub/us/cfr/ibr/004/itu-t.E.164.1.2008.pdf) form of the phone number.
           "formattedType": "A String", # Output only. The type of the phone number translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the phone number.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8935,7 +8935,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the phone number. The type can be custom or one of these predefined values: * `home` * `work` * `mobile` * `homeFax` * `workFax` * `otherFax` * `pager` * `workMobile` * `workPager` * `main` * `googleVoice` * `other`
@@ -8946,7 +8946,7 @@
         { # A person's photo. A picture shown next to the person's name to help others recognize the person.
           "default": True or False, # True if the photo is a default photo; false if the photo is a user-provided photo.
           "metadata": { # Metadata about a field. # Metadata about the photo.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8959,7 +8959,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "url": "A String", # The URL of the photo. You can change the desired size by appending a query parameter `sz={size}` at the end of the url, where {size} is the size in pixels. Example: https://lh3.googleusercontent.com/-T_wVWLlmg7w/AAAAAAAAAAI/AAAAAAAABa8/00gzXvDBYqw/s100/photo.jpg?sz=50
@@ -8969,7 +8969,7 @@
         { # A person's relation to another person.
           "formattedType": "A String", # Output only. The type of the relation translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
           "metadata": { # Metadata about a field. # Metadata about the relation.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -8982,7 +8982,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "person": "A String", # The name of the other person this relation refers to.
@@ -8993,7 +8993,7 @@
         { # **DEPRECATED**: No data will be returned A person's relationship interest .
           "formattedValue": "A String", # Output only. The value of the relationship interest translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
           "metadata": { # Metadata about a field. # Metadata about the relationship interest.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9006,7 +9006,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The kind of relationship the person is looking for. The value can be custom or one of these predefined values: * `friend` * `date` * `relationship` * `networking`
@@ -9016,7 +9016,7 @@
         { # **DEPRECATED**: No data will be returned A person's relationship status.
           "formattedValue": "A String", # Output only. The value of the relationship status translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the relationship status.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9029,7 +9029,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The relationship status. The value can be custom or one of these predefined values: * `single` * `inARelationship` * `engaged` * `married` * `itsComplicated` * `openRelationship` * `widowed` * `inDomesticPartnership` * `inCivilUnion`
@@ -9039,7 +9039,7 @@
         { # **DEPRECATED**: Please use `person.locations` instead. A person's past or current residence.
           "current": True or False, # True if the residence is the person's current residence; false if the residence is a past residence.
           "metadata": { # Metadata about a field. # Metadata about the residence.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9052,7 +9052,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The address of the residence.
@@ -9063,7 +9063,7 @@
         { # A person's SIP address. Session Initial Protocol addresses are used for VoIP communications to make voice or video calls over the internet.
           "formattedType": "A String", # Output only. The type of the SIP address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the SIP address.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9076,7 +9076,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the SIP address. The type can be custom or or one of these predefined values: * `home` * `work` * `mobile` * `other`
@@ -9086,7 +9086,7 @@
       "skills": [ # The person's skills.
         { # A skill that the person has.
           "metadata": { # Metadata about a field. # Metadata about the skill.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9099,7 +9099,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The skill; for example, `underwater basket weaving`.
@@ -9108,7 +9108,7 @@
       "taglines": [ # Output only. **DEPRECATED**: No data will be returned The person's taglines.
         { # **DEPRECATED**: No data will be returned A brief one-line description of the person.
           "metadata": { # Metadata about a field. # Metadata about the tagline.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9121,7 +9121,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The tagline.
@@ -9131,7 +9131,7 @@
         { # A person's associated URLs.
           "formattedType": "A String", # Output only. The type of the URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the URL.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9144,7 +9144,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the URL. The type can be custom or one of these predefined values: * `home` * `work` * `blog` * `profile` * `homePage` * `ftp` * `reservations` * `appInstallPage`: website for a Currents application. * `other`
@@ -9155,7 +9155,7 @@
         { # Arbitrary user data that is populated by the end users.
           "key": "A String", # The end user specified key of the user defined data.
           "metadata": { # Metadata about a field. # Metadata about the user defined data.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9168,7 +9168,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The end user specified value of the user defined data.
@@ -9228,7 +9228,7 @@
             "formattedType": "A String", # Output only. The type of the address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "formattedValue": "A String", # The unstructured value of the address. If this is not set by the user it will be automatically constructed from structured values.
             "metadata": { # Metadata about a field. # Metadata about the address.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9241,7 +9241,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "poBox": "A String", # The P.O. box of the address.
@@ -9256,7 +9256,7 @@
           { # A person's age range.
             "ageRange": "A String", # The age range.
             "metadata": { # Metadata about a field. # Metadata about the age range.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9269,7 +9269,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
           },
@@ -9278,7 +9278,7 @@
           { # A person's short biography.
             "contentType": "A String", # The content type of the biography.
             "metadata": { # Metadata about a field. # Metadata about the biography.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9291,7 +9291,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The short biography.
@@ -9305,7 +9305,7 @@
               "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
             },
             "metadata": { # Metadata about a field. # Metadata about the birthday.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9318,7 +9318,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "text": "A String", # A free-form string representing the user's birthday.
@@ -9327,7 +9327,7 @@
         "braggingRights": [ # **DEPRECATED**: No data will be returned The person's bragging rights.
           { # **DEPRECATED**: No data will be returned A person's bragging rights.
             "metadata": { # Metadata about a field. # Metadata about the bragging rights.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9340,7 +9340,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The bragging rights; for example, `climbed mount everest`.
@@ -9350,7 +9350,7 @@
           { # A person's calendar URL.
             "formattedType": "A String", # Output only. The type of the calendar URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the calendar URL.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9363,7 +9363,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the calendar URL. The type can be custom or one of these predefined values: * `home` * `freeBusy` * `work`
@@ -9374,7 +9374,7 @@
           { # Arbitrary client data that is populated by clients. Duplicate keys and values are allowed.
             "key": "A String", # The client specified key of the client data.
             "metadata": { # Metadata about a field. # Metadata about the client data.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9387,7 +9387,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The client specified value of the client data.
@@ -9397,7 +9397,7 @@
           { # A person's cover photo. A large image shown on the person's profile page that represents who they are or what they care about.
             "default": True or False, # True if the cover photo is the default cover photo; false if the cover photo is a user-provided cover photo.
             "metadata": { # Metadata about a field. # Metadata about the cover photo.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9410,7 +9410,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "url": "A String", # The URL of the cover photo.
@@ -9421,7 +9421,7 @@
             "displayName": "A String", # The display name of the email.
             "formattedType": "A String", # Output only. The type of the email address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the email address.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9434,7 +9434,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the email address. The type can be custom or one of these predefined values: * `home` * `work` * `other`
@@ -9451,7 +9451,7 @@
             },
             "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the event.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9464,7 +9464,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the event. The type can be custom or one of these predefined values: * `anniversary` * `other`
@@ -9474,7 +9474,7 @@
           { # An identifier from an external entity related to the person.
             "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the external ID.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9487,7 +9487,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the external ID. The type can be custom or one of these predefined values: * `account` * `customer` * `loginId` * `network` * `organization`
@@ -9497,7 +9497,7 @@
         "fileAses": [ # The person's file-ases.
           { # The name that should be used to sort the person in a list.
             "metadata": { # Metadata about a field. # Metadata about the file-as.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9510,7 +9510,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The file-as value
@@ -9521,7 +9521,7 @@
             "addressMeAs": "A String", # The type of pronouns that should be used to address the person. The value can be custom or one of these predefined values: * `male` * `female` * `other`
             "formattedValue": "A String", # Output only. The value of the gender translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale. Unspecified or custom value are not localized.
             "metadata": { # Metadata about a field. # Metadata about the gender.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9534,7 +9534,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The gender for the person. The gender can be custom or one of these predefined values: * `male` * `female` * `unspecified`
@@ -9545,7 +9545,7 @@
             "formattedProtocol": "A String", # Output only. The protocol of the IM client formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "formattedType": "A String", # Output only. The type of the IM client translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the IM client.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9558,7 +9558,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "protocol": "A String", # The protocol of the IM client. The protocol can be custom or one of these predefined values: * `aim` * `msn` * `yahoo` * `skype` * `qq` * `googleTalk` * `icq` * `jabber` * `netMeeting`
@@ -9569,7 +9569,7 @@
         "interests": [ # The person's interests.
           { # One of the person's interests.
             "metadata": { # Metadata about a field. # Metadata about the interest.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9582,7 +9582,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The interest; for example, `stargazing`.
@@ -9591,7 +9591,7 @@
         "locales": [ # The person's locale preferences.
           { # A person's locale preference.
             "metadata": { # Metadata about a field. # Metadata about the locale.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9604,7 +9604,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The well-formed [IETF BCP 47](https://tools.ietf.org/html/bcp47) language tag representing the locale.
@@ -9618,7 +9618,7 @@
             "floor": "A String", # The floor name or number.
             "floorSection": "A String", # The floor section in `floor_name`.
             "metadata": { # Metadata about a field. # Metadata about the location.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9631,7 +9631,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the location. The type can be custom or one of these predefined values: * `desk` * `grewUp`
@@ -9648,7 +9648,7 @@
               "inViewerDomain": True or False, # True if the person is in the viewer's Google Workspace domain.
             },
             "metadata": { # Metadata about a field. # Metadata about the membership.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9661,7 +9661,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
           },
@@ -9694,7 +9694,7 @@
           { # A person's miscellaneous keyword.
             "formattedType": "A String", # Output only. The type of the miscellaneous keyword translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the miscellaneous keyword.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9707,7 +9707,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The miscellaneous keyword type.
@@ -9723,7 +9723,7 @@
             "honorificPrefix": "A String", # The honorific prefixes, such as `Mrs.` or `Dr.`
             "honorificSuffix": "A String", # The honorific suffixes, such as `Jr.`
             "metadata": { # Metadata about a field. # Metadata about the name.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9736,7 +9736,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "middleName": "A String", # The middle name(s).
@@ -9752,7 +9752,7 @@
         "nicknames": [ # The person's nicknames.
           { # A person's nickname.
             "metadata": { # Metadata about a field. # Metadata about the nickname.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9765,7 +9765,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the nickname.
@@ -9775,7 +9775,7 @@
         "occupations": [ # The person's occupations.
           { # A person's occupation.
             "metadata": { # Metadata about a field. # Metadata about the occupation.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9788,7 +9788,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The occupation; for example, `carpenter`.
@@ -9808,7 +9808,7 @@
             "jobDescription": "A String", # The person's job description at the organization.
             "location": "A String", # The location of the organization office the person works at.
             "metadata": { # Metadata about a field. # Metadata about the organization.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9821,7 +9821,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "name": "A String", # The name of the organization.
@@ -9841,7 +9841,7 @@
             "canonicalForm": "A String", # Output only. The canonicalized [ITU-T E.164](https://law.resource.org/pub/us/cfr/ibr/004/itu-t.E.164.1.2008.pdf) form of the phone number.
             "formattedType": "A String", # Output only. The type of the phone number translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the phone number.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9854,7 +9854,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the phone number. The type can be custom or one of these predefined values: * `home` * `work` * `mobile` * `homeFax` * `workFax` * `otherFax` * `pager` * `workMobile` * `workPager` * `main` * `googleVoice` * `other`
@@ -9865,7 +9865,7 @@
           { # A person's photo. A picture shown next to the person's name to help others recognize the person.
             "default": True or False, # True if the photo is a default photo; false if the photo is a user-provided photo.
             "metadata": { # Metadata about a field. # Metadata about the photo.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9878,7 +9878,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "url": "A String", # The URL of the photo. You can change the desired size by appending a query parameter `sz={size}` at the end of the url, where {size} is the size in pixels. Example: https://lh3.googleusercontent.com/-T_wVWLlmg7w/AAAAAAAAAAI/AAAAAAAABa8/00gzXvDBYqw/s100/photo.jpg?sz=50
@@ -9888,7 +9888,7 @@
           { # A person's relation to another person.
             "formattedType": "A String", # Output only. The type of the relation translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
             "metadata": { # Metadata about a field. # Metadata about the relation.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9901,7 +9901,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "person": "A String", # The name of the other person this relation refers to.
@@ -9912,7 +9912,7 @@
           { # **DEPRECATED**: No data will be returned A person's relationship interest .
             "formattedValue": "A String", # Output only. The value of the relationship interest translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
             "metadata": { # Metadata about a field. # Metadata about the relationship interest.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9925,7 +9925,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The kind of relationship the person is looking for. The value can be custom or one of these predefined values: * `friend` * `date` * `relationship` * `networking`
@@ -9935,7 +9935,7 @@
           { # **DEPRECATED**: No data will be returned A person's relationship status.
             "formattedValue": "A String", # Output only. The value of the relationship status translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the relationship status.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9948,7 +9948,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The relationship status. The value can be custom or one of these predefined values: * `single` * `inARelationship` * `engaged` * `married` * `itsComplicated` * `openRelationship` * `widowed` * `inDomesticPartnership` * `inCivilUnion`
@@ -9958,7 +9958,7 @@
           { # **DEPRECATED**: Please use `person.locations` instead. A person's past or current residence.
             "current": True or False, # True if the residence is the person's current residence; false if the residence is a past residence.
             "metadata": { # Metadata about a field. # Metadata about the residence.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9971,7 +9971,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The address of the residence.
@@ -9982,7 +9982,7 @@
           { # A person's SIP address. Session Initial Protocol addresses are used for VoIP communications to make voice or video calls over the internet.
             "formattedType": "A String", # Output only. The type of the SIP address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the SIP address.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -9995,7 +9995,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the SIP address. The type can be custom or or one of these predefined values: * `home` * `work` * `mobile` * `other`
@@ -10005,7 +10005,7 @@
         "skills": [ # The person's skills.
           { # A skill that the person has.
             "metadata": { # Metadata about a field. # Metadata about the skill.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10018,7 +10018,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The skill; for example, `underwater basket weaving`.
@@ -10027,7 +10027,7 @@
         "taglines": [ # Output only. **DEPRECATED**: No data will be returned The person's taglines.
           { # **DEPRECATED**: No data will be returned A brief one-line description of the person.
             "metadata": { # Metadata about a field. # Metadata about the tagline.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10040,7 +10040,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The tagline.
@@ -10050,7 +10050,7 @@
           { # A person's associated URLs.
             "formattedType": "A String", # Output only. The type of the URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
             "metadata": { # Metadata about a field. # Metadata about the URL.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10063,7 +10063,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "type": "A String", # The type of the URL. The type can be custom or one of these predefined values: * `home` * `work` * `blog` * `profile` * `homePage` * `ftp` * `reservations` * `appInstallPage`: website for a Currents application. * `other`
@@ -10074,7 +10074,7 @@
           { # Arbitrary user data that is populated by the end users.
             "key": "A String", # The end user specified key of the user defined data.
             "metadata": { # Metadata about a field. # Metadata about the user defined data.
-              "primary": True or False, # True if the field is the primary field for the person.
+              "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
               "source": { # The source of a field. # The source of the field.
                 "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
                 "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10087,7 +10087,7 @@
                 "type": "A String", # The source type.
                 "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
               },
-              "sourcePrimary": True or False, # True if the field is the primary field for the source.
+              "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
               "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
             },
             "value": "A String", # The end user specified value of the user defined data.
@@ -10138,7 +10138,7 @@
           "formattedType": "A String", # Output only. The type of the address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "formattedValue": "A String", # The unstructured value of the address. If this is not set by the user it will be automatically constructed from structured values.
           "metadata": { # Metadata about a field. # Metadata about the address.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10151,7 +10151,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "poBox": "A String", # The P.O. box of the address.
@@ -10166,7 +10166,7 @@
         { # A person's age range.
           "ageRange": "A String", # The age range.
           "metadata": { # Metadata about a field. # Metadata about the age range.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10179,7 +10179,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
         },
@@ -10188,7 +10188,7 @@
         { # A person's short biography.
           "contentType": "A String", # The content type of the biography.
           "metadata": { # Metadata about a field. # Metadata about the biography.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10201,7 +10201,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The short biography.
@@ -10215,7 +10215,7 @@
             "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
           },
           "metadata": { # Metadata about a field. # Metadata about the birthday.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10228,7 +10228,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "text": "A String", # A free-form string representing the user's birthday.
@@ -10237,7 +10237,7 @@
       "braggingRights": [ # **DEPRECATED**: No data will be returned The person's bragging rights.
         { # **DEPRECATED**: No data will be returned A person's bragging rights.
           "metadata": { # Metadata about a field. # Metadata about the bragging rights.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10250,7 +10250,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The bragging rights; for example, `climbed mount everest`.
@@ -10260,7 +10260,7 @@
         { # A person's calendar URL.
           "formattedType": "A String", # Output only. The type of the calendar URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the calendar URL.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10273,7 +10273,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the calendar URL. The type can be custom or one of these predefined values: * `home` * `freeBusy` * `work`
@@ -10284,7 +10284,7 @@
         { # Arbitrary client data that is populated by clients. Duplicate keys and values are allowed.
           "key": "A String", # The client specified key of the client data.
           "metadata": { # Metadata about a field. # Metadata about the client data.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10297,7 +10297,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The client specified value of the client data.
@@ -10307,7 +10307,7 @@
         { # A person's cover photo. A large image shown on the person's profile page that represents who they are or what they care about.
           "default": True or False, # True if the cover photo is the default cover photo; false if the cover photo is a user-provided cover photo.
           "metadata": { # Metadata about a field. # Metadata about the cover photo.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10320,7 +10320,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "url": "A String", # The URL of the cover photo.
@@ -10331,7 +10331,7 @@
           "displayName": "A String", # The display name of the email.
           "formattedType": "A String", # Output only. The type of the email address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the email address.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10344,7 +10344,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the email address. The type can be custom or one of these predefined values: * `home` * `work` * `other`
@@ -10361,7 +10361,7 @@
           },
           "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the event.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10374,7 +10374,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the event. The type can be custom or one of these predefined values: * `anniversary` * `other`
@@ -10384,7 +10384,7 @@
         { # An identifier from an external entity related to the person.
           "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the external ID.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10397,7 +10397,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the external ID. The type can be custom or one of these predefined values: * `account` * `customer` * `loginId` * `network` * `organization`
@@ -10407,7 +10407,7 @@
       "fileAses": [ # The person's file-ases.
         { # The name that should be used to sort the person in a list.
           "metadata": { # Metadata about a field. # Metadata about the file-as.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10420,7 +10420,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The file-as value
@@ -10431,7 +10431,7 @@
           "addressMeAs": "A String", # The type of pronouns that should be used to address the person. The value can be custom or one of these predefined values: * `male` * `female` * `other`
           "formattedValue": "A String", # Output only. The value of the gender translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale. Unspecified or custom value are not localized.
           "metadata": { # Metadata about a field. # Metadata about the gender.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10444,7 +10444,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The gender for the person. The gender can be custom or one of these predefined values: * `male` * `female` * `unspecified`
@@ -10455,7 +10455,7 @@
           "formattedProtocol": "A String", # Output only. The protocol of the IM client formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "formattedType": "A String", # Output only. The type of the IM client translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the IM client.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10468,7 +10468,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "protocol": "A String", # The protocol of the IM client. The protocol can be custom or one of these predefined values: * `aim` * `msn` * `yahoo` * `skype` * `qq` * `googleTalk` * `icq` * `jabber` * `netMeeting`
@@ -10479,7 +10479,7 @@
       "interests": [ # The person's interests.
         { # One of the person's interests.
           "metadata": { # Metadata about a field. # Metadata about the interest.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10492,7 +10492,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The interest; for example, `stargazing`.
@@ -10501,7 +10501,7 @@
       "locales": [ # The person's locale preferences.
         { # A person's locale preference.
           "metadata": { # Metadata about a field. # Metadata about the locale.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10514,7 +10514,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The well-formed [IETF BCP 47](https://tools.ietf.org/html/bcp47) language tag representing the locale.
@@ -10528,7 +10528,7 @@
           "floor": "A String", # The floor name or number.
           "floorSection": "A String", # The floor section in `floor_name`.
           "metadata": { # Metadata about a field. # Metadata about the location.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10541,7 +10541,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the location. The type can be custom or one of these predefined values: * `desk` * `grewUp`
@@ -10558,7 +10558,7 @@
             "inViewerDomain": True or False, # True if the person is in the viewer's Google Workspace domain.
           },
           "metadata": { # Metadata about a field. # Metadata about the membership.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10571,7 +10571,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
         },
@@ -10604,7 +10604,7 @@
         { # A person's miscellaneous keyword.
           "formattedType": "A String", # Output only. The type of the miscellaneous keyword translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the miscellaneous keyword.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10617,7 +10617,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The miscellaneous keyword type.
@@ -10633,7 +10633,7 @@
           "honorificPrefix": "A String", # The honorific prefixes, such as `Mrs.` or `Dr.`
           "honorificSuffix": "A String", # The honorific suffixes, such as `Jr.`
           "metadata": { # Metadata about a field. # Metadata about the name.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10646,7 +10646,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "middleName": "A String", # The middle name(s).
@@ -10662,7 +10662,7 @@
       "nicknames": [ # The person's nicknames.
         { # A person's nickname.
           "metadata": { # Metadata about a field. # Metadata about the nickname.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10675,7 +10675,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the nickname.
@@ -10685,7 +10685,7 @@
       "occupations": [ # The person's occupations.
         { # A person's occupation.
           "metadata": { # Metadata about a field. # Metadata about the occupation.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10698,7 +10698,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The occupation; for example, `carpenter`.
@@ -10718,7 +10718,7 @@
           "jobDescription": "A String", # The person's job description at the organization.
           "location": "A String", # The location of the organization office the person works at.
           "metadata": { # Metadata about a field. # Metadata about the organization.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10731,7 +10731,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "name": "A String", # The name of the organization.
@@ -10751,7 +10751,7 @@
           "canonicalForm": "A String", # Output only. The canonicalized [ITU-T E.164](https://law.resource.org/pub/us/cfr/ibr/004/itu-t.E.164.1.2008.pdf) form of the phone number.
           "formattedType": "A String", # Output only. The type of the phone number translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the phone number.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10764,7 +10764,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the phone number. The type can be custom or one of these predefined values: * `home` * `work` * `mobile` * `homeFax` * `workFax` * `otherFax` * `pager` * `workMobile` * `workPager` * `main` * `googleVoice` * `other`
@@ -10775,7 +10775,7 @@
         { # A person's photo. A picture shown next to the person's name to help others recognize the person.
           "default": True or False, # True if the photo is a default photo; false if the photo is a user-provided photo.
           "metadata": { # Metadata about a field. # Metadata about the photo.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10788,7 +10788,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "url": "A String", # The URL of the photo. You can change the desired size by appending a query parameter `sz={size}` at the end of the url, where {size} is the size in pixels. Example: https://lh3.googleusercontent.com/-T_wVWLlmg7w/AAAAAAAAAAI/AAAAAAAABa8/00gzXvDBYqw/s100/photo.jpg?sz=50
@@ -10798,7 +10798,7 @@
         { # A person's relation to another person.
           "formattedType": "A String", # Output only. The type of the relation translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
           "metadata": { # Metadata about a field. # Metadata about the relation.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10811,7 +10811,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "person": "A String", # The name of the other person this relation refers to.
@@ -10822,7 +10822,7 @@
         { # **DEPRECATED**: No data will be returned A person's relationship interest .
           "formattedValue": "A String", # Output only. The value of the relationship interest translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
           "metadata": { # Metadata about a field. # Metadata about the relationship interest.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10835,7 +10835,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The kind of relationship the person is looking for. The value can be custom or one of these predefined values: * `friend` * `date` * `relationship` * `networking`
@@ -10845,7 +10845,7 @@
         { # **DEPRECATED**: No data will be returned A person's relationship status.
           "formattedValue": "A String", # Output only. The value of the relationship status translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the relationship status.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10858,7 +10858,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The relationship status. The value can be custom or one of these predefined values: * `single` * `inARelationship` * `engaged` * `married` * `itsComplicated` * `openRelationship` * `widowed` * `inDomesticPartnership` * `inCivilUnion`
@@ -10868,7 +10868,7 @@
         { # **DEPRECATED**: Please use `person.locations` instead. A person's past or current residence.
           "current": True or False, # True if the residence is the person's current residence; false if the residence is a past residence.
           "metadata": { # Metadata about a field. # Metadata about the residence.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10881,7 +10881,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The address of the residence.
@@ -10892,7 +10892,7 @@
         { # A person's SIP address. Session Initial Protocol addresses are used for VoIP communications to make voice or video calls over the internet.
           "formattedType": "A String", # Output only. The type of the SIP address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the SIP address.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10905,7 +10905,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the SIP address. The type can be custom or or one of these predefined values: * `home` * `work` * `mobile` * `other`
@@ -10915,7 +10915,7 @@
       "skills": [ # The person's skills.
         { # A skill that the person has.
           "metadata": { # Metadata about a field. # Metadata about the skill.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10928,7 +10928,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The skill; for example, `underwater basket weaving`.
@@ -10937,7 +10937,7 @@
       "taglines": [ # Output only. **DEPRECATED**: No data will be returned The person's taglines.
         { # **DEPRECATED**: No data will be returned A brief one-line description of the person.
           "metadata": { # Metadata about a field. # Metadata about the tagline.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10950,7 +10950,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The tagline.
@@ -10960,7 +10960,7 @@
         { # A person's associated URLs.
           "formattedType": "A String", # Output only. The type of the URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
           "metadata": { # Metadata about a field. # Metadata about the URL.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10973,7 +10973,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "type": "A String", # The type of the URL. The type can be custom or one of these predefined values: * `home` * `work` * `blog` * `profile` * `homePage` * `ftp` * `reservations` * `appInstallPage`: website for a Currents application. * `other`
@@ -10984,7 +10984,7 @@
         { # Arbitrary user data that is populated by the end users.
           "key": "A String", # The end user specified key of the user defined data.
           "metadata": { # Metadata about a field. # Metadata about the user defined data.
-            "primary": True or False, # True if the field is the primary field for the person.
+            "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
             "source": { # The source of a field. # The source of the field.
               "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
               "id": "A String", # The unique identifier within the source type generated by the server.
@@ -10997,7 +10997,7 @@
               "type": "A String", # The source type.
               "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
             },
-            "sourcePrimary": True or False, # True if the field is the primary field for the source.
+            "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
             "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
           },
           "value": "A String", # The end user specified value of the user defined data.
@@ -11042,7 +11042,7 @@
       "formattedType": "A String", # Output only. The type of the address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "formattedValue": "A String", # The unstructured value of the address. If this is not set by the user it will be automatically constructed from structured values.
       "metadata": { # Metadata about a field. # Metadata about the address.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11055,7 +11055,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "poBox": "A String", # The P.O. box of the address.
@@ -11070,7 +11070,7 @@
     { # A person's age range.
       "ageRange": "A String", # The age range.
       "metadata": { # Metadata about a field. # Metadata about the age range.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11083,7 +11083,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
     },
@@ -11092,7 +11092,7 @@
     { # A person's short biography.
       "contentType": "A String", # The content type of the biography.
       "metadata": { # Metadata about a field. # Metadata about the biography.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11105,7 +11105,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The short biography.
@@ -11119,7 +11119,7 @@
         "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
       },
       "metadata": { # Metadata about a field. # Metadata about the birthday.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11132,7 +11132,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "text": "A String", # A free-form string representing the user's birthday.
@@ -11141,7 +11141,7 @@
   "braggingRights": [ # **DEPRECATED**: No data will be returned The person's bragging rights.
     { # **DEPRECATED**: No data will be returned A person's bragging rights.
       "metadata": { # Metadata about a field. # Metadata about the bragging rights.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11154,7 +11154,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The bragging rights; for example, `climbed mount everest`.
@@ -11164,7 +11164,7 @@
     { # A person's calendar URL.
       "formattedType": "A String", # Output only. The type of the calendar URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the calendar URL.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11177,7 +11177,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the calendar URL. The type can be custom or one of these predefined values: * `home` * `freeBusy` * `work`
@@ -11188,7 +11188,7 @@
     { # Arbitrary client data that is populated by clients. Duplicate keys and values are allowed.
       "key": "A String", # The client specified key of the client data.
       "metadata": { # Metadata about a field. # Metadata about the client data.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11201,7 +11201,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The client specified value of the client data.
@@ -11211,7 +11211,7 @@
     { # A person's cover photo. A large image shown on the person's profile page that represents who they are or what they care about.
       "default": True or False, # True if the cover photo is the default cover photo; false if the cover photo is a user-provided cover photo.
       "metadata": { # Metadata about a field. # Metadata about the cover photo.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11224,7 +11224,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "url": "A String", # The URL of the cover photo.
@@ -11235,7 +11235,7 @@
       "displayName": "A String", # The display name of the email.
       "formattedType": "A String", # Output only. The type of the email address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the email address.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11248,7 +11248,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the email address. The type can be custom or one of these predefined values: * `home` * `work` * `other`
@@ -11265,7 +11265,7 @@
       },
       "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the event.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11278,7 +11278,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the event. The type can be custom or one of these predefined values: * `anniversary` * `other`
@@ -11288,7 +11288,7 @@
     { # An identifier from an external entity related to the person.
       "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the external ID.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11301,7 +11301,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the external ID. The type can be custom or one of these predefined values: * `account` * `customer` * `loginId` * `network` * `organization`
@@ -11311,7 +11311,7 @@
   "fileAses": [ # The person's file-ases.
     { # The name that should be used to sort the person in a list.
       "metadata": { # Metadata about a field. # Metadata about the file-as.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11324,7 +11324,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The file-as value
@@ -11335,7 +11335,7 @@
       "addressMeAs": "A String", # The type of pronouns that should be used to address the person. The value can be custom or one of these predefined values: * `male` * `female` * `other`
       "formattedValue": "A String", # Output only. The value of the gender translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale. Unspecified or custom value are not localized.
       "metadata": { # Metadata about a field. # Metadata about the gender.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11348,7 +11348,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The gender for the person. The gender can be custom or one of these predefined values: * `male` * `female` * `unspecified`
@@ -11359,7 +11359,7 @@
       "formattedProtocol": "A String", # Output only. The protocol of the IM client formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "formattedType": "A String", # Output only. The type of the IM client translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the IM client.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11372,7 +11372,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "protocol": "A String", # The protocol of the IM client. The protocol can be custom or one of these predefined values: * `aim` * `msn` * `yahoo` * `skype` * `qq` * `googleTalk` * `icq` * `jabber` * `netMeeting`
@@ -11383,7 +11383,7 @@
   "interests": [ # The person's interests.
     { # One of the person's interests.
       "metadata": { # Metadata about a field. # Metadata about the interest.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11396,7 +11396,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The interest; for example, `stargazing`.
@@ -11405,7 +11405,7 @@
   "locales": [ # The person's locale preferences.
     { # A person's locale preference.
       "metadata": { # Metadata about a field. # Metadata about the locale.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11418,7 +11418,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The well-formed [IETF BCP 47](https://tools.ietf.org/html/bcp47) language tag representing the locale.
@@ -11432,7 +11432,7 @@
       "floor": "A String", # The floor name or number.
       "floorSection": "A String", # The floor section in `floor_name`.
       "metadata": { # Metadata about a field. # Metadata about the location.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11445,7 +11445,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the location. The type can be custom or one of these predefined values: * `desk` * `grewUp`
@@ -11462,7 +11462,7 @@
         "inViewerDomain": True or False, # True if the person is in the viewer's Google Workspace domain.
       },
       "metadata": { # Metadata about a field. # Metadata about the membership.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11475,7 +11475,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
     },
@@ -11508,7 +11508,7 @@
     { # A person's miscellaneous keyword.
       "formattedType": "A String", # Output only. The type of the miscellaneous keyword translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the miscellaneous keyword.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11521,7 +11521,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The miscellaneous keyword type.
@@ -11537,7 +11537,7 @@
       "honorificPrefix": "A String", # The honorific prefixes, such as `Mrs.` or `Dr.`
       "honorificSuffix": "A String", # The honorific suffixes, such as `Jr.`
       "metadata": { # Metadata about a field. # Metadata about the name.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11550,7 +11550,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "middleName": "A String", # The middle name(s).
@@ -11566,7 +11566,7 @@
   "nicknames": [ # The person's nicknames.
     { # A person's nickname.
       "metadata": { # Metadata about a field. # Metadata about the nickname.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11579,7 +11579,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the nickname.
@@ -11589,7 +11589,7 @@
   "occupations": [ # The person's occupations.
     { # A person's occupation.
       "metadata": { # Metadata about a field. # Metadata about the occupation.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11602,7 +11602,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The occupation; for example, `carpenter`.
@@ -11622,7 +11622,7 @@
       "jobDescription": "A String", # The person's job description at the organization.
       "location": "A String", # The location of the organization office the person works at.
       "metadata": { # Metadata about a field. # Metadata about the organization.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11635,7 +11635,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "name": "A String", # The name of the organization.
@@ -11655,7 +11655,7 @@
       "canonicalForm": "A String", # Output only. The canonicalized [ITU-T E.164](https://law.resource.org/pub/us/cfr/ibr/004/itu-t.E.164.1.2008.pdf) form of the phone number.
       "formattedType": "A String", # Output only. The type of the phone number translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the phone number.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11668,7 +11668,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the phone number. The type can be custom or one of these predefined values: * `home` * `work` * `mobile` * `homeFax` * `workFax` * `otherFax` * `pager` * `workMobile` * `workPager` * `main` * `googleVoice` * `other`
@@ -11679,7 +11679,7 @@
     { # A person's photo. A picture shown next to the person's name to help others recognize the person.
       "default": True or False, # True if the photo is a default photo; false if the photo is a user-provided photo.
       "metadata": { # Metadata about a field. # Metadata about the photo.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11692,7 +11692,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "url": "A String", # The URL of the photo. You can change the desired size by appending a query parameter `sz={size}` at the end of the url, where {size} is the size in pixels. Example: https://lh3.googleusercontent.com/-T_wVWLlmg7w/AAAAAAAAAAI/AAAAAAAABa8/00gzXvDBYqw/s100/photo.jpg?sz=50
@@ -11702,7 +11702,7 @@
     { # A person's relation to another person.
       "formattedType": "A String", # Output only. The type of the relation translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
       "metadata": { # Metadata about a field. # Metadata about the relation.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11715,7 +11715,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "person": "A String", # The name of the other person this relation refers to.
@@ -11726,7 +11726,7 @@
     { # **DEPRECATED**: No data will be returned A person's relationship interest .
       "formattedValue": "A String", # Output only. The value of the relationship interest translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
       "metadata": { # Metadata about a field. # Metadata about the relationship interest.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11739,7 +11739,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The kind of relationship the person is looking for. The value can be custom or one of these predefined values: * `friend` * `date` * `relationship` * `networking`
@@ -11749,7 +11749,7 @@
     { # **DEPRECATED**: No data will be returned A person's relationship status.
       "formattedValue": "A String", # Output only. The value of the relationship status translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the relationship status.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11762,7 +11762,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The relationship status. The value can be custom or one of these predefined values: * `single` * `inARelationship` * `engaged` * `married` * `itsComplicated` * `openRelationship` * `widowed` * `inDomesticPartnership` * `inCivilUnion`
@@ -11772,7 +11772,7 @@
     { # **DEPRECATED**: Please use `person.locations` instead. A person's past or current residence.
       "current": True or False, # True if the residence is the person's current residence; false if the residence is a past residence.
       "metadata": { # Metadata about a field. # Metadata about the residence.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11785,7 +11785,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The address of the residence.
@@ -11796,7 +11796,7 @@
     { # A person's SIP address. Session Initial Protocol addresses are used for VoIP communications to make voice or video calls over the internet.
       "formattedType": "A String", # Output only. The type of the SIP address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the SIP address.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11809,7 +11809,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the SIP address. The type can be custom or or one of these predefined values: * `home` * `work` * `mobile` * `other`
@@ -11819,7 +11819,7 @@
   "skills": [ # The person's skills.
     { # A skill that the person has.
       "metadata": { # Metadata about a field. # Metadata about the skill.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11832,7 +11832,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The skill; for example, `underwater basket weaving`.
@@ -11841,7 +11841,7 @@
   "taglines": [ # Output only. **DEPRECATED**: No data will be returned The person's taglines.
     { # **DEPRECATED**: No data will be returned A brief one-line description of the person.
       "metadata": { # Metadata about a field. # Metadata about the tagline.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11854,7 +11854,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The tagline.
@@ -11864,7 +11864,7 @@
     { # A person's associated URLs.
       "formattedType": "A String", # Output only. The type of the URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the URL.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11877,7 +11877,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the URL. The type can be custom or one of these predefined values: * `home` * `work` * `blog` * `profile` * `homePage` * `ftp` * `reservations` * `appInstallPage`: website for a Currents application. * `other`
@@ -11888,7 +11888,7 @@
     { # Arbitrary user data that is populated by the end users.
       "key": "A String", # The end user specified key of the user defined data.
       "metadata": { # Metadata about a field. # Metadata about the user defined data.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11901,7 +11901,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The end user specified value of the user defined data.
@@ -11935,7 +11935,7 @@
       "formattedType": "A String", # Output only. The type of the address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "formattedValue": "A String", # The unstructured value of the address. If this is not set by the user it will be automatically constructed from structured values.
       "metadata": { # Metadata about a field. # Metadata about the address.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11948,7 +11948,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "poBox": "A String", # The P.O. box of the address.
@@ -11963,7 +11963,7 @@
     { # A person's age range.
       "ageRange": "A String", # The age range.
       "metadata": { # Metadata about a field. # Metadata about the age range.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11976,7 +11976,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
     },
@@ -11985,7 +11985,7 @@
     { # A person's short biography.
       "contentType": "A String", # The content type of the biography.
       "metadata": { # Metadata about a field. # Metadata about the biography.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -11998,7 +11998,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The short biography.
@@ -12012,7 +12012,7 @@
         "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
       },
       "metadata": { # Metadata about a field. # Metadata about the birthday.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12025,7 +12025,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "text": "A String", # A free-form string representing the user's birthday.
@@ -12034,7 +12034,7 @@
   "braggingRights": [ # **DEPRECATED**: No data will be returned The person's bragging rights.
     { # **DEPRECATED**: No data will be returned A person's bragging rights.
       "metadata": { # Metadata about a field. # Metadata about the bragging rights.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12047,7 +12047,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The bragging rights; for example, `climbed mount everest`.
@@ -12057,7 +12057,7 @@
     { # A person's calendar URL.
       "formattedType": "A String", # Output only. The type of the calendar URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the calendar URL.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12070,7 +12070,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the calendar URL. The type can be custom or one of these predefined values: * `home` * `freeBusy` * `work`
@@ -12081,7 +12081,7 @@
     { # Arbitrary client data that is populated by clients. Duplicate keys and values are allowed.
       "key": "A String", # The client specified key of the client data.
       "metadata": { # Metadata about a field. # Metadata about the client data.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12094,7 +12094,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The client specified value of the client data.
@@ -12104,7 +12104,7 @@
     { # A person's cover photo. A large image shown on the person's profile page that represents who they are or what they care about.
       "default": True or False, # True if the cover photo is the default cover photo; false if the cover photo is a user-provided cover photo.
       "metadata": { # Metadata about a field. # Metadata about the cover photo.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12117,7 +12117,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "url": "A String", # The URL of the cover photo.
@@ -12128,7 +12128,7 @@
       "displayName": "A String", # The display name of the email.
       "formattedType": "A String", # Output only. The type of the email address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the email address.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12141,7 +12141,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the email address. The type can be custom or one of these predefined values: * `home` * `work` * `other`
@@ -12158,7 +12158,7 @@
       },
       "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the event.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12171,7 +12171,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the event. The type can be custom or one of these predefined values: * `anniversary` * `other`
@@ -12181,7 +12181,7 @@
     { # An identifier from an external entity related to the person.
       "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the external ID.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12194,7 +12194,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the external ID. The type can be custom or one of these predefined values: * `account` * `customer` * `loginId` * `network` * `organization`
@@ -12204,7 +12204,7 @@
   "fileAses": [ # The person's file-ases.
     { # The name that should be used to sort the person in a list.
       "metadata": { # Metadata about a field. # Metadata about the file-as.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12217,7 +12217,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The file-as value
@@ -12228,7 +12228,7 @@
       "addressMeAs": "A String", # The type of pronouns that should be used to address the person. The value can be custom or one of these predefined values: * `male` * `female` * `other`
       "formattedValue": "A String", # Output only. The value of the gender translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale. Unspecified or custom value are not localized.
       "metadata": { # Metadata about a field. # Metadata about the gender.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12241,7 +12241,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The gender for the person. The gender can be custom or one of these predefined values: * `male` * `female` * `unspecified`
@@ -12252,7 +12252,7 @@
       "formattedProtocol": "A String", # Output only. The protocol of the IM client formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "formattedType": "A String", # Output only. The type of the IM client translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the IM client.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12265,7 +12265,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "protocol": "A String", # The protocol of the IM client. The protocol can be custom or one of these predefined values: * `aim` * `msn` * `yahoo` * `skype` * `qq` * `googleTalk` * `icq` * `jabber` * `netMeeting`
@@ -12276,7 +12276,7 @@
   "interests": [ # The person's interests.
     { # One of the person's interests.
       "metadata": { # Metadata about a field. # Metadata about the interest.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12289,7 +12289,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The interest; for example, `stargazing`.
@@ -12298,7 +12298,7 @@
   "locales": [ # The person's locale preferences.
     { # A person's locale preference.
       "metadata": { # Metadata about a field. # Metadata about the locale.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12311,7 +12311,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The well-formed [IETF BCP 47](https://tools.ietf.org/html/bcp47) language tag representing the locale.
@@ -12325,7 +12325,7 @@
       "floor": "A String", # The floor name or number.
       "floorSection": "A String", # The floor section in `floor_name`.
       "metadata": { # Metadata about a field. # Metadata about the location.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12338,7 +12338,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the location. The type can be custom or one of these predefined values: * `desk` * `grewUp`
@@ -12355,7 +12355,7 @@
         "inViewerDomain": True or False, # True if the person is in the viewer's Google Workspace domain.
       },
       "metadata": { # Metadata about a field. # Metadata about the membership.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12368,7 +12368,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
     },
@@ -12401,7 +12401,7 @@
     { # A person's miscellaneous keyword.
       "formattedType": "A String", # Output only. The type of the miscellaneous keyword translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the miscellaneous keyword.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12414,7 +12414,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The miscellaneous keyword type.
@@ -12430,7 +12430,7 @@
       "honorificPrefix": "A String", # The honorific prefixes, such as `Mrs.` or `Dr.`
       "honorificSuffix": "A String", # The honorific suffixes, such as `Jr.`
       "metadata": { # Metadata about a field. # Metadata about the name.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12443,7 +12443,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "middleName": "A String", # The middle name(s).
@@ -12459,7 +12459,7 @@
   "nicknames": [ # The person's nicknames.
     { # A person's nickname.
       "metadata": { # Metadata about a field. # Metadata about the nickname.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12472,7 +12472,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the nickname.
@@ -12482,7 +12482,7 @@
   "occupations": [ # The person's occupations.
     { # A person's occupation.
       "metadata": { # Metadata about a field. # Metadata about the occupation.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12495,7 +12495,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The occupation; for example, `carpenter`.
@@ -12515,7 +12515,7 @@
       "jobDescription": "A String", # The person's job description at the organization.
       "location": "A String", # The location of the organization office the person works at.
       "metadata": { # Metadata about a field. # Metadata about the organization.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12528,7 +12528,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "name": "A String", # The name of the organization.
@@ -12548,7 +12548,7 @@
       "canonicalForm": "A String", # Output only. The canonicalized [ITU-T E.164](https://law.resource.org/pub/us/cfr/ibr/004/itu-t.E.164.1.2008.pdf) form of the phone number.
       "formattedType": "A String", # Output only. The type of the phone number translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the phone number.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12561,7 +12561,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the phone number. The type can be custom or one of these predefined values: * `home` * `work` * `mobile` * `homeFax` * `workFax` * `otherFax` * `pager` * `workMobile` * `workPager` * `main` * `googleVoice` * `other`
@@ -12572,7 +12572,7 @@
     { # A person's photo. A picture shown next to the person's name to help others recognize the person.
       "default": True or False, # True if the photo is a default photo; false if the photo is a user-provided photo.
       "metadata": { # Metadata about a field. # Metadata about the photo.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12585,7 +12585,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "url": "A String", # The URL of the photo. You can change the desired size by appending a query parameter `sz={size}` at the end of the url, where {size} is the size in pixels. Example: https://lh3.googleusercontent.com/-T_wVWLlmg7w/AAAAAAAAAAI/AAAAAAAABa8/00gzXvDBYqw/s100/photo.jpg?sz=50
@@ -12595,7 +12595,7 @@
     { # A person's relation to another person.
       "formattedType": "A String", # Output only. The type of the relation translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
       "metadata": { # Metadata about a field. # Metadata about the relation.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12608,7 +12608,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "person": "A String", # The name of the other person this relation refers to.
@@ -12619,7 +12619,7 @@
     { # **DEPRECATED**: No data will be returned A person's relationship interest .
       "formattedValue": "A String", # Output only. The value of the relationship interest translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
       "metadata": { # Metadata about a field. # Metadata about the relationship interest.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12632,7 +12632,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The kind of relationship the person is looking for. The value can be custom or one of these predefined values: * `friend` * `date` * `relationship` * `networking`
@@ -12642,7 +12642,7 @@
     { # **DEPRECATED**: No data will be returned A person's relationship status.
       "formattedValue": "A String", # Output only. The value of the relationship status translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the relationship status.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12655,7 +12655,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The relationship status. The value can be custom or one of these predefined values: * `single` * `inARelationship` * `engaged` * `married` * `itsComplicated` * `openRelationship` * `widowed` * `inDomesticPartnership` * `inCivilUnion`
@@ -12665,7 +12665,7 @@
     { # **DEPRECATED**: Please use `person.locations` instead. A person's past or current residence.
       "current": True or False, # True if the residence is the person's current residence; false if the residence is a past residence.
       "metadata": { # Metadata about a field. # Metadata about the residence.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12678,7 +12678,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The address of the residence.
@@ -12689,7 +12689,7 @@
     { # A person's SIP address. Session Initial Protocol addresses are used for VoIP communications to make voice or video calls over the internet.
       "formattedType": "A String", # Output only. The type of the SIP address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the SIP address.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12702,7 +12702,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the SIP address. The type can be custom or or one of these predefined values: * `home` * `work` * `mobile` * `other`
@@ -12712,7 +12712,7 @@
   "skills": [ # The person's skills.
     { # A skill that the person has.
       "metadata": { # Metadata about a field. # Metadata about the skill.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12725,7 +12725,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The skill; for example, `underwater basket weaving`.
@@ -12734,7 +12734,7 @@
   "taglines": [ # Output only. **DEPRECATED**: No data will be returned The person's taglines.
     { # **DEPRECATED**: No data will be returned A brief one-line description of the person.
       "metadata": { # Metadata about a field. # Metadata about the tagline.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12747,7 +12747,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The tagline.
@@ -12757,7 +12757,7 @@
     { # A person's associated URLs.
       "formattedType": "A String", # Output only. The type of the URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
       "metadata": { # Metadata about a field. # Metadata about the URL.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12770,7 +12770,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "type": "A String", # The type of the URL. The type can be custom or one of these predefined values: * `home` * `work` * `blog` * `profile` * `homePage` * `ftp` * `reservations` * `appInstallPage`: website for a Currents application. * `other`
@@ -12781,7 +12781,7 @@
     { # Arbitrary user data that is populated by the end users.
       "key": "A String", # The end user specified key of the user defined data.
       "metadata": { # Metadata about a field. # Metadata about the user defined data.
-        "primary": True or False, # True if the field is the primary field for the person.
+        "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
         "source": { # The source of a field. # The source of the field.
           "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
           "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12794,7 +12794,7 @@
           "type": "A String", # The source type.
           "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
         },
-        "sourcePrimary": True or False, # True if the field is the primary field for the source.
+        "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
         "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
       },
       "value": "A String", # The end user specified value of the user defined data.
@@ -12839,7 +12839,7 @@
         "formattedType": "A String", # Output only. The type of the address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
         "formattedValue": "A String", # The unstructured value of the address. If this is not set by the user it will be automatically constructed from structured values.
         "metadata": { # Metadata about a field. # Metadata about the address.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12852,7 +12852,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "poBox": "A String", # The P.O. box of the address.
@@ -12867,7 +12867,7 @@
       { # A person's age range.
         "ageRange": "A String", # The age range.
         "metadata": { # Metadata about a field. # Metadata about the age range.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12880,7 +12880,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
       },
@@ -12889,7 +12889,7 @@
       { # A person's short biography.
         "contentType": "A String", # The content type of the biography.
         "metadata": { # Metadata about a field. # Metadata about the biography.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12902,7 +12902,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The short biography.
@@ -12916,7 +12916,7 @@
           "year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
         },
         "metadata": { # Metadata about a field. # Metadata about the birthday.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12929,7 +12929,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "text": "A String", # A free-form string representing the user's birthday.
@@ -12938,7 +12938,7 @@
     "braggingRights": [ # **DEPRECATED**: No data will be returned The person's bragging rights.
       { # **DEPRECATED**: No data will be returned A person's bragging rights.
         "metadata": { # Metadata about a field. # Metadata about the bragging rights.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12951,7 +12951,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The bragging rights; for example, `climbed mount everest`.
@@ -12961,7 +12961,7 @@
       { # A person's calendar URL.
         "formattedType": "A String", # Output only. The type of the calendar URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
         "metadata": { # Metadata about a field. # Metadata about the calendar URL.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12974,7 +12974,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "type": "A String", # The type of the calendar URL. The type can be custom or one of these predefined values: * `home` * `freeBusy` * `work`
@@ -12985,7 +12985,7 @@
       { # Arbitrary client data that is populated by clients. Duplicate keys and values are allowed.
         "key": "A String", # The client specified key of the client data.
         "metadata": { # Metadata about a field. # Metadata about the client data.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -12998,7 +12998,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The client specified value of the client data.
@@ -13008,7 +13008,7 @@
       { # A person's cover photo. A large image shown on the person's profile page that represents who they are or what they care about.
         "default": True or False, # True if the cover photo is the default cover photo; false if the cover photo is a user-provided cover photo.
         "metadata": { # Metadata about a field. # Metadata about the cover photo.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13021,7 +13021,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "url": "A String", # The URL of the cover photo.
@@ -13032,7 +13032,7 @@
         "displayName": "A String", # The display name of the email.
         "formattedType": "A String", # Output only. The type of the email address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
         "metadata": { # Metadata about a field. # Metadata about the email address.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13045,7 +13045,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "type": "A String", # The type of the email address. The type can be custom or one of these predefined values: * `home` * `work` * `other`
@@ -13062,7 +13062,7 @@
         },
         "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
         "metadata": { # Metadata about a field. # Metadata about the event.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13075,7 +13075,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "type": "A String", # The type of the event. The type can be custom or one of these predefined values: * `anniversary` * `other`
@@ -13085,7 +13085,7 @@
       { # An identifier from an external entity related to the person.
         "formattedType": "A String", # Output only. The type of the event translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
         "metadata": { # Metadata about a field. # Metadata about the external ID.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13098,7 +13098,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "type": "A String", # The type of the external ID. The type can be custom or one of these predefined values: * `account` * `customer` * `loginId` * `network` * `organization`
@@ -13108,7 +13108,7 @@
     "fileAses": [ # The person's file-ases.
       { # The name that should be used to sort the person in a list.
         "metadata": { # Metadata about a field. # Metadata about the file-as.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13121,7 +13121,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The file-as value
@@ -13132,7 +13132,7 @@
         "addressMeAs": "A String", # The type of pronouns that should be used to address the person. The value can be custom or one of these predefined values: * `male` * `female` * `other`
         "formattedValue": "A String", # Output only. The value of the gender translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale. Unspecified or custom value are not localized.
         "metadata": { # Metadata about a field. # Metadata about the gender.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13145,7 +13145,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The gender for the person. The gender can be custom or one of these predefined values: * `male` * `female` * `unspecified`
@@ -13156,7 +13156,7 @@
         "formattedProtocol": "A String", # Output only. The protocol of the IM client formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
         "formattedType": "A String", # Output only. The type of the IM client translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
         "metadata": { # Metadata about a field. # Metadata about the IM client.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13169,7 +13169,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "protocol": "A String", # The protocol of the IM client. The protocol can be custom or one of these predefined values: * `aim` * `msn` * `yahoo` * `skype` * `qq` * `googleTalk` * `icq` * `jabber` * `netMeeting`
@@ -13180,7 +13180,7 @@
     "interests": [ # The person's interests.
       { # One of the person's interests.
         "metadata": { # Metadata about a field. # Metadata about the interest.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13193,7 +13193,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The interest; for example, `stargazing`.
@@ -13202,7 +13202,7 @@
     "locales": [ # The person's locale preferences.
       { # A person's locale preference.
         "metadata": { # Metadata about a field. # Metadata about the locale.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13215,7 +13215,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The well-formed [IETF BCP 47](https://tools.ietf.org/html/bcp47) language tag representing the locale.
@@ -13229,7 +13229,7 @@
         "floor": "A String", # The floor name or number.
         "floorSection": "A String", # The floor section in `floor_name`.
         "metadata": { # Metadata about a field. # Metadata about the location.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13242,7 +13242,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "type": "A String", # The type of the location. The type can be custom or one of these predefined values: * `desk` * `grewUp`
@@ -13259,7 +13259,7 @@
           "inViewerDomain": True or False, # True if the person is in the viewer's Google Workspace domain.
         },
         "metadata": { # Metadata about a field. # Metadata about the membership.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13272,7 +13272,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
       },
@@ -13305,7 +13305,7 @@
       { # A person's miscellaneous keyword.
         "formattedType": "A String", # Output only. The type of the miscellaneous keyword translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
         "metadata": { # Metadata about a field. # Metadata about the miscellaneous keyword.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13318,7 +13318,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "type": "A String", # The miscellaneous keyword type.
@@ -13334,7 +13334,7 @@
         "honorificPrefix": "A String", # The honorific prefixes, such as `Mrs.` or `Dr.`
         "honorificSuffix": "A String", # The honorific suffixes, such as `Jr.`
         "metadata": { # Metadata about a field. # Metadata about the name.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13347,7 +13347,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "middleName": "A String", # The middle name(s).
@@ -13363,7 +13363,7 @@
     "nicknames": [ # The person's nicknames.
       { # A person's nickname.
         "metadata": { # Metadata about a field. # Metadata about the nickname.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13376,7 +13376,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "type": "A String", # The type of the nickname.
@@ -13386,7 +13386,7 @@
     "occupations": [ # The person's occupations.
       { # A person's occupation.
         "metadata": { # Metadata about a field. # Metadata about the occupation.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13399,7 +13399,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The occupation; for example, `carpenter`.
@@ -13419,7 +13419,7 @@
         "jobDescription": "A String", # The person's job description at the organization.
         "location": "A String", # The location of the organization office the person works at.
         "metadata": { # Metadata about a field. # Metadata about the organization.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13432,7 +13432,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "name": "A String", # The name of the organization.
@@ -13452,7 +13452,7 @@
         "canonicalForm": "A String", # Output only. The canonicalized [ITU-T E.164](https://law.resource.org/pub/us/cfr/ibr/004/itu-t.E.164.1.2008.pdf) form of the phone number.
         "formattedType": "A String", # Output only. The type of the phone number translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
         "metadata": { # Metadata about a field. # Metadata about the phone number.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13465,7 +13465,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "type": "A String", # The type of the phone number. The type can be custom or one of these predefined values: * `home` * `work` * `mobile` * `homeFax` * `workFax` * `otherFax` * `pager` * `workMobile` * `workPager` * `main` * `googleVoice` * `other`
@@ -13476,7 +13476,7 @@
       { # A person's photo. A picture shown next to the person's name to help others recognize the person.
         "default": True or False, # True if the photo is a default photo; false if the photo is a user-provided photo.
         "metadata": { # Metadata about a field. # Metadata about the photo.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13489,7 +13489,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "url": "A String", # The URL of the photo. You can change the desired size by appending a query parameter `sz={size}` at the end of the url, where {size} is the size in pixels. Example: https://lh3.googleusercontent.com/-T_wVWLlmg7w/AAAAAAAAAAI/AAAAAAAABa8/00gzXvDBYqw/s100/photo.jpg?sz=50
@@ -13499,7 +13499,7 @@
       { # A person's relation to another person.
         "formattedType": "A String", # Output only. The type of the relation translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
         "metadata": { # Metadata about a field. # Metadata about the relation.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13512,7 +13512,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "person": "A String", # The name of the other person this relation refers to.
@@ -13523,7 +13523,7 @@
       { # **DEPRECATED**: No data will be returned A person's relationship interest .
         "formattedValue": "A String", # Output only. The value of the relationship interest translated and formatted in the viewer's account locale or the locale specified in the Accept-Language HTTP header.
         "metadata": { # Metadata about a field. # Metadata about the relationship interest.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13536,7 +13536,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The kind of relationship the person is looking for. The value can be custom or one of these predefined values: * `friend` * `date` * `relationship` * `networking`
@@ -13546,7 +13546,7 @@
       { # **DEPRECATED**: No data will be returned A person's relationship status.
         "formattedValue": "A String", # Output only. The value of the relationship status translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
         "metadata": { # Metadata about a field. # Metadata about the relationship status.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13559,7 +13559,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The relationship status. The value can be custom or one of these predefined values: * `single` * `inARelationship` * `engaged` * `married` * `itsComplicated` * `openRelationship` * `widowed` * `inDomesticPartnership` * `inCivilUnion`
@@ -13569,7 +13569,7 @@
       { # **DEPRECATED**: Please use `person.locations` instead. A person's past or current residence.
         "current": True or False, # True if the residence is the person's current residence; false if the residence is a past residence.
         "metadata": { # Metadata about a field. # Metadata about the residence.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13582,7 +13582,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The address of the residence.
@@ -13593,7 +13593,7 @@
       { # A person's SIP address. Session Initial Protocol addresses are used for VoIP communications to make voice or video calls over the internet.
         "formattedType": "A String", # Output only. The type of the SIP address translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
         "metadata": { # Metadata about a field. # Metadata about the SIP address.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13606,7 +13606,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "type": "A String", # The type of the SIP address. The type can be custom or or one of these predefined values: * `home` * `work` * `mobile` * `other`
@@ -13616,7 +13616,7 @@
     "skills": [ # The person's skills.
       { # A skill that the person has.
         "metadata": { # Metadata about a field. # Metadata about the skill.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13629,7 +13629,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The skill; for example, `underwater basket weaving`.
@@ -13638,7 +13638,7 @@
     "taglines": [ # Output only. **DEPRECATED**: No data will be returned The person's taglines.
       { # **DEPRECATED**: No data will be returned A brief one-line description of the person.
         "metadata": { # Metadata about a field. # Metadata about the tagline.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13651,7 +13651,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The tagline.
@@ -13661,7 +13661,7 @@
       { # A person's associated URLs.
         "formattedType": "A String", # Output only. The type of the URL translated and formatted in the viewer's account locale or the `Accept-Language` HTTP header locale.
         "metadata": { # Metadata about a field. # Metadata about the URL.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13674,7 +13674,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "type": "A String", # The type of the URL. The type can be custom or one of these predefined values: * `home` * `work` * `blog` * `profile` * `homePage` * `ftp` * `reservations` * `appInstallPage`: website for a Currents application. * `other`
@@ -13685,7 +13685,7 @@
       { # Arbitrary user data that is populated by the end users.
         "key": "A String", # The end user specified key of the user defined data.
         "metadata": { # Metadata about a field. # Metadata about the user defined data.
-          "primary": True or False, # True if the field is the primary field for the person.
+          "primary": True or False, # Output only. True if the field is the primary field for all sources in the person. Each person will have at most one field with `primary` set to true.
           "source": { # The source of a field. # The source of the field.
             "etag": "A String", # **Only populated in `person.metadata.sources`.** The [HTTP entity tag](https://en.wikipedia.org/wiki/HTTP_ETag) of the source. Used for web cache validation.
             "id": "A String", # The unique identifier within the source type generated by the server.
@@ -13698,7 +13698,7 @@
             "type": "A String", # The source type.
             "updateTime": "A String", # Output only. **Only populated in `person.metadata.sources`.** Last update timestamp of this source.
           },
-          "sourcePrimary": True or False, # True if the field is the primary field for the source.
+          "sourcePrimary": True or False, # True if the field is the primary field for the source. Each source must have at most one field with `source_primary` set to true.
           "verified": True or False, # Output only. True if the field is verified; false if the field is unverified. A verified field is typically a name, email address, phone number, or website that has been confirmed to be owned by the person.
         },
         "value": "A String", # The end user specified value of the user defined data.

docs/dyn/policysimulator_v1.folders.locations.replays.html

diff --git a/docs/dyn/policysimulator_v1.folders.locations.replays.html b/docs/dyn/policysimulator_v1.folders.locations.replays.html
index d313673..31b341c 100644
--- a/docs/dyn/policysimulator_v1.folders.locations.replays.html
+++ b/docs/dyn/policysimulator_v1.folders.locations.replays.html
@@ -107,7 +107,7 @@
   "config": { # The configuration used for a Replay. # Required. The configuration used for the `Replay`.
     "logSource": "A String", # The logs to use as input for the Replay.
     "policyOverlay": { # A mapping of the resources that you want to simulate policies for and the policies that you want to simulate. Keys are the full resource names for the resources. For example, `//cloudresourcemanager.googleapis.com/projects/my-project`. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names. Values are Policy objects representing the policies that you want to simulate. Replays automatically take into account any IAM policies inherited through the resource hierarchy, and any policies set on descendant resources. You do not need to include these policies in the policy overlay.
-      "a_key": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+      "a_key": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
         "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
           { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
             "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -207,7 +207,7 @@
   "config": { # The configuration used for a Replay. # Required. The configuration used for the `Replay`.
     "logSource": "A String", # The logs to use as input for the Replay.
     "policyOverlay": { # A mapping of the resources that you want to simulate policies for and the policies that you want to simulate. Keys are the full resource names for the resources. For example, `//cloudresourcemanager.googleapis.com/projects/my-project`. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names. Values are Policy objects representing the policies that you want to simulate. Replays automatically take into account any IAM policies inherited through the resource hierarchy, and any policies set on descendant resources. You do not need to include these policies in the policy overlay.
-      "a_key": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+      "a_key": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
         "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
           { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
             "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/policysimulator_v1.folders.locations.replays.results.html

diff --git a/docs/dyn/policysimulator_v1.folders.locations.replays.results.html b/docs/dyn/policysimulator_v1.folders.locations.replays.results.html
index edbda9d..96fa723 100644
--- a/docs/dyn/policysimulator_v1.folders.locations.replays.results.html
+++ b/docs/dyn/policysimulator_v1.folders.locations.replays.results.html
@@ -155,7 +155,7 @@
                   },
                 ],
                 "fullResourceName": "A String", # The full resource name that identifies the resource. For example, `//compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance`. If the user who created the Replay does not have access to the policy, this field is omitted. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names.
-                "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the resource. If the user who created the Replay does not have access to the policy, this field is empty.
+                "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the resource. If the user who created the Replay does not have access to the policy, this field is empty.
                   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
                     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
                       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -228,7 +228,7 @@
                   },
                 ],
                 "fullResourceName": "A String", # The full resource name that identifies the resource. For example, `//compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance`. If the user who created the Replay does not have access to the policy, this field is omitted. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names.
-                "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the resource. If the user who created the Replay does not have access to the policy, this field is empty.
+                "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the resource. If the user who created the Replay does not have access to the policy, this field is empty.
                   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
                     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
                       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/policysimulator_v1.organizations.locations.replays.html

diff --git a/docs/dyn/policysimulator_v1.organizations.locations.replays.html b/docs/dyn/policysimulator_v1.organizations.locations.replays.html
index bdf5806..4c03308 100644
--- a/docs/dyn/policysimulator_v1.organizations.locations.replays.html
+++ b/docs/dyn/policysimulator_v1.organizations.locations.replays.html
@@ -107,7 +107,7 @@
   "config": { # The configuration used for a Replay. # Required. The configuration used for the `Replay`.
     "logSource": "A String", # The logs to use as input for the Replay.
     "policyOverlay": { # A mapping of the resources that you want to simulate policies for and the policies that you want to simulate. Keys are the full resource names for the resources. For example, `//cloudresourcemanager.googleapis.com/projects/my-project`. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names. Values are Policy objects representing the policies that you want to simulate. Replays automatically take into account any IAM policies inherited through the resource hierarchy, and any policies set on descendant resources. You do not need to include these policies in the policy overlay.
-      "a_key": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+      "a_key": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
         "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
           { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
             "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -207,7 +207,7 @@
   "config": { # The configuration used for a Replay. # Required. The configuration used for the `Replay`.
     "logSource": "A String", # The logs to use as input for the Replay.
     "policyOverlay": { # A mapping of the resources that you want to simulate policies for and the policies that you want to simulate. Keys are the full resource names for the resources. For example, `//cloudresourcemanager.googleapis.com/projects/my-project`. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names. Values are Policy objects representing the policies that you want to simulate. Replays automatically take into account any IAM policies inherited through the resource hierarchy, and any policies set on descendant resources. You do not need to include these policies in the policy overlay.
-      "a_key": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+      "a_key": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
         "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
           { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
             "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/policysimulator_v1.organizations.locations.replays.results.html

diff --git a/docs/dyn/policysimulator_v1.organizations.locations.replays.results.html b/docs/dyn/policysimulator_v1.organizations.locations.replays.results.html
index 1dca2fb..b64b884 100644
--- a/docs/dyn/policysimulator_v1.organizations.locations.replays.results.html
+++ b/docs/dyn/policysimulator_v1.organizations.locations.replays.results.html
@@ -155,7 +155,7 @@
                   },
                 ],
                 "fullResourceName": "A String", # The full resource name that identifies the resource. For example, `//compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance`. If the user who created the Replay does not have access to the policy, this field is omitted. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names.
-                "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the resource. If the user who created the Replay does not have access to the policy, this field is empty.
+                "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the resource. If the user who created the Replay does not have access to the policy, this field is empty.
                   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
                     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
                       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -228,7 +228,7 @@
                   },
                 ],
                 "fullResourceName": "A String", # The full resource name that identifies the resource. For example, `//compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance`. If the user who created the Replay does not have access to the policy, this field is omitted. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names.
-                "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the resource. If the user who created the Replay does not have access to the policy, this field is empty.
+                "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the resource. If the user who created the Replay does not have access to the policy, this field is empty.
                   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
                     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
                       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/policysimulator_v1.projects.locations.replays.html

diff --git a/docs/dyn/policysimulator_v1.projects.locations.replays.html b/docs/dyn/policysimulator_v1.projects.locations.replays.html
index db91a0e..ad9f8bb 100644
--- a/docs/dyn/policysimulator_v1.projects.locations.replays.html
+++ b/docs/dyn/policysimulator_v1.projects.locations.replays.html
@@ -107,7 +107,7 @@
   "config": { # The configuration used for a Replay. # Required. The configuration used for the `Replay`.
     "logSource": "A String", # The logs to use as input for the Replay.
     "policyOverlay": { # A mapping of the resources that you want to simulate policies for and the policies that you want to simulate. Keys are the full resource names for the resources. For example, `//cloudresourcemanager.googleapis.com/projects/my-project`. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names. Values are Policy objects representing the policies that you want to simulate. Replays automatically take into account any IAM policies inherited through the resource hierarchy, and any policies set on descendant resources. You do not need to include these policies in the policy overlay.
-      "a_key": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+      "a_key": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
         "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
           { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
             "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -207,7 +207,7 @@
   "config": { # The configuration used for a Replay. # Required. The configuration used for the `Replay`.
     "logSource": "A String", # The logs to use as input for the Replay.
     "policyOverlay": { # A mapping of the resources that you want to simulate policies for and the policies that you want to simulate. Keys are the full resource names for the resources. For example, `//cloudresourcemanager.googleapis.com/projects/my-project`. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names. Values are Policy objects representing the policies that you want to simulate. Replays automatically take into account any IAM policies inherited through the resource hierarchy, and any policies set on descendant resources. You do not need to include these policies in the policy overlay.
-      "a_key": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+      "a_key": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
         "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
           { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
             "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/policysimulator_v1.projects.locations.replays.results.html

diff --git a/docs/dyn/policysimulator_v1.projects.locations.replays.results.html b/docs/dyn/policysimulator_v1.projects.locations.replays.results.html
index c130f27..2be1b57 100644
--- a/docs/dyn/policysimulator_v1.projects.locations.replays.results.html
+++ b/docs/dyn/policysimulator_v1.projects.locations.replays.results.html
@@ -155,7 +155,7 @@
                   },
                 ],
                 "fullResourceName": "A String", # The full resource name that identifies the resource. For example, `//compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance`. If the user who created the Replay does not have access to the policy, this field is omitted. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names.
-                "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the resource. If the user who created the Replay does not have access to the policy, this field is empty.
+                "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the resource. If the user who created the Replay does not have access to the policy, this field is empty.
                   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
                     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
                       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -228,7 +228,7 @@
                   },
                 ],
                 "fullResourceName": "A String", # The full resource name that identifies the resource. For example, `//compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance`. If the user who created the Replay does not have access to the policy, this field is omitted. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names.
-                "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the resource. If the user who created the Replay does not have access to the policy, this field is empty.
+                "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the resource. If the user who created the Replay does not have access to the policy, this field is empty.
                   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
                     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
                       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/policysimulator_v1beta1.folders.locations.replays.html

diff --git a/docs/dyn/policysimulator_v1beta1.folders.locations.replays.html b/docs/dyn/policysimulator_v1beta1.folders.locations.replays.html
index 05efa50..b944442 100644
--- a/docs/dyn/policysimulator_v1beta1.folders.locations.replays.html
+++ b/docs/dyn/policysimulator_v1beta1.folders.locations.replays.html
@@ -107,7 +107,7 @@
   "config": { # The configuration used for a Replay. # Required. The configuration used for the `Replay`.
     "logSource": "A String", # The logs to use as input for the Replay.
     "policyOverlay": { # A mapping of the resources that you want to simulate policies for and the policies that you want to simulate. Keys are the full resource names for the resources. For example, `//cloudresourcemanager.googleapis.com/projects/my-project`. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names. Values are Policy objects representing the policies that you want to simulate. Replays automatically take into account any IAM policies inherited through the resource hierarchy, and any policies set on descendant resources. You do not need to include these policies in the policy overlay.
-      "a_key": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+      "a_key": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
         "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
           { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
             "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -207,7 +207,7 @@
   "config": { # The configuration used for a Replay. # Required. The configuration used for the `Replay`.
     "logSource": "A String", # The logs to use as input for the Replay.
     "policyOverlay": { # A mapping of the resources that you want to simulate policies for and the policies that you want to simulate. Keys are the full resource names for the resources. For example, `//cloudresourcemanager.googleapis.com/projects/my-project`. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names. Values are Policy objects representing the policies that you want to simulate. Replays automatically take into account any IAM policies inherited through the resource hierarchy, and any policies set on descendant resources. You do not need to include these policies in the policy overlay.
-      "a_key": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+      "a_key": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
         "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
           { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
             "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/policysimulator_v1beta1.folders.locations.replays.results.html

diff --git a/docs/dyn/policysimulator_v1beta1.folders.locations.replays.results.html b/docs/dyn/policysimulator_v1beta1.folders.locations.replays.results.html
index e26f230..af72c1e 100644
--- a/docs/dyn/policysimulator_v1beta1.folders.locations.replays.results.html
+++ b/docs/dyn/policysimulator_v1beta1.folders.locations.replays.results.html
@@ -155,7 +155,7 @@
                   },
                 ],
                 "fullResourceName": "A String", # The full resource name that identifies the resource. For example, `//compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance`. If the user who created the Replay does not have access to the policy, this field is omitted. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names.
-                "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the resource. If the user who created the Replay does not have access to the policy, this field is empty.
+                "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the resource. If the user who created the Replay does not have access to the policy, this field is empty.
                   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
                     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
                       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -228,7 +228,7 @@
                   },
                 ],
                 "fullResourceName": "A String", # The full resource name that identifies the resource. For example, `//compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance`. If the user who created the Replay does not have access to the policy, this field is omitted. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names.
-                "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the resource. If the user who created the Replay does not have access to the policy, this field is empty.
+                "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the resource. If the user who created the Replay does not have access to the policy, this field is empty.
                   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
                     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
                       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/policysimulator_v1beta1.organizations.locations.replays.html

diff --git a/docs/dyn/policysimulator_v1beta1.organizations.locations.replays.html b/docs/dyn/policysimulator_v1beta1.organizations.locations.replays.html
index fde5d58..7453406 100644
--- a/docs/dyn/policysimulator_v1beta1.organizations.locations.replays.html
+++ b/docs/dyn/policysimulator_v1beta1.organizations.locations.replays.html
@@ -107,7 +107,7 @@
   "config": { # The configuration used for a Replay. # Required. The configuration used for the `Replay`.
     "logSource": "A String", # The logs to use as input for the Replay.
     "policyOverlay": { # A mapping of the resources that you want to simulate policies for and the policies that you want to simulate. Keys are the full resource names for the resources. For example, `//cloudresourcemanager.googleapis.com/projects/my-project`. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names. Values are Policy objects representing the policies that you want to simulate. Replays automatically take into account any IAM policies inherited through the resource hierarchy, and any policies set on descendant resources. You do not need to include these policies in the policy overlay.
-      "a_key": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+      "a_key": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
         "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
           { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
             "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -207,7 +207,7 @@
   "config": { # The configuration used for a Replay. # Required. The configuration used for the `Replay`.
     "logSource": "A String", # The logs to use as input for the Replay.
     "policyOverlay": { # A mapping of the resources that you want to simulate policies for and the policies that you want to simulate. Keys are the full resource names for the resources. For example, `//cloudresourcemanager.googleapis.com/projects/my-project`. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names. Values are Policy objects representing the policies that you want to simulate. Replays automatically take into account any IAM policies inherited through the resource hierarchy, and any policies set on descendant resources. You do not need to include these policies in the policy overlay.
-      "a_key": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+      "a_key": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
         "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
           { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
             "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/policysimulator_v1beta1.organizations.locations.replays.results.html

diff --git a/docs/dyn/policysimulator_v1beta1.organizations.locations.replays.results.html b/docs/dyn/policysimulator_v1beta1.organizations.locations.replays.results.html
index b6d8cdc..a13fd9e 100644
--- a/docs/dyn/policysimulator_v1beta1.organizations.locations.replays.results.html
+++ b/docs/dyn/policysimulator_v1beta1.organizations.locations.replays.results.html
@@ -155,7 +155,7 @@
                   },
                 ],
                 "fullResourceName": "A String", # The full resource name that identifies the resource. For example, `//compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance`. If the user who created the Replay does not have access to the policy, this field is omitted. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names.
-                "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the resource. If the user who created the Replay does not have access to the policy, this field is empty.
+                "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the resource. If the user who created the Replay does not have access to the policy, this field is empty.
                   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
                     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
                       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -228,7 +228,7 @@
                   },
                 ],
                 "fullResourceName": "A String", # The full resource name that identifies the resource. For example, `//compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance`. If the user who created the Replay does not have access to the policy, this field is omitted. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names.
-                "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the resource. If the user who created the Replay does not have access to the policy, this field is empty.
+                "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the resource. If the user who created the Replay does not have access to the policy, this field is empty.
                   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
                     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
                       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/policysimulator_v1beta1.projects.locations.replays.html

diff --git a/docs/dyn/policysimulator_v1beta1.projects.locations.replays.html b/docs/dyn/policysimulator_v1beta1.projects.locations.replays.html
index 772177f..7c2a44c 100644
--- a/docs/dyn/policysimulator_v1beta1.projects.locations.replays.html
+++ b/docs/dyn/policysimulator_v1beta1.projects.locations.replays.html
@@ -107,7 +107,7 @@
   "config": { # The configuration used for a Replay. # Required. The configuration used for the `Replay`.
     "logSource": "A String", # The logs to use as input for the Replay.
     "policyOverlay": { # A mapping of the resources that you want to simulate policies for and the policies that you want to simulate. Keys are the full resource names for the resources. For example, `//cloudresourcemanager.googleapis.com/projects/my-project`. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names. Values are Policy objects representing the policies that you want to simulate. Replays automatically take into account any IAM policies inherited through the resource hierarchy, and any policies set on descendant resources. You do not need to include these policies in the policy overlay.
-      "a_key": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+      "a_key": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
         "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
           { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
             "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -207,7 +207,7 @@
   "config": { # The configuration used for a Replay. # Required. The configuration used for the `Replay`.
     "logSource": "A String", # The logs to use as input for the Replay.
     "policyOverlay": { # A mapping of the resources that you want to simulate policies for and the policies that you want to simulate. Keys are the full resource names for the resources. For example, `//cloudresourcemanager.googleapis.com/projects/my-project`. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names. Values are Policy objects representing the policies that you want to simulate. Replays automatically take into account any IAM policies inherited through the resource hierarchy, and any policies set on descendant resources. You do not need to include these policies in the policy overlay.
-      "a_key": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+      "a_key": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
         "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
           { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
             "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/policysimulator_v1beta1.projects.locations.replays.results.html

diff --git a/docs/dyn/policysimulator_v1beta1.projects.locations.replays.results.html b/docs/dyn/policysimulator_v1beta1.projects.locations.replays.results.html
index 3f712ca..bb12d65 100644
--- a/docs/dyn/policysimulator_v1beta1.projects.locations.replays.results.html
+++ b/docs/dyn/policysimulator_v1beta1.projects.locations.replays.results.html
@@ -155,7 +155,7 @@
                   },
                 ],
                 "fullResourceName": "A String", # The full resource name that identifies the resource. For example, `//compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance`. If the user who created the Replay does not have access to the policy, this field is omitted. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names.
-                "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the resource. If the user who created the Replay does not have access to the policy, this field is empty.
+                "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the resource. If the user who created the Replay does not have access to the policy, this field is empty.
                   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
                     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
                       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -228,7 +228,7 @@
                   },
                 ],
                 "fullResourceName": "A String", # The full resource name that identifies the resource. For example, `//compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance`. If the user who created the Replay does not have access to the policy, this field is omitted. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names.
-                "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the resource. If the user who created the Replay does not have access to the policy, this field is empty.
+                "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy attached to the resource. If the user who created the Replay does not have access to the policy, this field is empty.
                   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
                     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
                       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/redis_v1.projects.locations.instances.html

diff --git a/docs/dyn/redis_v1.projects.locations.instances.html b/docs/dyn/redis_v1.projects.locations.instances.html
index 186925b..a646cd6 100644
--- a/docs/dyn/redis_v1.projects.locations.instances.html
+++ b/docs/dyn/redis_v1.projects.locations.instances.html
@@ -128,7 +128,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # A Google Cloud Redis instance. next id = 30
+{ # A Google Cloud Redis instance. next id = 36
   "alternativeLocationId": "A String", # Optional. Only applicable to STANDARD_HA tier which protects the instance against zonal failures by provisioning it across two zones. If provided, it must be a different zone from the one provided in location_id.
   "authEnabled": True or False, # Optional. Indicates whether OSS Redis AUTH is enabled for the instance. If set to "true" AUTH is enabled on the instance. Default value is "false" meaning AUTH is disabled.
   "authorizedNetwork": "A String", # Optional. The full name of the Google Compute Engine [network](https://cloud.google.com/vpc/docs/vpc) to which the instance is connected. If left unspecified, the `default` network will be used.
@@ -140,7 +140,7 @@
   "labels": { # Resource labels to represent user provided metadata
     "a_key": "A String",
   },
-  "locationId": "A String", # Optional. The zone where the instance will be provisioned. If not provided, the service will choose a zone for the instance. For STANDARD_HA tier, instances will be created across two zones for protection against zonal failures. If alternative_location_id is also provided, it must be different from location_id.
+  "locationId": "A String", # Optional. The zone where the instance will be provisioned. If not provided, the service will choose a zone from the specified region for the instance. For standard tier, instances will be created across two zones for protection against zonal failures. If [alternative_location_id] is also provided, it must be different from [location_id].
   "maintenancePolicy": { # Maintenance policy for an instance. # Optional. The maintenance policy for the instance. If not provided, maintenance events can be performed at any time.
     "createTime": "A String", # Output only. The time when the policy was created.
     "description": "A String", # Optional. Description of what this policy is for. Create/Update methods return INVALID_ARGUMENT if the length is greater than 512.
@@ -355,7 +355,7 @@
 Returns:
   An object of the form:
 
-    { # A Google Cloud Redis instance. next id = 30
+    { # A Google Cloud Redis instance. next id = 36
   "alternativeLocationId": "A String", # Optional. Only applicable to STANDARD_HA tier which protects the instance against zonal failures by provisioning it across two zones. If provided, it must be a different zone from the one provided in location_id.
   "authEnabled": True or False, # Optional. Indicates whether OSS Redis AUTH is enabled for the instance. If set to "true" AUTH is enabled on the instance. Default value is "false" meaning AUTH is disabled.
   "authorizedNetwork": "A String", # Optional. The full name of the Google Compute Engine [network](https://cloud.google.com/vpc/docs/vpc) to which the instance is connected. If left unspecified, the `default` network will be used.
@@ -367,7 +367,7 @@
   "labels": { # Resource labels to represent user provided metadata
     "a_key": "A String",
   },
-  "locationId": "A String", # Optional. The zone where the instance will be provisioned. If not provided, the service will choose a zone for the instance. For STANDARD_HA tier, instances will be created across two zones for protection against zonal failures. If alternative_location_id is also provided, it must be different from location_id.
+  "locationId": "A String", # Optional. The zone where the instance will be provisioned. If not provided, the service will choose a zone from the specified region for the instance. For standard tier, instances will be created across two zones for protection against zonal failures. If [alternative_location_id] is also provided, it must be different from [location_id].
   "maintenancePolicy": { # Maintenance policy for an instance. # Optional. The maintenance policy for the instance. If not provided, maintenance events can be performed at any time.
     "createTime": "A String", # Output only. The time when the policy was created.
     "description": "A String", # Optional. Description of what this policy is for. Create/Update methods return INVALID_ARGUMENT if the length is greater than 512.
@@ -499,7 +499,7 @@
 
     { # Response for ListInstances.
   "instances": [ # A list of Redis instances in the project in the specified location, or across all locations. If the `location_id` in the parent field of the request is "-", all regions available to the project are queried, and the results aggregated. If in such an aggregated query a location is unavailable, a placeholder Redis entry is included in the response with the `name` field set to a value of the form `projects/{project_id}/locations/{location_id}/instances/`- and the `status` field set to ERROR and `status_message` field set to "location not available for ListInstances".
-    { # A Google Cloud Redis instance. next id = 30
+    { # A Google Cloud Redis instance. next id = 36
       "alternativeLocationId": "A String", # Optional. Only applicable to STANDARD_HA tier which protects the instance against zonal failures by provisioning it across two zones. If provided, it must be a different zone from the one provided in location_id.
       "authEnabled": True or False, # Optional. Indicates whether OSS Redis AUTH is enabled for the instance. If set to "true" AUTH is enabled on the instance. Default value is "false" meaning AUTH is disabled.
       "authorizedNetwork": "A String", # Optional. The full name of the Google Compute Engine [network](https://cloud.google.com/vpc/docs/vpc) to which the instance is connected. If left unspecified, the `default` network will be used.
@@ -511,7 +511,7 @@
       "labels": { # Resource labels to represent user provided metadata
         "a_key": "A String",
       },
-      "locationId": "A String", # Optional. The zone where the instance will be provisioned. If not provided, the service will choose a zone for the instance. For STANDARD_HA tier, instances will be created across two zones for protection against zonal failures. If alternative_location_id is also provided, it must be different from location_id.
+      "locationId": "A String", # Optional. The zone where the instance will be provisioned. If not provided, the service will choose a zone from the specified region for the instance. For standard tier, instances will be created across two zones for protection against zonal failures. If [alternative_location_id] is also provided, it must be different from [location_id].
       "maintenancePolicy": { # Maintenance policy for an instance. # Optional. The maintenance policy for the instance. If not provided, maintenance events can be performed at any time.
         "createTime": "A String", # Output only. The time when the policy was created.
         "description": "A String", # Optional. Description of what this policy is for. Create/Update methods return INVALID_ARGUMENT if the length is greater than 512.
@@ -589,7 +589,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # A Google Cloud Redis instance. next id = 30
+{ # A Google Cloud Redis instance. next id = 36
   "alternativeLocationId": "A String", # Optional. Only applicable to STANDARD_HA tier which protects the instance against zonal failures by provisioning it across two zones. If provided, it must be a different zone from the one provided in location_id.
   "authEnabled": True or False, # Optional. Indicates whether OSS Redis AUTH is enabled for the instance. If set to "true" AUTH is enabled on the instance. Default value is "false" meaning AUTH is disabled.
   "authorizedNetwork": "A String", # Optional. The full name of the Google Compute Engine [network](https://cloud.google.com/vpc/docs/vpc) to which the instance is connected. If left unspecified, the `default` network will be used.
@@ -601,7 +601,7 @@
   "labels": { # Resource labels to represent user provided metadata
     "a_key": "A String",
   },
-  "locationId": "A String", # Optional. The zone where the instance will be provisioned. If not provided, the service will choose a zone for the instance. For STANDARD_HA tier, instances will be created across two zones for protection against zonal failures. If alternative_location_id is also provided, it must be different from location_id.
+  "locationId": "A String", # Optional. The zone where the instance will be provisioned. If not provided, the service will choose a zone from the specified region for the instance. For standard tier, instances will be created across two zones for protection against zonal failures. If [alternative_location_id] is also provided, it must be different from [location_id].
   "maintenancePolicy": { # Maintenance policy for an instance. # Optional. The maintenance policy for the instance. If not provided, maintenance events can be performed at any time.
     "createTime": "A String", # Output only. The time when the policy was created.
     "description": "A String", # Optional. Description of what this policy is for. Create/Update methods return INVALID_ARGUMENT if the length is greater than 512.

docs/dyn/redis_v1beta1.projects.locations.instances.html

diff --git a/docs/dyn/redis_v1beta1.projects.locations.instances.html b/docs/dyn/redis_v1beta1.projects.locations.instances.html
index 4b405ed..4da5fb8 100644
--- a/docs/dyn/redis_v1beta1.projects.locations.instances.html
+++ b/docs/dyn/redis_v1beta1.projects.locations.instances.html
@@ -128,7 +128,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # A Google Cloud Redis instance. next id = 30
+{ # A Google Cloud Redis instance. next id = 36
   "alternativeLocationId": "A String", # Optional. Only applicable to STANDARD_HA tier which protects the instance against zonal failures by provisioning it across two zones. If provided, it must be a different zone from the one provided in location_id.
   "authEnabled": True or False, # Optional. Indicates whether OSS Redis AUTH is enabled for the instance. If set to "true" AUTH is enabled on the instance. Default value is "false" meaning AUTH is disabled.
   "authorizedNetwork": "A String", # Optional. The full name of the Google Compute Engine [network](https://cloud.google.com/vpc/docs/vpc) to which the instance is connected. If left unspecified, the `default` network will be used.
@@ -140,7 +140,7 @@
   "labels": { # Resource labels to represent user provided metadata
     "a_key": "A String",
   },
-  "locationId": "A String", # Optional. The zone where the instance will be provisioned. If not provided, the service will choose a zone for the instance. For STANDARD_HA tier, instances will be created across two zones for protection against zonal failures. If alternative_location_id is also provided, it must be different from location_id.
+  "locationId": "A String", # Optional. The zone where the instance will be provisioned. If not provided, the service will choose a zone from the specified region for the instance. For standard tier, instances will be created across two zones for protection against zonal failures. If [alternative_location_id] is also provided, it must be different from [location_id].
   "maintenancePolicy": { # Maintenance policy for an instance. # Optional. The maintenance policy for the instance. If not provided, maintenance events can be performed at any time.
     "createTime": "A String", # Output only. The time when the policy was created.
     "description": "A String", # Optional. Description of what this policy is for. Create/Update methods return INVALID_ARGUMENT if the length is greater than 512.
@@ -355,7 +355,7 @@
 Returns:
   An object of the form:
 
-    { # A Google Cloud Redis instance. next id = 30
+    { # A Google Cloud Redis instance. next id = 36
   "alternativeLocationId": "A String", # Optional. Only applicable to STANDARD_HA tier which protects the instance against zonal failures by provisioning it across two zones. If provided, it must be a different zone from the one provided in location_id.
   "authEnabled": True or False, # Optional. Indicates whether OSS Redis AUTH is enabled for the instance. If set to "true" AUTH is enabled on the instance. Default value is "false" meaning AUTH is disabled.
   "authorizedNetwork": "A String", # Optional. The full name of the Google Compute Engine [network](https://cloud.google.com/vpc/docs/vpc) to which the instance is connected. If left unspecified, the `default` network will be used.
@@ -367,7 +367,7 @@
   "labels": { # Resource labels to represent user provided metadata
     "a_key": "A String",
   },
-  "locationId": "A String", # Optional. The zone where the instance will be provisioned. If not provided, the service will choose a zone for the instance. For STANDARD_HA tier, instances will be created across two zones for protection against zonal failures. If alternative_location_id is also provided, it must be different from location_id.
+  "locationId": "A String", # Optional. The zone where the instance will be provisioned. If not provided, the service will choose a zone from the specified region for the instance. For standard tier, instances will be created across two zones for protection against zonal failures. If [alternative_location_id] is also provided, it must be different from [location_id].
   "maintenancePolicy": { # Maintenance policy for an instance. # Optional. The maintenance policy for the instance. If not provided, maintenance events can be performed at any time.
     "createTime": "A String", # Output only. The time when the policy was created.
     "description": "A String", # Optional. Description of what this policy is for. Create/Update methods return INVALID_ARGUMENT if the length is greater than 512.
@@ -499,7 +499,7 @@
 
     { # Response for ListInstances.
   "instances": [ # A list of Redis instances in the project in the specified location, or across all locations. If the `location_id` in the parent field of the request is "-", all regions available to the project are queried, and the results aggregated. If in such an aggregated query a location is unavailable, a placeholder Redis entry is included in the response with the `name` field set to a value of the form `projects/{project_id}/locations/{location_id}/instances/`- and the `status` field set to ERROR and `status_message` field set to "location not available for ListInstances".
-    { # A Google Cloud Redis instance. next id = 30
+    { # A Google Cloud Redis instance. next id = 36
       "alternativeLocationId": "A String", # Optional. Only applicable to STANDARD_HA tier which protects the instance against zonal failures by provisioning it across two zones. If provided, it must be a different zone from the one provided in location_id.
       "authEnabled": True or False, # Optional. Indicates whether OSS Redis AUTH is enabled for the instance. If set to "true" AUTH is enabled on the instance. Default value is "false" meaning AUTH is disabled.
       "authorizedNetwork": "A String", # Optional. The full name of the Google Compute Engine [network](https://cloud.google.com/vpc/docs/vpc) to which the instance is connected. If left unspecified, the `default` network will be used.
@@ -511,7 +511,7 @@
       "labels": { # Resource labels to represent user provided metadata
         "a_key": "A String",
       },
-      "locationId": "A String", # Optional. The zone where the instance will be provisioned. If not provided, the service will choose a zone for the instance. For STANDARD_HA tier, instances will be created across two zones for protection against zonal failures. If alternative_location_id is also provided, it must be different from location_id.
+      "locationId": "A String", # Optional. The zone where the instance will be provisioned. If not provided, the service will choose a zone from the specified region for the instance. For standard tier, instances will be created across two zones for protection against zonal failures. If [alternative_location_id] is also provided, it must be different from [location_id].
       "maintenancePolicy": { # Maintenance policy for an instance. # Optional. The maintenance policy for the instance. If not provided, maintenance events can be performed at any time.
         "createTime": "A String", # Output only. The time when the policy was created.
         "description": "A String", # Optional. Description of what this policy is for. Create/Update methods return INVALID_ARGUMENT if the length is greater than 512.
@@ -589,7 +589,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # A Google Cloud Redis instance. next id = 30
+{ # A Google Cloud Redis instance. next id = 36
   "alternativeLocationId": "A String", # Optional. Only applicable to STANDARD_HA tier which protects the instance against zonal failures by provisioning it across two zones. If provided, it must be a different zone from the one provided in location_id.
   "authEnabled": True or False, # Optional. Indicates whether OSS Redis AUTH is enabled for the instance. If set to "true" AUTH is enabled on the instance. Default value is "false" meaning AUTH is disabled.
   "authorizedNetwork": "A String", # Optional. The full name of the Google Compute Engine [network](https://cloud.google.com/vpc/docs/vpc) to which the instance is connected. If left unspecified, the `default` network will be used.
@@ -601,7 +601,7 @@
   "labels": { # Resource labels to represent user provided metadata
     "a_key": "A String",
   },
-  "locationId": "A String", # Optional. The zone where the instance will be provisioned. If not provided, the service will choose a zone for the instance. For STANDARD_HA tier, instances will be created across two zones for protection against zonal failures. If alternative_location_id is also provided, it must be different from location_id.
+  "locationId": "A String", # Optional. The zone where the instance will be provisioned. If not provided, the service will choose a zone from the specified region for the instance. For standard tier, instances will be created across two zones for protection against zonal failures. If [alternative_location_id] is also provided, it must be different from [location_id].
   "maintenancePolicy": { # Maintenance policy for an instance. # Optional. The maintenance policy for the instance. If not provided, maintenance events can be performed at any time.
     "createTime": "A String", # Output only. The time when the policy was created.
     "description": "A String", # Optional. Description of what this policy is for. Create/Update methods return INVALID_ARGUMENT if the length is greater than 512.

docs/dyn/run_v1.namespaces.configurations.html

diff --git a/docs/dyn/run_v1.namespaces.configurations.html b/docs/dyn/run_v1.namespaces.configurations.html
index 97836eb..fccebcb 100644
--- a/docs/dyn/run_v1.namespaces.configurations.html
+++ b/docs/dyn/run_v1.namespaces.configurations.html
@@ -330,9 +330,9 @@
             "terminationMessagePath": "A String", # (Optional) Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log.
             "terminationMessagePolicy": "A String", # (Optional) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
             "volumeMounts": [ # (Optional) Volume to mount into the container's filesystem. Only supports SecretVolumeSources. Pod volumes to mount into the container's filesystem.
-              { # Not supported by Cloud Run VolumeMount describes a mounting of a Volume within a container.
+              { # VolumeMount describes a mounting of a Volume within a container.
                 "mountPath": "A String", # Path within the container at which the volume should be mounted. Must not contain ':'.
-                "name": "A String", # This must match the Name of a Volume.
+                "name": "A String", # The name of the volume. There must be a corresponding Volume with the same name.
                 "readOnly": True or False, # (Optional) Only true is accepted. Defaults to true.
                 "subPath": "A String", # (Optional) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
               },
@@ -343,7 +343,7 @@
         "serviceAccountName": "A String", # Email address of the IAM service account associated with the revision of the service. The service account represents the identity of the running revision, and determines what permissions the revision has. If not provided, the revision will use the project's default service account.
         "timeoutSeconds": 42, # TimeoutSeconds holds the max duration the instance is allowed for responding to a request. Cloud Run fully managed: defaults to 300 seconds (5 minutes). Maximum allowed value is 3600 seconds (1 hour). Cloud Run for Anthos: defaults to 300 seconds (5 minutes). Maximum allowed value is configurable by the cluster operator.
         "volumes": [
-          { # Not supported by Cloud Run Volume represents a named volume in a container.
+          { # Volume represents a named volume in a container.
             "configMap": { # Not supported by Cloud Run Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
               "items": [ # (Optional) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -356,7 +356,7 @@
               "name": "A String", # Name of the config.
               "optional": True or False, # (Optional) Specify whether the Secret or its keys must be defined.
             },
-            "name": "A String", # Volume's name.
+            "name": "A String", # Volume's name. In Cloud Run Fully Managed, the name 'cloudsql' is reserved.
             "secret": { # The secret's value will be presented as the content of a file whose name is defined in the item path. If no items are defined, the name of the file is the secret_name. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0000 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. NOTE: This is an integer representation of the mode bits. So, the integer value should look exactly as the chmod numeric notation, i.e. Unix chmod "777" (a=rwx) should have the integer value 777.
               "items": [ # (Optional) If unspecified, the volume will expose a file whose name is the secret_name. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a key and a path. If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -643,9 +643,9 @@
                 "terminationMessagePath": "A String", # (Optional) Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log.
                 "terminationMessagePolicy": "A String", # (Optional) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
                 "volumeMounts": [ # (Optional) Volume to mount into the container's filesystem. Only supports SecretVolumeSources. Pod volumes to mount into the container's filesystem.
-                  { # Not supported by Cloud Run VolumeMount describes a mounting of a Volume within a container.
+                  { # VolumeMount describes a mounting of a Volume within a container.
                     "mountPath": "A String", # Path within the container at which the volume should be mounted. Must not contain ':'.
-                    "name": "A String", # This must match the Name of a Volume.
+                    "name": "A String", # The name of the volume. There must be a corresponding Volume with the same name.
                     "readOnly": True or False, # (Optional) Only true is accepted. Defaults to true.
                     "subPath": "A String", # (Optional) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
                   },
@@ -656,7 +656,7 @@
             "serviceAccountName": "A String", # Email address of the IAM service account associated with the revision of the service. The service account represents the identity of the running revision, and determines what permissions the revision has. If not provided, the revision will use the project's default service account.
             "timeoutSeconds": 42, # TimeoutSeconds holds the max duration the instance is allowed for responding to a request. Cloud Run fully managed: defaults to 300 seconds (5 minutes). Maximum allowed value is 3600 seconds (1 hour). Cloud Run for Anthos: defaults to 300 seconds (5 minutes). Maximum allowed value is configurable by the cluster operator.
             "volumes": [
-              { # Not supported by Cloud Run Volume represents a named volume in a container.
+              { # Volume represents a named volume in a container.
                 "configMap": { # Not supported by Cloud Run Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
                   "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
                   "items": [ # (Optional) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -669,7 +669,7 @@
                   "name": "A String", # Name of the config.
                   "optional": True or False, # (Optional) Specify whether the Secret or its keys must be defined.
                 },
-                "name": "A String", # Volume's name.
+                "name": "A String", # Volume's name. In Cloud Run Fully Managed, the name 'cloudsql' is reserved.
                 "secret": { # The secret's value will be presented as the content of a file whose name is defined in the item path. If no items are defined, the name of the file is the secret_name. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
                   "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0000 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. NOTE: This is an integer representation of the mode bits. So, the integer value should look exactly as the chmod numeric notation, i.e. Unix chmod "777" (a=rwx) should have the integer value 777.
                   "items": [ # (Optional) If unspecified, the volume will expose a file whose name is the secret_name. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a key and a path. If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.

docs/dyn/run_v1.namespaces.revisions.html

diff --git a/docs/dyn/run_v1.namespaces.revisions.html b/docs/dyn/run_v1.namespaces.revisions.html
index fda324c..e399d32 100644
--- a/docs/dyn/run_v1.namespaces.revisions.html
+++ b/docs/dyn/run_v1.namespaces.revisions.html
@@ -344,9 +344,9 @@
         "terminationMessagePath": "A String", # (Optional) Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log.
         "terminationMessagePolicy": "A String", # (Optional) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
         "volumeMounts": [ # (Optional) Volume to mount into the container's filesystem. Only supports SecretVolumeSources. Pod volumes to mount into the container's filesystem.
-          { # Not supported by Cloud Run VolumeMount describes a mounting of a Volume within a container.
+          { # VolumeMount describes a mounting of a Volume within a container.
             "mountPath": "A String", # Path within the container at which the volume should be mounted. Must not contain ':'.
-            "name": "A String", # This must match the Name of a Volume.
+            "name": "A String", # The name of the volume. There must be a corresponding Volume with the same name.
             "readOnly": True or False, # (Optional) Only true is accepted. Defaults to true.
             "subPath": "A String", # (Optional) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
           },
@@ -357,7 +357,7 @@
     "serviceAccountName": "A String", # Email address of the IAM service account associated with the revision of the service. The service account represents the identity of the running revision, and determines what permissions the revision has. If not provided, the revision will use the project's default service account.
     "timeoutSeconds": 42, # TimeoutSeconds holds the max duration the instance is allowed for responding to a request. Cloud Run fully managed: defaults to 300 seconds (5 minutes). Maximum allowed value is 3600 seconds (1 hour). Cloud Run for Anthos: defaults to 300 seconds (5 minutes). Maximum allowed value is configurable by the cluster operator.
     "volumes": [
-      { # Not supported by Cloud Run Volume represents a named volume in a container.
+      { # Volume represents a named volume in a container.
         "configMap": { # Not supported by Cloud Run Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
           "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
           "items": [ # (Optional) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -370,7 +370,7 @@
           "name": "A String", # Name of the config.
           "optional": True or False, # (Optional) Specify whether the Secret or its keys must be defined.
         },
-        "name": "A String", # Volume's name.
+        "name": "A String", # Volume's name. In Cloud Run Fully Managed, the name 'cloudsql' is reserved.
         "secret": { # The secret's value will be presented as the content of a file whose name is defined in the item path. If no items are defined, the name of the file is the secret_name. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
           "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0000 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. NOTE: This is an integer representation of the mode bits. So, the integer value should look exactly as the chmod numeric notation, i.e. Unix chmod "777" (a=rwx) should have the integer value 777.
           "items": [ # (Optional) If unspecified, the volume will expose a file whose name is the secret_name. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a key and a path. If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -622,9 +622,9 @@
             "terminationMessagePath": "A String", # (Optional) Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log.
             "terminationMessagePolicy": "A String", # (Optional) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
             "volumeMounts": [ # (Optional) Volume to mount into the container's filesystem. Only supports SecretVolumeSources. Pod volumes to mount into the container's filesystem.
-              { # Not supported by Cloud Run VolumeMount describes a mounting of a Volume within a container.
+              { # VolumeMount describes a mounting of a Volume within a container.
                 "mountPath": "A String", # Path within the container at which the volume should be mounted. Must not contain ':'.
-                "name": "A String", # This must match the Name of a Volume.
+                "name": "A String", # The name of the volume. There must be a corresponding Volume with the same name.
                 "readOnly": True or False, # (Optional) Only true is accepted. Defaults to true.
                 "subPath": "A String", # (Optional) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
               },
@@ -635,7 +635,7 @@
         "serviceAccountName": "A String", # Email address of the IAM service account associated with the revision of the service. The service account represents the identity of the running revision, and determines what permissions the revision has. If not provided, the revision will use the project's default service account.
         "timeoutSeconds": 42, # TimeoutSeconds holds the max duration the instance is allowed for responding to a request. Cloud Run fully managed: defaults to 300 seconds (5 minutes). Maximum allowed value is 3600 seconds (1 hour). Cloud Run for Anthos: defaults to 300 seconds (5 minutes). Maximum allowed value is configurable by the cluster operator.
         "volumes": [
-          { # Not supported by Cloud Run Volume represents a named volume in a container.
+          { # Volume represents a named volume in a container.
             "configMap": { # Not supported by Cloud Run Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
               "items": [ # (Optional) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -648,7 +648,7 @@
               "name": "A String", # Name of the config.
               "optional": True or False, # (Optional) Specify whether the Secret or its keys must be defined.
             },
-            "name": "A String", # Volume's name.
+            "name": "A String", # Volume's name. In Cloud Run Fully Managed, the name 'cloudsql' is reserved.
             "secret": { # The secret's value will be presented as the content of a file whose name is defined in the item path. If no items are defined, the name of the file is the secret_name. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0000 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. NOTE: This is an integer representation of the mode bits. So, the integer value should look exactly as the chmod numeric notation, i.e. Unix chmod "777" (a=rwx) should have the integer value 777.
               "items": [ # (Optional) If unspecified, the volume will expose a file whose name is the secret_name. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a key and a path. If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.

docs/dyn/run_v1.namespaces.services.html

diff --git a/docs/dyn/run_v1.namespaces.services.html b/docs/dyn/run_v1.namespaces.services.html
index 92fbc51..ec39d7f 100644
--- a/docs/dyn/run_v1.namespaces.services.html
+++ b/docs/dyn/run_v1.namespaces.services.html
@@ -334,9 +334,9 @@
             "terminationMessagePath": "A String", # (Optional) Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log.
             "terminationMessagePolicy": "A String", # (Optional) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
             "volumeMounts": [ # (Optional) Volume to mount into the container's filesystem. Only supports SecretVolumeSources. Pod volumes to mount into the container's filesystem.
-              { # Not supported by Cloud Run VolumeMount describes a mounting of a Volume within a container.
+              { # VolumeMount describes a mounting of a Volume within a container.
                 "mountPath": "A String", # Path within the container at which the volume should be mounted. Must not contain ':'.
-                "name": "A String", # This must match the Name of a Volume.
+                "name": "A String", # The name of the volume. There must be a corresponding Volume with the same name.
                 "readOnly": True or False, # (Optional) Only true is accepted. Defaults to true.
                 "subPath": "A String", # (Optional) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
               },
@@ -347,7 +347,7 @@
         "serviceAccountName": "A String", # Email address of the IAM service account associated with the revision of the service. The service account represents the identity of the running revision, and determines what permissions the revision has. If not provided, the revision will use the project's default service account.
         "timeoutSeconds": 42, # TimeoutSeconds holds the max duration the instance is allowed for responding to a request. Cloud Run fully managed: defaults to 300 seconds (5 minutes). Maximum allowed value is 3600 seconds (1 hour). Cloud Run for Anthos: defaults to 300 seconds (5 minutes). Maximum allowed value is configurable by the cluster operator.
         "volumes": [
-          { # Not supported by Cloud Run Volume represents a named volume in a container.
+          { # Volume represents a named volume in a container.
             "configMap": { # Not supported by Cloud Run Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
               "items": [ # (Optional) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -360,7 +360,7 @@
               "name": "A String", # Name of the config.
               "optional": True or False, # (Optional) Specify whether the Secret or its keys must be defined.
             },
-            "name": "A String", # Volume's name.
+            "name": "A String", # Volume's name. In Cloud Run Fully Managed, the name 'cloudsql' is reserved.
             "secret": { # The secret's value will be presented as the content of a file whose name is defined in the item path. If no items are defined, the name of the file is the secret_name. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0000 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. NOTE: This is an integer representation of the mode bits. So, the integer value should look exactly as the chmod numeric notation, i.e. Unix chmod "777" (a=rwx) should have the integer value 777.
               "items": [ # (Optional) If unspecified, the volume will expose a file whose name is the secret_name. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a key and a path. If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -655,9 +655,9 @@
             "terminationMessagePath": "A String", # (Optional) Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log.
             "terminationMessagePolicy": "A String", # (Optional) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
             "volumeMounts": [ # (Optional) Volume to mount into the container's filesystem. Only supports SecretVolumeSources. Pod volumes to mount into the container's filesystem.
-              { # Not supported by Cloud Run VolumeMount describes a mounting of a Volume within a container.
+              { # VolumeMount describes a mounting of a Volume within a container.
                 "mountPath": "A String", # Path within the container at which the volume should be mounted. Must not contain ':'.
-                "name": "A String", # This must match the Name of a Volume.
+                "name": "A String", # The name of the volume. There must be a corresponding Volume with the same name.
                 "readOnly": True or False, # (Optional) Only true is accepted. Defaults to true.
                 "subPath": "A String", # (Optional) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
               },
@@ -668,7 +668,7 @@
         "serviceAccountName": "A String", # Email address of the IAM service account associated with the revision of the service. The service account represents the identity of the running revision, and determines what permissions the revision has. If not provided, the revision will use the project's default service account.
         "timeoutSeconds": 42, # TimeoutSeconds holds the max duration the instance is allowed for responding to a request. Cloud Run fully managed: defaults to 300 seconds (5 minutes). Maximum allowed value is 3600 seconds (1 hour). Cloud Run for Anthos: defaults to 300 seconds (5 minutes). Maximum allowed value is configurable by the cluster operator.
         "volumes": [
-          { # Not supported by Cloud Run Volume represents a named volume in a container.
+          { # Volume represents a named volume in a container.
             "configMap": { # Not supported by Cloud Run Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
               "items": [ # (Optional) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -681,7 +681,7 @@
               "name": "A String", # Name of the config.
               "optional": True or False, # (Optional) Specify whether the Secret or its keys must be defined.
             },
-            "name": "A String", # Volume's name.
+            "name": "A String", # Volume's name. In Cloud Run Fully Managed, the name 'cloudsql' is reserved.
             "secret": { # The secret's value will be presented as the content of a file whose name is defined in the item path. If no items are defined, the name of the file is the secret_name. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0000 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. NOTE: This is an integer representation of the mode bits. So, the integer value should look exactly as the chmod numeric notation, i.e. Unix chmod "777" (a=rwx) should have the integer value 777.
               "items": [ # (Optional) If unspecified, the volume will expose a file whose name is the secret_name. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a key and a path. If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -1027,9 +1027,9 @@
             "terminationMessagePath": "A String", # (Optional) Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log.
             "terminationMessagePolicy": "A String", # (Optional) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
             "volumeMounts": [ # (Optional) Volume to mount into the container's filesystem. Only supports SecretVolumeSources. Pod volumes to mount into the container's filesystem.
-              { # Not supported by Cloud Run VolumeMount describes a mounting of a Volume within a container.
+              { # VolumeMount describes a mounting of a Volume within a container.
                 "mountPath": "A String", # Path within the container at which the volume should be mounted. Must not contain ':'.
-                "name": "A String", # This must match the Name of a Volume.
+                "name": "A String", # The name of the volume. There must be a corresponding Volume with the same name.
                 "readOnly": True or False, # (Optional) Only true is accepted. Defaults to true.
                 "subPath": "A String", # (Optional) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
               },
@@ -1040,7 +1040,7 @@
         "serviceAccountName": "A String", # Email address of the IAM service account associated with the revision of the service. The service account represents the identity of the running revision, and determines what permissions the revision has. If not provided, the revision will use the project's default service account.
         "timeoutSeconds": 42, # TimeoutSeconds holds the max duration the instance is allowed for responding to a request. Cloud Run fully managed: defaults to 300 seconds (5 minutes). Maximum allowed value is 3600 seconds (1 hour). Cloud Run for Anthos: defaults to 300 seconds (5 minutes). Maximum allowed value is configurable by the cluster operator.
         "volumes": [
-          { # Not supported by Cloud Run Volume represents a named volume in a container.
+          { # Volume represents a named volume in a container.
             "configMap": { # Not supported by Cloud Run Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
               "items": [ # (Optional) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -1053,7 +1053,7 @@
               "name": "A String", # Name of the config.
               "optional": True or False, # (Optional) Specify whether the Secret or its keys must be defined.
             },
-            "name": "A String", # Volume's name.
+            "name": "A String", # Volume's name. In Cloud Run Fully Managed, the name 'cloudsql' is reserved.
             "secret": { # The secret's value will be presented as the content of a file whose name is defined in the item path. If no items are defined, the name of the file is the secret_name. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0000 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. NOTE: This is an integer representation of the mode bits. So, the integer value should look exactly as the chmod numeric notation, i.e. Unix chmod "777" (a=rwx) should have the integer value 777.
               "items": [ # (Optional) If unspecified, the volume will expose a file whose name is the secret_name. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a key and a path. If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -1364,9 +1364,9 @@
                 "terminationMessagePath": "A String", # (Optional) Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log.
                 "terminationMessagePolicy": "A String", # (Optional) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
                 "volumeMounts": [ # (Optional) Volume to mount into the container's filesystem. Only supports SecretVolumeSources. Pod volumes to mount into the container's filesystem.
-                  { # Not supported by Cloud Run VolumeMount describes a mounting of a Volume within a container.
+                  { # VolumeMount describes a mounting of a Volume within a container.
                     "mountPath": "A String", # Path within the container at which the volume should be mounted. Must not contain ':'.
-                    "name": "A String", # This must match the Name of a Volume.
+                    "name": "A String", # The name of the volume. There must be a corresponding Volume with the same name.
                     "readOnly": True or False, # (Optional) Only true is accepted. Defaults to true.
                     "subPath": "A String", # (Optional) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
                   },
@@ -1377,7 +1377,7 @@
             "serviceAccountName": "A String", # Email address of the IAM service account associated with the revision of the service. The service account represents the identity of the running revision, and determines what permissions the revision has. If not provided, the revision will use the project's default service account.
             "timeoutSeconds": 42, # TimeoutSeconds holds the max duration the instance is allowed for responding to a request. Cloud Run fully managed: defaults to 300 seconds (5 minutes). Maximum allowed value is 3600 seconds (1 hour). Cloud Run for Anthos: defaults to 300 seconds (5 minutes). Maximum allowed value is configurable by the cluster operator.
             "volumes": [
-              { # Not supported by Cloud Run Volume represents a named volume in a container.
+              { # Volume represents a named volume in a container.
                 "configMap": { # Not supported by Cloud Run Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
                   "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
                   "items": [ # (Optional) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -1390,7 +1390,7 @@
                   "name": "A String", # Name of the config.
                   "optional": True or False, # (Optional) Specify whether the Secret or its keys must be defined.
                 },
-                "name": "A String", # Volume's name.
+                "name": "A String", # Volume's name. In Cloud Run Fully Managed, the name 'cloudsql' is reserved.
                 "secret": { # The secret's value will be presented as the content of a file whose name is defined in the item path. If no items are defined, the name of the file is the secret_name. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
                   "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0000 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. NOTE: This is an integer representation of the mode bits. So, the integer value should look exactly as the chmod numeric notation, i.e. Unix chmod "777" (a=rwx) should have the integer value 777.
                   "items": [ # (Optional) If unspecified, the volume will expose a file whose name is the secret_name. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a key and a path. If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -1697,9 +1697,9 @@
             "terminationMessagePath": "A String", # (Optional) Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log.
             "terminationMessagePolicy": "A String", # (Optional) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
             "volumeMounts": [ # (Optional) Volume to mount into the container's filesystem. Only supports SecretVolumeSources. Pod volumes to mount into the container's filesystem.
-              { # Not supported by Cloud Run VolumeMount describes a mounting of a Volume within a container.
+              { # VolumeMount describes a mounting of a Volume within a container.
                 "mountPath": "A String", # Path within the container at which the volume should be mounted. Must not contain ':'.
-                "name": "A String", # This must match the Name of a Volume.
+                "name": "A String", # The name of the volume. There must be a corresponding Volume with the same name.
                 "readOnly": True or False, # (Optional) Only true is accepted. Defaults to true.
                 "subPath": "A String", # (Optional) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
               },
@@ -1710,7 +1710,7 @@
         "serviceAccountName": "A String", # Email address of the IAM service account associated with the revision of the service. The service account represents the identity of the running revision, and determines what permissions the revision has. If not provided, the revision will use the project's default service account.
         "timeoutSeconds": 42, # TimeoutSeconds holds the max duration the instance is allowed for responding to a request. Cloud Run fully managed: defaults to 300 seconds (5 minutes). Maximum allowed value is 3600 seconds (1 hour). Cloud Run for Anthos: defaults to 300 seconds (5 minutes). Maximum allowed value is configurable by the cluster operator.
         "volumes": [
-          { # Not supported by Cloud Run Volume represents a named volume in a container.
+          { # Volume represents a named volume in a container.
             "configMap": { # Not supported by Cloud Run Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
               "items": [ # (Optional) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -1723,7 +1723,7 @@
               "name": "A String", # Name of the config.
               "optional": True or False, # (Optional) Specify whether the Secret or its keys must be defined.
             },
-            "name": "A String", # Volume's name.
+            "name": "A String", # Volume's name. In Cloud Run Fully Managed, the name 'cloudsql' is reserved.
             "secret": { # The secret's value will be presented as the content of a file whose name is defined in the item path. If no items are defined, the name of the file is the secret_name. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0000 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. NOTE: This is an integer representation of the mode bits. So, the integer value should look exactly as the chmod numeric notation, i.e. Unix chmod "777" (a=rwx) should have the integer value 777.
               "items": [ # (Optional) If unspecified, the volume will expose a file whose name is the secret_name. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a key and a path. If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -2018,9 +2018,9 @@
             "terminationMessagePath": "A String", # (Optional) Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log.
             "terminationMessagePolicy": "A String", # (Optional) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
             "volumeMounts": [ # (Optional) Volume to mount into the container's filesystem. Only supports SecretVolumeSources. Pod volumes to mount into the container's filesystem.
-              { # Not supported by Cloud Run VolumeMount describes a mounting of a Volume within a container.
+              { # VolumeMount describes a mounting of a Volume within a container.
                 "mountPath": "A String", # Path within the container at which the volume should be mounted. Must not contain ':'.
-                "name": "A String", # This must match the Name of a Volume.
+                "name": "A String", # The name of the volume. There must be a corresponding Volume with the same name.
                 "readOnly": True or False, # (Optional) Only true is accepted. Defaults to true.
                 "subPath": "A String", # (Optional) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
               },
@@ -2031,7 +2031,7 @@
         "serviceAccountName": "A String", # Email address of the IAM service account associated with the revision of the service. The service account represents the identity of the running revision, and determines what permissions the revision has. If not provided, the revision will use the project's default service account.
         "timeoutSeconds": 42, # TimeoutSeconds holds the max duration the instance is allowed for responding to a request. Cloud Run fully managed: defaults to 300 seconds (5 minutes). Maximum allowed value is 3600 seconds (1 hour). Cloud Run for Anthos: defaults to 300 seconds (5 minutes). Maximum allowed value is configurable by the cluster operator.
         "volumes": [
-          { # Not supported by Cloud Run Volume represents a named volume in a container.
+          { # Volume represents a named volume in a container.
             "configMap": { # Not supported by Cloud Run Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
               "items": [ # (Optional) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -2044,7 +2044,7 @@
               "name": "A String", # Name of the config.
               "optional": True or False, # (Optional) Specify whether the Secret or its keys must be defined.
             },
-            "name": "A String", # Volume's name.
+            "name": "A String", # Volume's name. In Cloud Run Fully Managed, the name 'cloudsql' is reserved.
             "secret": { # The secret's value will be presented as the content of a file whose name is defined in the item path. If no items are defined, the name of the file is the secret_name. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0000 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. NOTE: This is an integer representation of the mode bits. So, the integer value should look exactly as the chmod numeric notation, i.e. Unix chmod "777" (a=rwx) should have the integer value 777.
               "items": [ # (Optional) If unspecified, the volume will expose a file whose name is the secret_name. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a key and a path. If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.

docs/dyn/run_v1.projects.locations.configurations.html

diff --git a/docs/dyn/run_v1.projects.locations.configurations.html b/docs/dyn/run_v1.projects.locations.configurations.html
index 5c4c818..d24f6aa 100644
--- a/docs/dyn/run_v1.projects.locations.configurations.html
+++ b/docs/dyn/run_v1.projects.locations.configurations.html
@@ -330,9 +330,9 @@
             "terminationMessagePath": "A String", # (Optional) Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log.
             "terminationMessagePolicy": "A String", # (Optional) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
             "volumeMounts": [ # (Optional) Volume to mount into the container's filesystem. Only supports SecretVolumeSources. Pod volumes to mount into the container's filesystem.
-              { # Not supported by Cloud Run VolumeMount describes a mounting of a Volume within a container.
+              { # VolumeMount describes a mounting of a Volume within a container.
                 "mountPath": "A String", # Path within the container at which the volume should be mounted. Must not contain ':'.
-                "name": "A String", # This must match the Name of a Volume.
+                "name": "A String", # The name of the volume. There must be a corresponding Volume with the same name.
                 "readOnly": True or False, # (Optional) Only true is accepted. Defaults to true.
                 "subPath": "A String", # (Optional) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
               },
@@ -343,7 +343,7 @@
         "serviceAccountName": "A String", # Email address of the IAM service account associated with the revision of the service. The service account represents the identity of the running revision, and determines what permissions the revision has. If not provided, the revision will use the project's default service account.
         "timeoutSeconds": 42, # TimeoutSeconds holds the max duration the instance is allowed for responding to a request. Cloud Run fully managed: defaults to 300 seconds (5 minutes). Maximum allowed value is 3600 seconds (1 hour). Cloud Run for Anthos: defaults to 300 seconds (5 minutes). Maximum allowed value is configurable by the cluster operator.
         "volumes": [
-          { # Not supported by Cloud Run Volume represents a named volume in a container.
+          { # Volume represents a named volume in a container.
             "configMap": { # Not supported by Cloud Run Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
               "items": [ # (Optional) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -356,7 +356,7 @@
               "name": "A String", # Name of the config.
               "optional": True or False, # (Optional) Specify whether the Secret or its keys must be defined.
             },
-            "name": "A String", # Volume's name.
+            "name": "A String", # Volume's name. In Cloud Run Fully Managed, the name 'cloudsql' is reserved.
             "secret": { # The secret's value will be presented as the content of a file whose name is defined in the item path. If no items are defined, the name of the file is the secret_name. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0000 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. NOTE: This is an integer representation of the mode bits. So, the integer value should look exactly as the chmod numeric notation, i.e. Unix chmod "777" (a=rwx) should have the integer value 777.
               "items": [ # (Optional) If unspecified, the volume will expose a file whose name is the secret_name. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a key and a path. If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -643,9 +643,9 @@
                 "terminationMessagePath": "A String", # (Optional) Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log.
                 "terminationMessagePolicy": "A String", # (Optional) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
                 "volumeMounts": [ # (Optional) Volume to mount into the container's filesystem. Only supports SecretVolumeSources. Pod volumes to mount into the container's filesystem.
-                  { # Not supported by Cloud Run VolumeMount describes a mounting of a Volume within a container.
+                  { # VolumeMount describes a mounting of a Volume within a container.
                     "mountPath": "A String", # Path within the container at which the volume should be mounted. Must not contain ':'.
-                    "name": "A String", # This must match the Name of a Volume.
+                    "name": "A String", # The name of the volume. There must be a corresponding Volume with the same name.
                     "readOnly": True or False, # (Optional) Only true is accepted. Defaults to true.
                     "subPath": "A String", # (Optional) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
                   },
@@ -656,7 +656,7 @@
             "serviceAccountName": "A String", # Email address of the IAM service account associated with the revision of the service. The service account represents the identity of the running revision, and determines what permissions the revision has. If not provided, the revision will use the project's default service account.
             "timeoutSeconds": 42, # TimeoutSeconds holds the max duration the instance is allowed for responding to a request. Cloud Run fully managed: defaults to 300 seconds (5 minutes). Maximum allowed value is 3600 seconds (1 hour). Cloud Run for Anthos: defaults to 300 seconds (5 minutes). Maximum allowed value is configurable by the cluster operator.
             "volumes": [
-              { # Not supported by Cloud Run Volume represents a named volume in a container.
+              { # Volume represents a named volume in a container.
                 "configMap": { # Not supported by Cloud Run Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
                   "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
                   "items": [ # (Optional) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -669,7 +669,7 @@
                   "name": "A String", # Name of the config.
                   "optional": True or False, # (Optional) Specify whether the Secret or its keys must be defined.
                 },
-                "name": "A String", # Volume's name.
+                "name": "A String", # Volume's name. In Cloud Run Fully Managed, the name 'cloudsql' is reserved.
                 "secret": { # The secret's value will be presented as the content of a file whose name is defined in the item path. If no items are defined, the name of the file is the secret_name. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
                   "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0000 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. NOTE: This is an integer representation of the mode bits. So, the integer value should look exactly as the chmod numeric notation, i.e. Unix chmod "777" (a=rwx) should have the integer value 777.
                   "items": [ # (Optional) If unspecified, the volume will expose a file whose name is the secret_name. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a key and a path. If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.

docs/dyn/run_v1.projects.locations.revisions.html

diff --git a/docs/dyn/run_v1.projects.locations.revisions.html b/docs/dyn/run_v1.projects.locations.revisions.html
index 92c61ee..f23951b 100644
--- a/docs/dyn/run_v1.projects.locations.revisions.html
+++ b/docs/dyn/run_v1.projects.locations.revisions.html
@@ -344,9 +344,9 @@
         "terminationMessagePath": "A String", # (Optional) Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log.
         "terminationMessagePolicy": "A String", # (Optional) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
         "volumeMounts": [ # (Optional) Volume to mount into the container's filesystem. Only supports SecretVolumeSources. Pod volumes to mount into the container's filesystem.
-          { # Not supported by Cloud Run VolumeMount describes a mounting of a Volume within a container.
+          { # VolumeMount describes a mounting of a Volume within a container.
             "mountPath": "A String", # Path within the container at which the volume should be mounted. Must not contain ':'.
-            "name": "A String", # This must match the Name of a Volume.
+            "name": "A String", # The name of the volume. There must be a corresponding Volume with the same name.
             "readOnly": True or False, # (Optional) Only true is accepted. Defaults to true.
             "subPath": "A String", # (Optional) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
           },
@@ -357,7 +357,7 @@
     "serviceAccountName": "A String", # Email address of the IAM service account associated with the revision of the service. The service account represents the identity of the running revision, and determines what permissions the revision has. If not provided, the revision will use the project's default service account.
     "timeoutSeconds": 42, # TimeoutSeconds holds the max duration the instance is allowed for responding to a request. Cloud Run fully managed: defaults to 300 seconds (5 minutes). Maximum allowed value is 3600 seconds (1 hour). Cloud Run for Anthos: defaults to 300 seconds (5 minutes). Maximum allowed value is configurable by the cluster operator.
     "volumes": [
-      { # Not supported by Cloud Run Volume represents a named volume in a container.
+      { # Volume represents a named volume in a container.
         "configMap": { # Not supported by Cloud Run Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
           "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
           "items": [ # (Optional) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -370,7 +370,7 @@
           "name": "A String", # Name of the config.
           "optional": True or False, # (Optional) Specify whether the Secret or its keys must be defined.
         },
-        "name": "A String", # Volume's name.
+        "name": "A String", # Volume's name. In Cloud Run Fully Managed, the name 'cloudsql' is reserved.
         "secret": { # The secret's value will be presented as the content of a file whose name is defined in the item path. If no items are defined, the name of the file is the secret_name. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
           "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0000 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. NOTE: This is an integer representation of the mode bits. So, the integer value should look exactly as the chmod numeric notation, i.e. Unix chmod "777" (a=rwx) should have the integer value 777.
           "items": [ # (Optional) If unspecified, the volume will expose a file whose name is the secret_name. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a key and a path. If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -622,9 +622,9 @@
             "terminationMessagePath": "A String", # (Optional) Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log.
             "terminationMessagePolicy": "A String", # (Optional) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
             "volumeMounts": [ # (Optional) Volume to mount into the container's filesystem. Only supports SecretVolumeSources. Pod volumes to mount into the container's filesystem.
-              { # Not supported by Cloud Run VolumeMount describes a mounting of a Volume within a container.
+              { # VolumeMount describes a mounting of a Volume within a container.
                 "mountPath": "A String", # Path within the container at which the volume should be mounted. Must not contain ':'.
-                "name": "A String", # This must match the Name of a Volume.
+                "name": "A String", # The name of the volume. There must be a corresponding Volume with the same name.
                 "readOnly": True or False, # (Optional) Only true is accepted. Defaults to true.
                 "subPath": "A String", # (Optional) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
               },
@@ -635,7 +635,7 @@
         "serviceAccountName": "A String", # Email address of the IAM service account associated with the revision of the service. The service account represents the identity of the running revision, and determines what permissions the revision has. If not provided, the revision will use the project's default service account.
         "timeoutSeconds": 42, # TimeoutSeconds holds the max duration the instance is allowed for responding to a request. Cloud Run fully managed: defaults to 300 seconds (5 minutes). Maximum allowed value is 3600 seconds (1 hour). Cloud Run for Anthos: defaults to 300 seconds (5 minutes). Maximum allowed value is configurable by the cluster operator.
         "volumes": [
-          { # Not supported by Cloud Run Volume represents a named volume in a container.
+          { # Volume represents a named volume in a container.
             "configMap": { # Not supported by Cloud Run Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
               "items": [ # (Optional) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -648,7 +648,7 @@
               "name": "A String", # Name of the config.
               "optional": True or False, # (Optional) Specify whether the Secret or its keys must be defined.
             },
-            "name": "A String", # Volume's name.
+            "name": "A String", # Volume's name. In Cloud Run Fully Managed, the name 'cloudsql' is reserved.
             "secret": { # The secret's value will be presented as the content of a file whose name is defined in the item path. If no items are defined, the name of the file is the secret_name. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0000 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. NOTE: This is an integer representation of the mode bits. So, the integer value should look exactly as the chmod numeric notation, i.e. Unix chmod "777" (a=rwx) should have the integer value 777.
               "items": [ # (Optional) If unspecified, the volume will expose a file whose name is the secret_name. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a key and a path. If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.

docs/dyn/run_v1.projects.locations.services.html

diff --git a/docs/dyn/run_v1.projects.locations.services.html b/docs/dyn/run_v1.projects.locations.services.html
index 429e849..6d0d191 100644
--- a/docs/dyn/run_v1.projects.locations.services.html
+++ b/docs/dyn/run_v1.projects.locations.services.html
@@ -343,9 +343,9 @@
             "terminationMessagePath": "A String", # (Optional) Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log.
             "terminationMessagePolicy": "A String", # (Optional) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
             "volumeMounts": [ # (Optional) Volume to mount into the container's filesystem. Only supports SecretVolumeSources. Pod volumes to mount into the container's filesystem.
-              { # Not supported by Cloud Run VolumeMount describes a mounting of a Volume within a container.
+              { # VolumeMount describes a mounting of a Volume within a container.
                 "mountPath": "A String", # Path within the container at which the volume should be mounted. Must not contain ':'.
-                "name": "A String", # This must match the Name of a Volume.
+                "name": "A String", # The name of the volume. There must be a corresponding Volume with the same name.
                 "readOnly": True or False, # (Optional) Only true is accepted. Defaults to true.
                 "subPath": "A String", # (Optional) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
               },
@@ -356,7 +356,7 @@
         "serviceAccountName": "A String", # Email address of the IAM service account associated with the revision of the service. The service account represents the identity of the running revision, and determines what permissions the revision has. If not provided, the revision will use the project's default service account.
         "timeoutSeconds": 42, # TimeoutSeconds holds the max duration the instance is allowed for responding to a request. Cloud Run fully managed: defaults to 300 seconds (5 minutes). Maximum allowed value is 3600 seconds (1 hour). Cloud Run for Anthos: defaults to 300 seconds (5 minutes). Maximum allowed value is configurable by the cluster operator.
         "volumes": [
-          { # Not supported by Cloud Run Volume represents a named volume in a container.
+          { # Volume represents a named volume in a container.
             "configMap": { # Not supported by Cloud Run Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
               "items": [ # (Optional) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -369,7 +369,7 @@
               "name": "A String", # Name of the config.
               "optional": True or False, # (Optional) Specify whether the Secret or its keys must be defined.
             },
-            "name": "A String", # Volume's name.
+            "name": "A String", # Volume's name. In Cloud Run Fully Managed, the name 'cloudsql' is reserved.
             "secret": { # The secret's value will be presented as the content of a file whose name is defined in the item path. If no items are defined, the name of the file is the secret_name. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0000 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. NOTE: This is an integer representation of the mode bits. So, the integer value should look exactly as the chmod numeric notation, i.e. Unix chmod "777" (a=rwx) should have the integer value 777.
               "items": [ # (Optional) If unspecified, the volume will expose a file whose name is the secret_name. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a key and a path. If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -664,9 +664,9 @@
             "terminationMessagePath": "A String", # (Optional) Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log.
             "terminationMessagePolicy": "A String", # (Optional) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
             "volumeMounts": [ # (Optional) Volume to mount into the container's filesystem. Only supports SecretVolumeSources. Pod volumes to mount into the container's filesystem.
-              { # Not supported by Cloud Run VolumeMount describes a mounting of a Volume within a container.
+              { # VolumeMount describes a mounting of a Volume within a container.
                 "mountPath": "A String", # Path within the container at which the volume should be mounted. Must not contain ':'.
-                "name": "A String", # This must match the Name of a Volume.
+                "name": "A String", # The name of the volume. There must be a corresponding Volume with the same name.
                 "readOnly": True or False, # (Optional) Only true is accepted. Defaults to true.
                 "subPath": "A String", # (Optional) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
               },
@@ -677,7 +677,7 @@
         "serviceAccountName": "A String", # Email address of the IAM service account associated with the revision of the service. The service account represents the identity of the running revision, and determines what permissions the revision has. If not provided, the revision will use the project's default service account.
         "timeoutSeconds": 42, # TimeoutSeconds holds the max duration the instance is allowed for responding to a request. Cloud Run fully managed: defaults to 300 seconds (5 minutes). Maximum allowed value is 3600 seconds (1 hour). Cloud Run for Anthos: defaults to 300 seconds (5 minutes). Maximum allowed value is configurable by the cluster operator.
         "volumes": [
-          { # Not supported by Cloud Run Volume represents a named volume in a container.
+          { # Volume represents a named volume in a container.
             "configMap": { # Not supported by Cloud Run Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
               "items": [ # (Optional) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -690,7 +690,7 @@
               "name": "A String", # Name of the config.
               "optional": True or False, # (Optional) Specify whether the Secret or its keys must be defined.
             },
-            "name": "A String", # Volume's name.
+            "name": "A String", # Volume's name. In Cloud Run Fully Managed, the name 'cloudsql' is reserved.
             "secret": { # The secret's value will be presented as the content of a file whose name is defined in the item path. If no items are defined, the name of the file is the secret_name. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0000 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. NOTE: This is an integer representation of the mode bits. So, the integer value should look exactly as the chmod numeric notation, i.e. Unix chmod "777" (a=rwx) should have the integer value 777.
               "items": [ # (Optional) If unspecified, the volume will expose a file whose name is the secret_name. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a key and a path. If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -1036,9 +1036,9 @@
             "terminationMessagePath": "A String", # (Optional) Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log.
             "terminationMessagePolicy": "A String", # (Optional) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
             "volumeMounts": [ # (Optional) Volume to mount into the container's filesystem. Only supports SecretVolumeSources. Pod volumes to mount into the container's filesystem.
-              { # Not supported by Cloud Run VolumeMount describes a mounting of a Volume within a container.
+              { # VolumeMount describes a mounting of a Volume within a container.
                 "mountPath": "A String", # Path within the container at which the volume should be mounted. Must not contain ':'.
-                "name": "A String", # This must match the Name of a Volume.
+                "name": "A String", # The name of the volume. There must be a corresponding Volume with the same name.
                 "readOnly": True or False, # (Optional) Only true is accepted. Defaults to true.
                 "subPath": "A String", # (Optional) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
               },
@@ -1049,7 +1049,7 @@
         "serviceAccountName": "A String", # Email address of the IAM service account associated with the revision of the service. The service account represents the identity of the running revision, and determines what permissions the revision has. If not provided, the revision will use the project's default service account.
         "timeoutSeconds": 42, # TimeoutSeconds holds the max duration the instance is allowed for responding to a request. Cloud Run fully managed: defaults to 300 seconds (5 minutes). Maximum allowed value is 3600 seconds (1 hour). Cloud Run for Anthos: defaults to 300 seconds (5 minutes). Maximum allowed value is configurable by the cluster operator.
         "volumes": [
-          { # Not supported by Cloud Run Volume represents a named volume in a container.
+          { # Volume represents a named volume in a container.
             "configMap": { # Not supported by Cloud Run Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
               "items": [ # (Optional) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -1062,7 +1062,7 @@
               "name": "A String", # Name of the config.
               "optional": True or False, # (Optional) Specify whether the Secret or its keys must be defined.
             },
-            "name": "A String", # Volume's name.
+            "name": "A String", # Volume's name. In Cloud Run Fully Managed, the name 'cloudsql' is reserved.
             "secret": { # The secret's value will be presented as the content of a file whose name is defined in the item path. If no items are defined, the name of the file is the secret_name. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0000 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. NOTE: This is an integer representation of the mode bits. So, the integer value should look exactly as the chmod numeric notation, i.e. Unix chmod "777" (a=rwx) should have the integer value 777.
               "items": [ # (Optional) If unspecified, the volume will expose a file whose name is the secret_name. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a key and a path. If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -1137,7 +1137,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -1421,9 +1421,9 @@
                 "terminationMessagePath": "A String", # (Optional) Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log.
                 "terminationMessagePolicy": "A String", # (Optional) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
                 "volumeMounts": [ # (Optional) Volume to mount into the container's filesystem. Only supports SecretVolumeSources. Pod volumes to mount into the container's filesystem.
-                  { # Not supported by Cloud Run VolumeMount describes a mounting of a Volume within a container.
+                  { # VolumeMount describes a mounting of a Volume within a container.
                     "mountPath": "A String", # Path within the container at which the volume should be mounted. Must not contain ':'.
-                    "name": "A String", # This must match the Name of a Volume.
+                    "name": "A String", # The name of the volume. There must be a corresponding Volume with the same name.
                     "readOnly": True or False, # (Optional) Only true is accepted. Defaults to true.
                     "subPath": "A String", # (Optional) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
                   },
@@ -1434,7 +1434,7 @@
             "serviceAccountName": "A String", # Email address of the IAM service account associated with the revision of the service. The service account represents the identity of the running revision, and determines what permissions the revision has. If not provided, the revision will use the project's default service account.
             "timeoutSeconds": 42, # TimeoutSeconds holds the max duration the instance is allowed for responding to a request. Cloud Run fully managed: defaults to 300 seconds (5 minutes). Maximum allowed value is 3600 seconds (1 hour). Cloud Run for Anthos: defaults to 300 seconds (5 minutes). Maximum allowed value is configurable by the cluster operator.
             "volumes": [
-              { # Not supported by Cloud Run Volume represents a named volume in a container.
+              { # Volume represents a named volume in a container.
                 "configMap": { # Not supported by Cloud Run Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
                   "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
                   "items": [ # (Optional) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -1447,7 +1447,7 @@
                   "name": "A String", # Name of the config.
                   "optional": True or False, # (Optional) Specify whether the Secret or its keys must be defined.
                 },
-                "name": "A String", # Volume's name.
+                "name": "A String", # Volume's name. In Cloud Run Fully Managed, the name 'cloudsql' is reserved.
                 "secret": { # The secret's value will be presented as the content of a file whose name is defined in the item path. If no items are defined, the name of the file is the secret_name. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
                   "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0000 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. NOTE: This is an integer representation of the mode bits. So, the integer value should look exactly as the chmod numeric notation, i.e. Unix chmod "777" (a=rwx) should have the integer value 777.
                   "items": [ # (Optional) If unspecified, the volume will expose a file whose name is the secret_name. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a key and a path. If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -1754,9 +1754,9 @@
             "terminationMessagePath": "A String", # (Optional) Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log.
             "terminationMessagePolicy": "A String", # (Optional) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
             "volumeMounts": [ # (Optional) Volume to mount into the container's filesystem. Only supports SecretVolumeSources. Pod volumes to mount into the container's filesystem.
-              { # Not supported by Cloud Run VolumeMount describes a mounting of a Volume within a container.
+              { # VolumeMount describes a mounting of a Volume within a container.
                 "mountPath": "A String", # Path within the container at which the volume should be mounted. Must not contain ':'.
-                "name": "A String", # This must match the Name of a Volume.
+                "name": "A String", # The name of the volume. There must be a corresponding Volume with the same name.
                 "readOnly": True or False, # (Optional) Only true is accepted. Defaults to true.
                 "subPath": "A String", # (Optional) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
               },
@@ -1767,7 +1767,7 @@
         "serviceAccountName": "A String", # Email address of the IAM service account associated with the revision of the service. The service account represents the identity of the running revision, and determines what permissions the revision has. If not provided, the revision will use the project's default service account.
         "timeoutSeconds": 42, # TimeoutSeconds holds the max duration the instance is allowed for responding to a request. Cloud Run fully managed: defaults to 300 seconds (5 minutes). Maximum allowed value is 3600 seconds (1 hour). Cloud Run for Anthos: defaults to 300 seconds (5 minutes). Maximum allowed value is configurable by the cluster operator.
         "volumes": [
-          { # Not supported by Cloud Run Volume represents a named volume in a container.
+          { # Volume represents a named volume in a container.
             "configMap": { # Not supported by Cloud Run Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
               "items": [ # (Optional) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -1780,7 +1780,7 @@
               "name": "A String", # Name of the config.
               "optional": True or False, # (Optional) Specify whether the Secret or its keys must be defined.
             },
-            "name": "A String", # Volume's name.
+            "name": "A String", # Volume's name. In Cloud Run Fully Managed, the name 'cloudsql' is reserved.
             "secret": { # The secret's value will be presented as the content of a file whose name is defined in the item path. If no items are defined, the name of the file is the secret_name. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0000 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. NOTE: This is an integer representation of the mode bits. So, the integer value should look exactly as the chmod numeric notation, i.e. Unix chmod "777" (a=rwx) should have the integer value 777.
               "items": [ # (Optional) If unspecified, the volume will expose a file whose name is the secret_name. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a key and a path. If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -2075,9 +2075,9 @@
             "terminationMessagePath": "A String", # (Optional) Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log.
             "terminationMessagePolicy": "A String", # (Optional) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
             "volumeMounts": [ # (Optional) Volume to mount into the container's filesystem. Only supports SecretVolumeSources. Pod volumes to mount into the container's filesystem.
-              { # Not supported by Cloud Run VolumeMount describes a mounting of a Volume within a container.
+              { # VolumeMount describes a mounting of a Volume within a container.
                 "mountPath": "A String", # Path within the container at which the volume should be mounted. Must not contain ':'.
-                "name": "A String", # This must match the Name of a Volume.
+                "name": "A String", # The name of the volume. There must be a corresponding Volume with the same name.
                 "readOnly": True or False, # (Optional) Only true is accepted. Defaults to true.
                 "subPath": "A String", # (Optional) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
               },
@@ -2088,7 +2088,7 @@
         "serviceAccountName": "A String", # Email address of the IAM service account associated with the revision of the service. The service account represents the identity of the running revision, and determines what permissions the revision has. If not provided, the revision will use the project's default service account.
         "timeoutSeconds": 42, # TimeoutSeconds holds the max duration the instance is allowed for responding to a request. Cloud Run fully managed: defaults to 300 seconds (5 minutes). Maximum allowed value is 3600 seconds (1 hour). Cloud Run for Anthos: defaults to 300 seconds (5 minutes). Maximum allowed value is configurable by the cluster operator.
         "volumes": [
-          { # Not supported by Cloud Run Volume represents a named volume in a container.
+          { # Volume represents a named volume in a container.
             "configMap": { # Not supported by Cloud Run Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
               "items": [ # (Optional) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -2101,7 +2101,7 @@
               "name": "A String", # Name of the config.
               "optional": True or False, # (Optional) Specify whether the Secret or its keys must be defined.
             },
-            "name": "A String", # Volume's name.
+            "name": "A String", # Volume's name. In Cloud Run Fully Managed, the name 'cloudsql' is reserved.
             "secret": { # The secret's value will be presented as the content of a file whose name is defined in the item path. If no items are defined, the name of the file is the secret_name. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0000 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. NOTE: This is an integer representation of the mode bits. So, the integer value should look exactly as the chmod numeric notation, i.e. Unix chmod "777" (a=rwx) should have the integer value 777.
               "items": [ # (Optional) If unspecified, the volume will expose a file whose name is the secret_name. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a key and a path. If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -2171,7 +2171,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -2213,7 +2213,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/run_v1alpha1.namespaces.jobs.html

diff --git a/docs/dyn/run_v1alpha1.namespaces.jobs.html b/docs/dyn/run_v1alpha1.namespaces.jobs.html
index d0ca340..2337755 100644
--- a/docs/dyn/run_v1alpha1.namespaces.jobs.html
+++ b/docs/dyn/run_v1alpha1.namespaces.jobs.html
@@ -303,9 +303,9 @@
             "terminationMessagePath": "A String", # (Optional) Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log.
             "terminationMessagePolicy": "A String", # (Optional) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
             "volumeMounts": [ # (Optional) Volume to mount into the container's filesystem. Only supports SecretVolumeSources. Pod volumes to mount into the container's filesystem.
-              { # Not supported by Cloud Run VolumeMount describes a mounting of a Volume within a container.
+              { # VolumeMount describes a mounting of a Volume within a container.
                 "mountPath": "A String", # Path within the container at which the volume should be mounted. Must not contain ':'.
-                "name": "A String", # This must match the Name of a Volume.
+                "name": "A String", # The name of the volume. There must be a corresponding Volume with the same name.
                 "readOnly": True or False, # (Optional) Only true is accepted. Defaults to true.
                 "subPath": "A String", # (Optional) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
               },
@@ -317,7 +317,7 @@
         "serviceAccountName": "A String", # Optional. Email address of the IAM service account associated with the instance of a Job. The service account represents the identity of the running instance, and determines what permissions the instance has. If not provided, the instance will use the project's default service account. +optional
         "terminationGracePeriodSeconds": "A String", # Optional. Optional duration in seconds the instance needs to terminate gracefully. Value must be non-negative integer. The value zero indicates delete immediately. The grace period is the duration in seconds after the processes running in the instance are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. +optional
         "volumes": [ # Optional. List of volumes that can be mounted by containers belonging to the instance. More info: https://kubernetes.io/docs/concepts/storage/volumes +optional
-          { # Not supported by Cloud Run Volume represents a named volume in a container.
+          { # Volume represents a named volume in a container.
             "configMap": { # Not supported by Cloud Run Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
               "items": [ # (Optional) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -330,7 +330,7 @@
               "name": "A String", # Name of the config.
               "optional": True or False, # (Optional) Specify whether the Secret or its keys must be defined.
             },
-            "name": "A String", # Volume's name.
+            "name": "A String", # Volume's name. In Cloud Run Fully Managed, the name 'cloudsql' is reserved.
             "secret": { # The secret's value will be presented as the content of a file whose name is defined in the item path. If no items are defined, the name of the file is the secret_name. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0000 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. NOTE: This is an integer representation of the mode bits. So, the integer value should look exactly as the chmod numeric notation, i.e. Unix chmod "777" (a=rwx) should have the integer value 777.
               "items": [ # (Optional) If unspecified, the volume will expose a file whose name is the secret_name. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a key and a path. If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -588,9 +588,9 @@
             "terminationMessagePath": "A String", # (Optional) Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log.
             "terminationMessagePolicy": "A String", # (Optional) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
             "volumeMounts": [ # (Optional) Volume to mount into the container's filesystem. Only supports SecretVolumeSources. Pod volumes to mount into the container's filesystem.
-              { # Not supported by Cloud Run VolumeMount describes a mounting of a Volume within a container.
+              { # VolumeMount describes a mounting of a Volume within a container.
                 "mountPath": "A String", # Path within the container at which the volume should be mounted. Must not contain ':'.
-                "name": "A String", # This must match the Name of a Volume.
+                "name": "A String", # The name of the volume. There must be a corresponding Volume with the same name.
                 "readOnly": True or False, # (Optional) Only true is accepted. Defaults to true.
                 "subPath": "A String", # (Optional) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
               },
@@ -602,7 +602,7 @@
         "serviceAccountName": "A String", # Optional. Email address of the IAM service account associated with the instance of a Job. The service account represents the identity of the running instance, and determines what permissions the instance has. If not provided, the instance will use the project's default service account. +optional
         "terminationGracePeriodSeconds": "A String", # Optional. Optional duration in seconds the instance needs to terminate gracefully. Value must be non-negative integer. The value zero indicates delete immediately. The grace period is the duration in seconds after the processes running in the instance are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. +optional
         "volumes": [ # Optional. List of volumes that can be mounted by containers belonging to the instance. More info: https://kubernetes.io/docs/concepts/storage/volumes +optional
-          { # Not supported by Cloud Run Volume represents a named volume in a container.
+          { # Volume represents a named volume in a container.
             "configMap": { # Not supported by Cloud Run Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
               "items": [ # (Optional) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -615,7 +615,7 @@
               "name": "A String", # Name of the config.
               "optional": True or False, # (Optional) Specify whether the Secret or its keys must be defined.
             },
-            "name": "A String", # Volume's name.
+            "name": "A String", # Volume's name. In Cloud Run Fully Managed, the name 'cloudsql' is reserved.
             "secret": { # The secret's value will be presented as the content of a file whose name is defined in the item path. If no items are defined, the name of the file is the secret_name. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0000 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. NOTE: This is an integer representation of the mode bits. So, the integer value should look exactly as the chmod numeric notation, i.e. Unix chmod "777" (a=rwx) should have the integer value 777.
               "items": [ # (Optional) If unspecified, the volume will expose a file whose name is the secret_name. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a key and a path. If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -901,9 +901,9 @@
             "terminationMessagePath": "A String", # (Optional) Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log.
             "terminationMessagePolicy": "A String", # (Optional) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
             "volumeMounts": [ # (Optional) Volume to mount into the container's filesystem. Only supports SecretVolumeSources. Pod volumes to mount into the container's filesystem.
-              { # Not supported by Cloud Run VolumeMount describes a mounting of a Volume within a container.
+              { # VolumeMount describes a mounting of a Volume within a container.
                 "mountPath": "A String", # Path within the container at which the volume should be mounted. Must not contain ':'.
-                "name": "A String", # This must match the Name of a Volume.
+                "name": "A String", # The name of the volume. There must be a corresponding Volume with the same name.
                 "readOnly": True or False, # (Optional) Only true is accepted. Defaults to true.
                 "subPath": "A String", # (Optional) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
               },
@@ -915,7 +915,7 @@
         "serviceAccountName": "A String", # Optional. Email address of the IAM service account associated with the instance of a Job. The service account represents the identity of the running instance, and determines what permissions the instance has. If not provided, the instance will use the project's default service account. +optional
         "terminationGracePeriodSeconds": "A String", # Optional. Optional duration in seconds the instance needs to terminate gracefully. Value must be non-negative integer. The value zero indicates delete immediately. The grace period is the duration in seconds after the processes running in the instance are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. +optional
         "volumes": [ # Optional. List of volumes that can be mounted by containers belonging to the instance. More info: https://kubernetes.io/docs/concepts/storage/volumes +optional
-          { # Not supported by Cloud Run Volume represents a named volume in a container.
+          { # Volume represents a named volume in a container.
             "configMap": { # Not supported by Cloud Run Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
               "items": [ # (Optional) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -928,7 +928,7 @@
               "name": "A String", # Name of the config.
               "optional": True or False, # (Optional) Specify whether the Secret or its keys must be defined.
             },
-            "name": "A String", # Volume's name.
+            "name": "A String", # Volume's name. In Cloud Run Fully Managed, the name 'cloudsql' is reserved.
             "secret": { # The secret's value will be presented as the content of a file whose name is defined in the item path. If no items are defined, the name of the file is the secret_name. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
               "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0000 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. NOTE: This is an integer representation of the mode bits. So, the integer value should look exactly as the chmod numeric notation, i.e. Unix chmod "777" (a=rwx) should have the integer value 777.
               "items": [ # (Optional) If unspecified, the volume will expose a file whose name is the secret_name. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a key and a path. If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -1203,9 +1203,9 @@
                 "terminationMessagePath": "A String", # (Optional) Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log.
                 "terminationMessagePolicy": "A String", # (Optional) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
                 "volumeMounts": [ # (Optional) Volume to mount into the container's filesystem. Only supports SecretVolumeSources. Pod volumes to mount into the container's filesystem.
-                  { # Not supported by Cloud Run VolumeMount describes a mounting of a Volume within a container.
+                  { # VolumeMount describes a mounting of a Volume within a container.
                     "mountPath": "A String", # Path within the container at which the volume should be mounted. Must not contain ':'.
-                    "name": "A String", # This must match the Name of a Volume.
+                    "name": "A String", # The name of the volume. There must be a corresponding Volume with the same name.
                     "readOnly": True or False, # (Optional) Only true is accepted. Defaults to true.
                     "subPath": "A String", # (Optional) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
                   },
@@ -1217,7 +1217,7 @@
             "serviceAccountName": "A String", # Optional. Email address of the IAM service account associated with the instance of a Job. The service account represents the identity of the running instance, and determines what permissions the instance has. If not provided, the instance will use the project's default service account. +optional
             "terminationGracePeriodSeconds": "A String", # Optional. Optional duration in seconds the instance needs to terminate gracefully. Value must be non-negative integer. The value zero indicates delete immediately. The grace period is the duration in seconds after the processes running in the instance are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. +optional
             "volumes": [ # Optional. List of volumes that can be mounted by containers belonging to the instance. More info: https://kubernetes.io/docs/concepts/storage/volumes +optional
-              { # Not supported by Cloud Run Volume represents a named volume in a container.
+              { # Volume represents a named volume in a container.
                 "configMap": { # Not supported by Cloud Run Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
                   "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
                   "items": [ # (Optional) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.
@@ -1230,7 +1230,7 @@
                   "name": "A String", # Name of the config.
                   "optional": True or False, # (Optional) Specify whether the Secret or its keys must be defined.
                 },
-                "name": "A String", # Volume's name.
+                "name": "A String", # Volume's name. In Cloud Run Fully Managed, the name 'cloudsql' is reserved.
                 "secret": { # The secret's value will be presented as the content of a file whose name is defined in the item path. If no items are defined, the name of the file is the secret_name. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
                   "defaultMode": 42, # (Optional) Mode bits to use on created files by default. Must be a value between 0000 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. NOTE: This is an integer representation of the mode bits. So, the integer value should look exactly as the chmod numeric notation, i.e. Unix chmod "777" (a=rwx) should have the integer value 777.
                   "items": [ # (Optional) If unspecified, the volume will expose a file whose name is the secret_name. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a key and a path. If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified that is not present in the Secret, the volume setup will error unless it is marked optional.

docs/dyn/secretmanager_v1.projects.secrets.html

diff --git a/docs/dyn/secretmanager_v1.projects.secrets.html b/docs/dyn/secretmanager_v1.projects.secrets.html
index 96885eb..3ccf078 100644
--- a/docs/dyn/secretmanager_v1.projects.secrets.html
+++ b/docs/dyn/secretmanager_v1.projects.secrets.html
@@ -346,7 +346,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -557,7 +557,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -599,7 +599,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/secretmanager_v1beta1.projects.secrets.html

diff --git a/docs/dyn/secretmanager_v1beta1.projects.secrets.html b/docs/dyn/secretmanager_v1beta1.projects.secrets.html
index e4e507e..5ffee97 100644
--- a/docs/dyn/secretmanager_v1beta1.projects.secrets.html
+++ b/docs/dyn/secretmanager_v1beta1.projects.secrets.html
@@ -273,7 +273,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -429,7 +429,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -471,7 +471,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/securitycenter_v1.folders.sources.findings.html

diff --git a/docs/dyn/securitycenter_v1.folders.sources.findings.html b/docs/dyn/securitycenter_v1.folders.sources.findings.html
index 0f94527..d4dee82 100644
--- a/docs/dyn/securitycenter_v1.folders.sources.findings.html
+++ b/docs/dyn/securitycenter_v1.folders.sources.findings.html
@@ -213,6 +213,28 @@
           "a_key": "",
         },
         "state": "A String", # The state of the finding.
+        "vulnerability": { # Refers to common vulnerability fields e.g. cve, cvss, cwe etc. # Represents vulnerability specific fields like cve, cvss scores etc. CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+          "cve": { # CVE stands for Common Vulnerabilities and Exposures. More information: https://cve.mitre.org # CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+            "cvssv3": { # Common Vulnerability Scoring System version 3. # Describe Common Vulnerability Scoring System specified at https://www.first.org/cvss/v3.1/specification-document
+              "attackComplexity": "A String", # This metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability.
+              "attackVector": "A String", # Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments. This metric reflects the context by which vulnerability exploitation is possible.
+              "availabilityImpact": "A String", # This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.
+              "baseScore": 3.14, # The base score is a function of the base metric scores.
+              "confidentialityImpact": "A String", # This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.
+              "integrityImpact": "A String", # This metric measures the impact to integrity of a successfully exploited vulnerability.
+              "privilegesRequired": "A String", # This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.
+              "scope": "A String", # The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.
+              "userInteraction": "A String", # This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.
+            },
+            "id": "A String", # The unique identifier for the vulnerability. e.g. CVE-2021-34527
+            "references": [ # Additional information about the CVE. e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527
+              { # Additional Links
+                "source": "A String", # Source of the reference e.g. NVD
+                "uri": "A String", # Uri for the mentioned source e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527.
+              },
+            ],
+          },
+        },
       },
       "resource": { # Information related to the Google Cloud resource that is associated with this finding. # Output only. Resource that is associated with this finding.
         "folders": [ # Contains a Folder message for each folder in the assets ancestry. The first folder is the deepest nested folder, and the last folder is the folder directly under the Organization.
@@ -289,6 +311,28 @@
     "a_key": "",
   },
   "state": "A String", # The state of the finding.
+  "vulnerability": { # Refers to common vulnerability fields e.g. cve, cvss, cwe etc. # Represents vulnerability specific fields like cve, cvss scores etc. CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+    "cve": { # CVE stands for Common Vulnerabilities and Exposures. More information: https://cve.mitre.org # CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+      "cvssv3": { # Common Vulnerability Scoring System version 3. # Describe Common Vulnerability Scoring System specified at https://www.first.org/cvss/v3.1/specification-document
+        "attackComplexity": "A String", # This metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability.
+        "attackVector": "A String", # Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments. This metric reflects the context by which vulnerability exploitation is possible.
+        "availabilityImpact": "A String", # This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.
+        "baseScore": 3.14, # The base score is a function of the base metric scores.
+        "confidentialityImpact": "A String", # This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.
+        "integrityImpact": "A String", # This metric measures the impact to integrity of a successfully exploited vulnerability.
+        "privilegesRequired": "A String", # This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.
+        "scope": "A String", # The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.
+        "userInteraction": "A String", # This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.
+      },
+      "id": "A String", # The unique identifier for the vulnerability. e.g. CVE-2021-34527
+      "references": [ # Additional information about the CVE. e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527
+        { # Additional Links
+          "source": "A String", # Source of the reference e.g. NVD
+          "uri": "A String", # Uri for the mentioned source e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527.
+        },
+      ],
+    },
+  },
 }
 
   updateMask: string, The FieldMask to use when updating the finding resource. This field should not be specified when creating a finding. When updating a finding, an empty mask is treated as updating all mutable fields and replacing source_properties. Individual source_properties can be added/updated by using "source_properties." in the field mask.
@@ -330,6 +374,28 @@
     "a_key": "",
   },
   "state": "A String", # The state of the finding.
+  "vulnerability": { # Refers to common vulnerability fields e.g. cve, cvss, cwe etc. # Represents vulnerability specific fields like cve, cvss scores etc. CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+    "cve": { # CVE stands for Common Vulnerabilities and Exposures. More information: https://cve.mitre.org # CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+      "cvssv3": { # Common Vulnerability Scoring System version 3. # Describe Common Vulnerability Scoring System specified at https://www.first.org/cvss/v3.1/specification-document
+        "attackComplexity": "A String", # This metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability.
+        "attackVector": "A String", # Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments. This metric reflects the context by which vulnerability exploitation is possible.
+        "availabilityImpact": "A String", # This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.
+        "baseScore": 3.14, # The base score is a function of the base metric scores.
+        "confidentialityImpact": "A String", # This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.
+        "integrityImpact": "A String", # This metric measures the impact to integrity of a successfully exploited vulnerability.
+        "privilegesRequired": "A String", # This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.
+        "scope": "A String", # The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.
+        "userInteraction": "A String", # This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.
+      },
+      "id": "A String", # The unique identifier for the vulnerability. e.g. CVE-2021-34527
+      "references": [ # Additional information about the CVE. e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527
+        { # Additional Links
+          "source": "A String", # Source of the reference e.g. NVD
+          "uri": "A String", # Uri for the mentioned source e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527.
+        },
+      ],
+    },
+  },
 }</pre>
 </div>
 
@@ -385,6 +451,28 @@
     &quot;a_key&quot;: &quot;&quot;,
   },
   &quot;state&quot;: &quot;A String&quot;, # The state of the finding.
+  &quot;vulnerability&quot;: { # Refers to common vulnerability fields e.g. cve, cvss, cwe etc. # Represents vulnerability specific fields like cve, cvss scores etc. CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+    &quot;cve&quot;: { # CVE stands for Common Vulnerabilities and Exposures. More information: https://cve.mitre.org # CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+      &quot;cvssv3&quot;: { # Common Vulnerability Scoring System version 3. # Describe Common Vulnerability Scoring System specified at https://www.first.org/cvss/v3.1/specification-document
+        &quot;attackComplexity&quot;: &quot;A String&quot;, # This metric describes the conditions beyond the attacker&#x27;s control that must exist in order to exploit the vulnerability.
+        &quot;attackVector&quot;: &quot;A String&quot;, # Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments. This metric reflects the context by which vulnerability exploitation is possible.
+        &quot;availabilityImpact&quot;: &quot;A String&quot;, # This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.
+        &quot;baseScore&quot;: 3.14, # The base score is a function of the base metric scores.
+        &quot;confidentialityImpact&quot;: &quot;A String&quot;, # This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.
+        &quot;integrityImpact&quot;: &quot;A String&quot;, # This metric measures the impact to integrity of a successfully exploited vulnerability.
+        &quot;privilegesRequired&quot;: &quot;A String&quot;, # This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.
+        &quot;scope&quot;: &quot;A String&quot;, # The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.
+        &quot;userInteraction&quot;: &quot;A String&quot;, # This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.
+      },
+      &quot;id&quot;: &quot;A String&quot;, # The unique identifier for the vulnerability. e.g. CVE-2021-34527
+      &quot;references&quot;: [ # Additional information about the CVE. e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527
+        { # Additional Links
+          &quot;source&quot;: &quot;A String&quot;, # Source of the reference e.g. NVD
+          &quot;uri&quot;: &quot;A String&quot;, # Uri for the mentioned source e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527.
+        },
+      ],
+    },
+  },
 }</pre>
 </div>
 

docs/dyn/securitycenter_v1.organizations.sources.findings.html

diff --git a/docs/dyn/securitycenter_v1.organizations.sources.findings.html b/docs/dyn/securitycenter_v1.organizations.sources.findings.html
index f9f7580..4beea90 100644
--- a/docs/dyn/securitycenter_v1.organizations.sources.findings.html
+++ b/docs/dyn/securitycenter_v1.organizations.sources.findings.html
@@ -146,6 +146,28 @@
     "a_key": "",
   },
   "state": "A String", # The state of the finding.
+  "vulnerability": { # Refers to common vulnerability fields e.g. cve, cvss, cwe etc. # Represents vulnerability specific fields like cve, cvss scores etc. CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+    "cve": { # CVE stands for Common Vulnerabilities and Exposures. More information: https://cve.mitre.org # CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+      "cvssv3": { # Common Vulnerability Scoring System version 3. # Describe Common Vulnerability Scoring System specified at https://www.first.org/cvss/v3.1/specification-document
+        "attackComplexity": "A String", # This metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability.
+        "attackVector": "A String", # Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments. This metric reflects the context by which vulnerability exploitation is possible.
+        "availabilityImpact": "A String", # This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.
+        "baseScore": 3.14, # The base score is a function of the base metric scores.
+        "confidentialityImpact": "A String", # This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.
+        "integrityImpact": "A String", # This metric measures the impact to integrity of a successfully exploited vulnerability.
+        "privilegesRequired": "A String", # This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.
+        "scope": "A String", # The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.
+        "userInteraction": "A String", # This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.
+      },
+      "id": "A String", # The unique identifier for the vulnerability. e.g. CVE-2021-34527
+      "references": [ # Additional information about the CVE. e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527
+        { # Additional Links
+          "source": "A String", # Source of the reference e.g. NVD
+          "uri": "A String", # Uri for the mentioned source e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527.
+        },
+      ],
+    },
+  },
 }
 
   findingId: string, Required. Unique identifier provided by the client within the parent scope. It must be alphanumeric and less than or equal to 32 characters and greater than 0 characters in length.
@@ -187,6 +209,28 @@
     "a_key": "",
   },
   "state": "A String", # The state of the finding.
+  "vulnerability": { # Refers to common vulnerability fields e.g. cve, cvss, cwe etc. # Represents vulnerability specific fields like cve, cvss scores etc. CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+    "cve": { # CVE stands for Common Vulnerabilities and Exposures. More information: https://cve.mitre.org # CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+      "cvssv3": { # Common Vulnerability Scoring System version 3. # Describe Common Vulnerability Scoring System specified at https://www.first.org/cvss/v3.1/specification-document
+        "attackComplexity": "A String", # This metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability.
+        "attackVector": "A String", # Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments. This metric reflects the context by which vulnerability exploitation is possible.
+        "availabilityImpact": "A String", # This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.
+        "baseScore": 3.14, # The base score is a function of the base metric scores.
+        "confidentialityImpact": "A String", # This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.
+        "integrityImpact": "A String", # This metric measures the impact to integrity of a successfully exploited vulnerability.
+        "privilegesRequired": "A String", # This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.
+        "scope": "A String", # The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.
+        "userInteraction": "A String", # This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.
+      },
+      "id": "A String", # The unique identifier for the vulnerability. e.g. CVE-2021-34527
+      "references": [ # Additional information about the CVE. e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527
+        { # Additional Links
+          "source": "A String", # Source of the reference e.g. NVD
+          "uri": "A String", # Uri for the mentioned source e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527.
+        },
+      ],
+    },
+  },
 }</pre>
 </div>
 
@@ -299,6 +343,28 @@
           &quot;a_key&quot;: &quot;&quot;,
         },
         &quot;state&quot;: &quot;A String&quot;, # The state of the finding.
+        &quot;vulnerability&quot;: { # Refers to common vulnerability fields e.g. cve, cvss, cwe etc. # Represents vulnerability specific fields like cve, cvss scores etc. CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+          &quot;cve&quot;: { # CVE stands for Common Vulnerabilities and Exposures. More information: https://cve.mitre.org # CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+            &quot;cvssv3&quot;: { # Common Vulnerability Scoring System version 3. # Describe Common Vulnerability Scoring System specified at https://www.first.org/cvss/v3.1/specification-document
+              &quot;attackComplexity&quot;: &quot;A String&quot;, # This metric describes the conditions beyond the attacker&#x27;s control that must exist in order to exploit the vulnerability.
+              &quot;attackVector&quot;: &quot;A String&quot;, # Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments. This metric reflects the context by which vulnerability exploitation is possible.
+              &quot;availabilityImpact&quot;: &quot;A String&quot;, # This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.
+              &quot;baseScore&quot;: 3.14, # The base score is a function of the base metric scores.
+              &quot;confidentialityImpact&quot;: &quot;A String&quot;, # This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.
+              &quot;integrityImpact&quot;: &quot;A String&quot;, # This metric measures the impact to integrity of a successfully exploited vulnerability.
+              &quot;privilegesRequired&quot;: &quot;A String&quot;, # This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.
+              &quot;scope&quot;: &quot;A String&quot;, # The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.
+              &quot;userInteraction&quot;: &quot;A String&quot;, # This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.
+            },
+            &quot;id&quot;: &quot;A String&quot;, # The unique identifier for the vulnerability. e.g. CVE-2021-34527
+            &quot;references&quot;: [ # Additional information about the CVE. e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527
+              { # Additional Links
+                &quot;source&quot;: &quot;A String&quot;, # Source of the reference e.g. NVD
+                &quot;uri&quot;: &quot;A String&quot;, # Uri for the mentioned source e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527.
+              },
+            ],
+          },
+        },
       },
       &quot;resource&quot;: { # Information related to the Google Cloud resource that is associated with this finding. # Output only. Resource that is associated with this finding.
         &quot;folders&quot;: [ # Contains a Folder message for each folder in the assets ancestry. The first folder is the deepest nested folder, and the last folder is the folder directly under the Organization.
@@ -375,6 +441,28 @@
     &quot;a_key&quot;: &quot;&quot;,
   },
   &quot;state&quot;: &quot;A String&quot;, # The state of the finding.
+  &quot;vulnerability&quot;: { # Refers to common vulnerability fields e.g. cve, cvss, cwe etc. # Represents vulnerability specific fields like cve, cvss scores etc. CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+    &quot;cve&quot;: { # CVE stands for Common Vulnerabilities and Exposures. More information: https://cve.mitre.org # CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+      &quot;cvssv3&quot;: { # Common Vulnerability Scoring System version 3. # Describe Common Vulnerability Scoring System specified at https://www.first.org/cvss/v3.1/specification-document
+        &quot;attackComplexity&quot;: &quot;A String&quot;, # This metric describes the conditions beyond the attacker&#x27;s control that must exist in order to exploit the vulnerability.
+        &quot;attackVector&quot;: &quot;A String&quot;, # Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments. This metric reflects the context by which vulnerability exploitation is possible.
+        &quot;availabilityImpact&quot;: &quot;A String&quot;, # This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.
+        &quot;baseScore&quot;: 3.14, # The base score is a function of the base metric scores.
+        &quot;confidentialityImpact&quot;: &quot;A String&quot;, # This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.
+        &quot;integrityImpact&quot;: &quot;A String&quot;, # This metric measures the impact to integrity of a successfully exploited vulnerability.
+        &quot;privilegesRequired&quot;: &quot;A String&quot;, # This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.
+        &quot;scope&quot;: &quot;A String&quot;, # The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.
+        &quot;userInteraction&quot;: &quot;A String&quot;, # This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.
+      },
+      &quot;id&quot;: &quot;A String&quot;, # The unique identifier for the vulnerability. e.g. CVE-2021-34527
+      &quot;references&quot;: [ # Additional information about the CVE. e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527
+        { # Additional Links
+          &quot;source&quot;: &quot;A String&quot;, # Source of the reference e.g. NVD
+          &quot;uri&quot;: &quot;A String&quot;, # Uri for the mentioned source e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527.
+        },
+      ],
+    },
+  },
 }
 
   updateMask: string, The FieldMask to use when updating the finding resource. This field should not be specified when creating a finding. When updating a finding, an empty mask is treated as updating all mutable fields and replacing source_properties. Individual source_properties can be added/updated by using &quot;source_properties.&quot; in the field mask.
@@ -416,6 +504,28 @@
     &quot;a_key&quot;: &quot;&quot;,
   },
   &quot;state&quot;: &quot;A String&quot;, # The state of the finding.
+  &quot;vulnerability&quot;: { # Refers to common vulnerability fields e.g. cve, cvss, cwe etc. # Represents vulnerability specific fields like cve, cvss scores etc. CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+    &quot;cve&quot;: { # CVE stands for Common Vulnerabilities and Exposures. More information: https://cve.mitre.org # CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+      &quot;cvssv3&quot;: { # Common Vulnerability Scoring System version 3. # Describe Common Vulnerability Scoring System specified at https://www.first.org/cvss/v3.1/specification-document
+        &quot;attackComplexity&quot;: &quot;A String&quot;, # This metric describes the conditions beyond the attacker&#x27;s control that must exist in order to exploit the vulnerability.
+        &quot;attackVector&quot;: &quot;A String&quot;, # Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments. This metric reflects the context by which vulnerability exploitation is possible.
+        &quot;availabilityImpact&quot;: &quot;A String&quot;, # This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.
+        &quot;baseScore&quot;: 3.14, # The base score is a function of the base metric scores.
+        &quot;confidentialityImpact&quot;: &quot;A String&quot;, # This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.
+        &quot;integrityImpact&quot;: &quot;A String&quot;, # This metric measures the impact to integrity of a successfully exploited vulnerability.
+        &quot;privilegesRequired&quot;: &quot;A String&quot;, # This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.
+        &quot;scope&quot;: &quot;A String&quot;, # The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.
+        &quot;userInteraction&quot;: &quot;A String&quot;, # This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.
+      },
+      &quot;id&quot;: &quot;A String&quot;, # The unique identifier for the vulnerability. e.g. CVE-2021-34527
+      &quot;references&quot;: [ # Additional information about the CVE. e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527
+        { # Additional Links
+          &quot;source&quot;: &quot;A String&quot;, # Source of the reference e.g. NVD
+          &quot;uri&quot;: &quot;A String&quot;, # Uri for the mentioned source e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527.
+        },
+      ],
+    },
+  },
 }</pre>
 </div>
 
@@ -471,6 +581,28 @@
     &quot;a_key&quot;: &quot;&quot;,
   },
   &quot;state&quot;: &quot;A String&quot;, # The state of the finding.
+  &quot;vulnerability&quot;: { # Refers to common vulnerability fields e.g. cve, cvss, cwe etc. # Represents vulnerability specific fields like cve, cvss scores etc. CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+    &quot;cve&quot;: { # CVE stands for Common Vulnerabilities and Exposures. More information: https://cve.mitre.org # CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+      &quot;cvssv3&quot;: { # Common Vulnerability Scoring System version 3. # Describe Common Vulnerability Scoring System specified at https://www.first.org/cvss/v3.1/specification-document
+        &quot;attackComplexity&quot;: &quot;A String&quot;, # This metric describes the conditions beyond the attacker&#x27;s control that must exist in order to exploit the vulnerability.
+        &quot;attackVector&quot;: &quot;A String&quot;, # Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments. This metric reflects the context by which vulnerability exploitation is possible.
+        &quot;availabilityImpact&quot;: &quot;A String&quot;, # This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.
+        &quot;baseScore&quot;: 3.14, # The base score is a function of the base metric scores.
+        &quot;confidentialityImpact&quot;: &quot;A String&quot;, # This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.
+        &quot;integrityImpact&quot;: &quot;A String&quot;, # This metric measures the impact to integrity of a successfully exploited vulnerability.
+        &quot;privilegesRequired&quot;: &quot;A String&quot;, # This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.
+        &quot;scope&quot;: &quot;A String&quot;, # The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.
+        &quot;userInteraction&quot;: &quot;A String&quot;, # This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.
+      },
+      &quot;id&quot;: &quot;A String&quot;, # The unique identifier for the vulnerability. e.g. CVE-2021-34527
+      &quot;references&quot;: [ # Additional information about the CVE. e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527
+        { # Additional Links
+          &quot;source&quot;: &quot;A String&quot;, # Source of the reference e.g. NVD
+          &quot;uri&quot;: &quot;A String&quot;, # Uri for the mentioned source e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527.
+        },
+      ],
+    },
+  },
 }</pre>
 </div>
 

docs/dyn/securitycenter_v1.organizations.sources.html

diff --git a/docs/dyn/securitycenter_v1.organizations.sources.html b/docs/dyn/securitycenter_v1.organizations.sources.html
index 690929e..16bf268 100644
--- a/docs/dyn/securitycenter_v1.organizations.sources.html
+++ b/docs/dyn/securitycenter_v1.organizations.sources.html
@@ -189,7 +189,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -308,7 +308,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -350,7 +350,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/securitycenter_v1.projects.sources.findings.html

diff --git a/docs/dyn/securitycenter_v1.projects.sources.findings.html b/docs/dyn/securitycenter_v1.projects.sources.findings.html
index d25a8dd..487329d 100644
--- a/docs/dyn/securitycenter_v1.projects.sources.findings.html
+++ b/docs/dyn/securitycenter_v1.projects.sources.findings.html
@@ -213,6 +213,28 @@
           "a_key": "",
         },
         "state": "A String", # The state of the finding.
+        "vulnerability": { # Refers to common vulnerability fields e.g. cve, cvss, cwe etc. # Represents vulnerability specific fields like cve, cvss scores etc. CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+          "cve": { # CVE stands for Common Vulnerabilities and Exposures. More information: https://cve.mitre.org # CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+            "cvssv3": { # Common Vulnerability Scoring System version 3. # Describe Common Vulnerability Scoring System specified at https://www.first.org/cvss/v3.1/specification-document
+              "attackComplexity": "A String", # This metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability.
+              "attackVector": "A String", # Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments. This metric reflects the context by which vulnerability exploitation is possible.
+              "availabilityImpact": "A String", # This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.
+              "baseScore": 3.14, # The base score is a function of the base metric scores.
+              "confidentialityImpact": "A String", # This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.
+              "integrityImpact": "A String", # This metric measures the impact to integrity of a successfully exploited vulnerability.
+              "privilegesRequired": "A String", # This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.
+              "scope": "A String", # The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.
+              "userInteraction": "A String", # This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.
+            },
+            "id": "A String", # The unique identifier for the vulnerability. e.g. CVE-2021-34527
+            "references": [ # Additional information about the CVE. e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527
+              { # Additional Links
+                "source": "A String", # Source of the reference e.g. NVD
+                "uri": "A String", # Uri for the mentioned source e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527.
+              },
+            ],
+          },
+        },
       },
       "resource": { # Information related to the Google Cloud resource that is associated with this finding. # Output only. Resource that is associated with this finding.
         "folders": [ # Contains a Folder message for each folder in the assets ancestry. The first folder is the deepest nested folder, and the last folder is the folder directly under the Organization.
@@ -289,6 +311,28 @@
     "a_key": "",
   },
   "state": "A String", # The state of the finding.
+  "vulnerability": { # Refers to common vulnerability fields e.g. cve, cvss, cwe etc. # Represents vulnerability specific fields like cve, cvss scores etc. CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+    "cve": { # CVE stands for Common Vulnerabilities and Exposures. More information: https://cve.mitre.org # CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+      "cvssv3": { # Common Vulnerability Scoring System version 3. # Describe Common Vulnerability Scoring System specified at https://www.first.org/cvss/v3.1/specification-document
+        "attackComplexity": "A String", # This metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability.
+        "attackVector": "A String", # Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments. This metric reflects the context by which vulnerability exploitation is possible.
+        "availabilityImpact": "A String", # This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.
+        "baseScore": 3.14, # The base score is a function of the base metric scores.
+        "confidentialityImpact": "A String", # This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.
+        "integrityImpact": "A String", # This metric measures the impact to integrity of a successfully exploited vulnerability.
+        "privilegesRequired": "A String", # This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.
+        "scope": "A String", # The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.
+        "userInteraction": "A String", # This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.
+      },
+      "id": "A String", # The unique identifier for the vulnerability. e.g. CVE-2021-34527
+      "references": [ # Additional information about the CVE. e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527
+        { # Additional Links
+          "source": "A String", # Source of the reference e.g. NVD
+          "uri": "A String", # Uri for the mentioned source e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527.
+        },
+      ],
+    },
+  },
 }
 
   updateMask: string, The FieldMask to use when updating the finding resource. This field should not be specified when creating a finding. When updating a finding, an empty mask is treated as updating all mutable fields and replacing source_properties. Individual source_properties can be added/updated by using "source_properties." in the field mask.
@@ -330,6 +374,28 @@
     "a_key": "",
   },
   "state": "A String", # The state of the finding.
+  "vulnerability": { # Refers to common vulnerability fields e.g. cve, cvss, cwe etc. # Represents vulnerability specific fields like cve, cvss scores etc. CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+    "cve": { # CVE stands for Common Vulnerabilities and Exposures. More information: https://cve.mitre.org # CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+      "cvssv3": { # Common Vulnerability Scoring System version 3. # Describe Common Vulnerability Scoring System specified at https://www.first.org/cvss/v3.1/specification-document
+        "attackComplexity": "A String", # This metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability.
+        "attackVector": "A String", # Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments. This metric reflects the context by which vulnerability exploitation is possible.
+        "availabilityImpact": "A String", # This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.
+        "baseScore": 3.14, # The base score is a function of the base metric scores.
+        "confidentialityImpact": "A String", # This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.
+        "integrityImpact": "A String", # This metric measures the impact to integrity of a successfully exploited vulnerability.
+        "privilegesRequired": "A String", # This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.
+        "scope": "A String", # The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.
+        "userInteraction": "A String", # This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.
+      },
+      "id": "A String", # The unique identifier for the vulnerability. e.g. CVE-2021-34527
+      "references": [ # Additional information about the CVE. e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527
+        { # Additional Links
+          "source": "A String", # Source of the reference e.g. NVD
+          "uri": "A String", # Uri for the mentioned source e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527.
+        },
+      ],
+    },
+  },
 }</pre>
 </div>
 
@@ -385,6 +451,28 @@
     &quot;a_key&quot;: &quot;&quot;,
   },
   &quot;state&quot;: &quot;A String&quot;, # The state of the finding.
+  &quot;vulnerability&quot;: { # Refers to common vulnerability fields e.g. cve, cvss, cwe etc. # Represents vulnerability specific fields like cve, cvss scores etc. CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+    &quot;cve&quot;: { # CVE stands for Common Vulnerabilities and Exposures. More information: https://cve.mitre.org # CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
+      &quot;cvssv3&quot;: { # Common Vulnerability Scoring System version 3. # Describe Common Vulnerability Scoring System specified at https://www.first.org/cvss/v3.1/specification-document
+        &quot;attackComplexity&quot;: &quot;A String&quot;, # This metric describes the conditions beyond the attacker&#x27;s control that must exist in order to exploit the vulnerability.
+        &quot;attackVector&quot;: &quot;A String&quot;, # Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments. This metric reflects the context by which vulnerability exploitation is possible.
+        &quot;availabilityImpact&quot;: &quot;A String&quot;, # This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.
+        &quot;baseScore&quot;: 3.14, # The base score is a function of the base metric scores.
+        &quot;confidentialityImpact&quot;: &quot;A String&quot;, # This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.
+        &quot;integrityImpact&quot;: &quot;A String&quot;, # This metric measures the impact to integrity of a successfully exploited vulnerability.
+        &quot;privilegesRequired&quot;: &quot;A String&quot;, # This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.
+        &quot;scope&quot;: &quot;A String&quot;, # The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.
+        &quot;userInteraction&quot;: &quot;A String&quot;, # This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.
+      },
+      &quot;id&quot;: &quot;A String&quot;, # The unique identifier for the vulnerability. e.g. CVE-2021-34527
+      &quot;references&quot;: [ # Additional information about the CVE. e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527
+        { # Additional Links
+          &quot;source&quot;: &quot;A String&quot;, # Source of the reference e.g. NVD
+          &quot;uri&quot;: &quot;A String&quot;, # Uri for the mentioned source e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527.
+        },
+      ],
+    },
+  },
 }</pre>
 </div>
 

docs/dyn/securitycenter_v1beta1.organizations.sources.html

diff --git a/docs/dyn/securitycenter_v1beta1.organizations.sources.html b/docs/dyn/securitycenter_v1beta1.organizations.sources.html
index 841428a..d8d16d5 100644
--- a/docs/dyn/securitycenter_v1beta1.organizations.sources.html
+++ b/docs/dyn/securitycenter_v1beta1.organizations.sources.html
@@ -186,7 +186,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -302,7 +302,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -344,7 +344,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/servicedirectory_v1.projects.locations.namespaces.html

diff --git a/docs/dyn/servicedirectory_v1.projects.locations.namespaces.html b/docs/dyn/servicedirectory_v1.projects.locations.namespaces.html
index 140ae93..4b6c630 100644
--- a/docs/dyn/servicedirectory_v1.projects.locations.namespaces.html
+++ b/docs/dyn/servicedirectory_v1.projects.locations.namespaces.html
@@ -211,7 +211,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -319,7 +319,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
         "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -347,7 +347,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/servicedirectory_v1.projects.locations.namespaces.services.html

diff --git a/docs/dyn/servicedirectory_v1.projects.locations.namespaces.services.html b/docs/dyn/servicedirectory_v1.projects.locations.namespaces.services.html
index 0b0943e..5085613 100644
--- a/docs/dyn/servicedirectory_v1.projects.locations.namespaces.services.html
+++ b/docs/dyn/servicedirectory_v1.projects.locations.namespaces.services.html
@@ -244,7 +244,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -424,7 +424,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
         "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -452,7 +452,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/servicedirectory_v1beta1.projects.locations.namespaces.html

diff --git a/docs/dyn/servicedirectory_v1beta1.projects.locations.namespaces.html b/docs/dyn/servicedirectory_v1beta1.projects.locations.namespaces.html
index c2ec719..394ceb7 100644
--- a/docs/dyn/servicedirectory_v1beta1.projects.locations.namespaces.html
+++ b/docs/dyn/servicedirectory_v1beta1.projects.locations.namespaces.html
@@ -217,7 +217,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -331,7 +331,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
         "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -359,7 +359,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/servicedirectory_v1beta1.projects.locations.namespaces.services.html

diff --git a/docs/dyn/servicedirectory_v1beta1.projects.locations.namespaces.services.html b/docs/dyn/servicedirectory_v1beta1.projects.locations.namespaces.services.html
index ad9230c..26687cf 100644
--- a/docs/dyn/servicedirectory_v1beta1.projects.locations.namespaces.services.html
+++ b/docs/dyn/servicedirectory_v1beta1.projects.locations.namespaces.services.html
@@ -259,7 +259,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -459,7 +459,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
         "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -487,7 +487,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
     { # Associates `members` with a `role`.
       "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

docs/dyn/servicemanagement_v1.services.consumers.html

diff --git a/docs/dyn/servicemanagement_v1.services.consumers.html b/docs/dyn/servicemanagement_v1.services.consumers.html
index d5ddcab..6912488 100644
--- a/docs/dyn/servicemanagement_v1.services.consumers.html
+++ b/docs/dyn/servicemanagement_v1.services.consumers.html
@@ -115,7 +115,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -158,7 +158,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -200,7 +200,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/servicemanagement_v1.services.html

diff --git a/docs/dyn/servicemanagement_v1.services.html b/docs/dyn/servicemanagement_v1.services.html
index 10b9e72..3222eb9 100644
--- a/docs/dyn/servicemanagement_v1.services.html
+++ b/docs/dyn/servicemanagement_v1.services.html
@@ -783,7 +783,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -868,7 +868,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         "auditLogConfigs": [ # The configuration for logging of each type of permission.
@@ -910,7 +910,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       "auditLogConfigs": [ # The configuration for logging of each type of permission.

docs/dyn/slides_v1.presentations.html

diff --git a/docs/dyn/slides_v1.presentations.html b/docs/dyn/slides_v1.presentations.html
index d402260..bee6c9e 100644
--- a/docs/dyn/slides_v1.presentations.html
+++ b/docs/dyn/slides_v1.presentations.html
@@ -1146,6 +1146,11 @@
               },
               "transparency": 3.14, # The transparency effect of the image. The value should be in the interval [0.0, 1.0], where 0 means no effect and 1 means completely transparent. This property is read-only.
             },
+            "placeholder": { # The placeholder information that uniquely identifies a placeholder shape. # Placeholders are page elements that inherit from corresponding placeholders on layouts and masters. If set, the image is a placeholder image and any inherited properties can be resolved by looking at the parent placeholder identified by the Placeholder.parent_object_id field.
+              "index": 42, # The index of the placeholder. If the same placeholder types are present in the same page, they would have different index values.
+              "parentObjectId": "A String", # The object ID of this shape's parent placeholder. If unset, the parent placeholder shape does not exist, so the shape does not inherit properties from any other shape.
+              "type": "A String", # The type of the placeholder.
+            },
             "sourceUrl": "A String", # The source URL is the URL used to insert the image. The source URL can be empty.
           },
           "line": { # A PageElement kind representing a non-connector line, straight connector, curved connector, or bent connector. # A line page element.
@@ -2157,6 +2162,11 @@
               },
               "transparency": 3.14, # The transparency effect of the image. The value should be in the interval [0.0, 1.0], where 0 means no effect and 1 means completely transparent. This property is read-only.
             },
+            "placeholder": { # The placeholder information that uniquely identifies a placeholder shape. # Placeholders are page elements that inherit from corresponding placeholders on layouts and masters. If set, the image is a placeholder image and any inherited properties can be resolved by looking at the parent placeholder identified by the Placeholder.parent_object_id field.
+              "index": 42, # The index of the placeholder. If the same placeholder types are present in the same page, they would have different index values.
+              "parentObjectId": "A String", # The object ID of this shape's parent placeholder. If unset, the parent placeholder shape does not exist, so the shape does not inherit properties from any other shape.
+              "type": "A String", # The type of the placeholder.
+            },
             "sourceUrl": "A String", # The source URL is the URL used to insert the image. The source URL can be empty.
           },
           "line": { # A PageElement kind representing a non-connector line, straight connector, curved connector, or bent connector. # A line page element.
@@ -3166,6 +3176,11 @@
             },
             "transparency": 3.14, # The transparency effect of the image. The value should be in the interval [0.0, 1.0], where 0 means no effect and 1 means completely transparent. This property is read-only.
           },
+          "placeholder": { # The placeholder information that uniquely identifies a placeholder shape. # Placeholders are page elements that inherit from corresponding placeholders on layouts and masters. If set, the image is a placeholder image and any inherited properties can be resolved by looking at the parent placeholder identified by the Placeholder.parent_object_id field.
+            "index": 42, # The index of the placeholder. If the same placeholder types are present in the same page, they would have different index values.
+            "parentObjectId": "A String", # The object ID of this shape's parent placeholder. If unset, the parent placeholder shape does not exist, so the shape does not inherit properties from any other shape.
+            "type": "A String", # The type of the placeholder.
+          },
           "sourceUrl": "A String", # The source URL is the URL used to insert the image. The source URL can be empty.
         },
         "line": { # A PageElement kind representing a non-connector line, straight connector, curved connector, or bent connector. # A line page element.
@@ -4187,6 +4202,11 @@
               },
               "transparency": 3.14, # The transparency effect of the image. The value should be in the interval [0.0, 1.0], where 0 means no effect and 1 means completely transparent. This property is read-only.
             },
+            "placeholder": { # The placeholder information that uniquely identifies a placeholder shape. # Placeholders are page elements that inherit from corresponding placeholders on layouts and masters. If set, the image is a placeholder image and any inherited properties can be resolved by looking at the parent placeholder identified by the Placeholder.parent_object_id field.
+              "index": 42, # The index of the placeholder. If the same placeholder types are present in the same page, they would have different index values.
+              "parentObjectId": "A String", # The object ID of this shape's parent placeholder. If unset, the parent placeholder shape does not exist, so the shape does not inherit properties from any other shape.
+              "type": "A String", # The type of the placeholder.
+            },
             "sourceUrl": "A String", # The source URL is the URL used to insert the image. The source URL can be empty.
           },
           "line": { # A PageElement kind representing a non-connector line, straight connector, curved connector, or bent connector. # A line page element.
@@ -5209,6 +5229,11 @@
               },
               "transparency": 3.14, # The transparency effect of the image. The value should be in the interval [0.0, 1.0], where 0 means no effect and 1 means completely transparent. This property is read-only.
             },
+            "placeholder": { # The placeholder information that uniquely identifies a placeholder shape. # Placeholders are page elements that inherit from corresponding placeholders on layouts and masters. If set, the image is a placeholder image and any inherited properties can be resolved by looking at the parent placeholder identified by the Placeholder.parent_object_id field.
+              "index": 42, # The index of the placeholder. If the same placeholder types are present in the same page, they would have different index values.
+              "parentObjectId": "A String", # The object ID of this shape's parent placeholder. If unset, the parent placeholder shape does not exist, so the shape does not inherit properties from any other shape.
+              "type": "A String", # The type of the placeholder.
+            },
             "sourceUrl": "A String", # The source URL is the URL used to insert the image. The source URL can be empty.
           },
           "line": { # A PageElement kind representing a non-connector line, straight connector, curved connector, or bent connector. # A line page element.
@@ -6220,6 +6245,11 @@
               },
               "transparency": 3.14, # The transparency effect of the image. The value should be in the interval [0.0, 1.0], where 0 means no effect and 1 means completely transparent. This property is read-only.
             },
+            "placeholder": { # The placeholder information that uniquely identifies a placeholder shape. # Placeholders are page elements that inherit from corresponding placeholders on layouts and masters. If set, the image is a placeholder image and any inherited properties can be resolved by looking at the parent placeholder identified by the Placeholder.parent_object_id field.
+              "index": 42, # The index of the placeholder. If the same placeholder types are present in the same page, they would have different index values.
+              "parentObjectId": "A String", # The object ID of this shape's parent placeholder. If unset, the parent placeholder shape does not exist, so the shape does not inherit properties from any other shape.
+              "type": "A String", # The type of the placeholder.
+            },
             "sourceUrl": "A String", # The source URL is the URL used to insert the image. The source URL can be empty.
           },
           "line": { # A PageElement kind representing a non-connector line, straight connector, curved connector, or bent connector. # A line page element.
@@ -7229,6 +7259,11 @@
             },
             "transparency": 3.14, # The transparency effect of the image. The value should be in the interval [0.0, 1.0], where 0 means no effect and 1 means completely transparent. This property is read-only.
           },
+          "placeholder": { # The placeholder information that uniquely identifies a placeholder shape. # Placeholders are page elements that inherit from corresponding placeholders on layouts and masters. If set, the image is a placeholder image and any inherited properties can be resolved by looking at the parent placeholder identified by the Placeholder.parent_object_id field.
+            "index": 42, # The index of the placeholder. If the same placeholder types are present in the same page, they would have different index values.
+            "parentObjectId": "A String", # The object ID of this shape's parent placeholder. If unset, the parent placeholder shape does not exist, so the shape does not inherit properties from any other shape.
+            "type": "A String", # The type of the placeholder.
+          },
           "sourceUrl": "A String", # The source URL is the URL used to insert the image. The source URL can be empty.
         },
         "line": { # A PageElement kind representing a non-connector line, straight connector, curved connector, or bent connector. # A line page element.
@@ -8250,6 +8285,11 @@
               },
               "transparency": 3.14, # The transparency effect of the image. The value should be in the interval [0.0, 1.0], where 0 means no effect and 1 means completely transparent. This property is read-only.
             },
+            "placeholder": { # The placeholder information that uniquely identifies a placeholder shape. # Placeholders are page elements that inherit from corresponding placeholders on layouts and masters. If set, the image is a placeholder image and any inherited properties can be resolved by looking at the parent placeholder identified by the Placeholder.parent_object_id field.
+              "index": 42, # The index of the placeholder. If the same placeholder types are present in the same page, they would have different index values.
+              "parentObjectId": "A String", # The object ID of this shape's parent placeholder. If unset, the parent placeholder shape does not exist, so the shape does not inherit properties from any other shape.
+              "type": "A String", # The type of the placeholder.
+            },
             "sourceUrl": "A String", # The source URL is the URL used to insert the image. The source URL can be empty.
           },
           "line": { # A PageElement kind representing a non-connector line, straight connector, curved connector, or bent connector. # A line page element.
@@ -9279,6 +9319,11 @@
               },
               "transparency": 3.14, # The transparency effect of the image. The value should be in the interval [0.0, 1.0], where 0 means no effect and 1 means completely transparent. This property is read-only.
             },
+            "placeholder": { # The placeholder information that uniquely identifies a placeholder shape. # Placeholders are page elements that inherit from corresponding placeholders on layouts and masters. If set, the image is a placeholder image and any inherited properties can be resolved by looking at the parent placeholder identified by the Placeholder.parent_object_id field.
+              "index": 42, # The index of the placeholder. If the same placeholder types are present in the same page, they would have different index values.
+              "parentObjectId": "A String", # The object ID of this shape's parent placeholder. If unset, the parent placeholder shape does not exist, so the shape does not inherit properties from any other shape.
+              "type": "A String", # The type of the placeholder.
+            },
             "sourceUrl": "A String", # The source URL is the URL used to insert the image. The source URL can be empty.
           },
           "line": { # A PageElement kind representing a non-connector line, straight connector, curved connector, or bent connector. # A line page element.
@@ -10290,6 +10335,11 @@
               },
               "transparency": 3.14, # The transparency effect of the image. The value should be in the interval [0.0, 1.0], where 0 means no effect and 1 means completely transparent. This property is read-only.
             },
+            "placeholder": { # The placeholder information that uniquely identifies a placeholder shape. # Placeholders are page elements that inherit from corresponding placeholders on layouts and masters. If set, the image is a placeholder image and any inherited properties can be resolved by looking at the parent placeholder identified by the Placeholder.parent_object_id field.
+              "index": 42, # The index of the placeholder. If the same placeholder types are present in the same page, they would have different index values.
+              "parentObjectId": "A String", # The object ID of this shape's parent placeholder. If unset, the parent placeholder shape does not exist, so the shape does not inherit properties from any other shape.
+              "type": "A String", # The type of the placeholder.
+            },
             "sourceUrl": "A String", # The source URL is the URL used to insert the image. The source URL can be empty.
           },
           "line": { # A PageElement kind representing a non-connector line, straight connector, curved connector, or bent connector. # A line page element.
@@ -11299,6 +11349,11 @@
             },
             "transparency": 3.14, # The transparency effect of the image. The value should be in the interval [0.0, 1.0], where 0 means no effect and 1 means completely transparent. This property is read-only.
           },
+          "placeholder": { # The placeholder information that uniquely identifies a placeholder shape. # Placeholders are page elements that inherit from corresponding placeholders on layouts and masters. If set, the image is a placeholder image and any inherited properties can be resolved by looking at the parent placeholder identified by the Placeholder.parent_object_id field.
+            "index": 42, # The index of the placeholder. If the same placeholder types are present in the same page, they would have different index values.
+            "parentObjectId": "A String", # The object ID of this shape's parent placeholder. If unset, the parent placeholder shape does not exist, so the shape does not inherit properties from any other shape.
+            "type": "A String", # The type of the placeholder.
+          },
           "sourceUrl": "A String", # The source URL is the URL used to insert the image. The source URL can be empty.
         },
         "line": { # A PageElement kind representing a non-connector line, straight connector, curved connector, or bent connector. # A line page element.
@@ -12320,6 +12375,11 @@
               },
               "transparency": 3.14, # The transparency effect of the image. The value should be in the interval [0.0, 1.0], where 0 means no effect and 1 means completely transparent. This property is read-only.
             },
+            "placeholder": { # The placeholder information that uniquely identifies a placeholder shape. # Placeholders are page elements that inherit from corresponding placeholders on layouts and masters. If set, the image is a placeholder image and any inherited properties can be resolved by looking at the parent placeholder identified by the Placeholder.parent_object_id field.
+              "index": 42, # The index of the placeholder. If the same placeholder types are present in the same page, they would have different index values.
+              "parentObjectId": "A String", # The object ID of this shape's parent placeholder. If unset, the parent placeholder shape does not exist, so the shape does not inherit properties from any other shape.
+              "type": "A String", # The type of the placeholder.
+            },
             "sourceUrl": "A String", # The source URL is the URL used to insert the image. The source URL can be empty.
           },
           "line": { # A PageElement kind representing a non-connector line, straight connector, curved connector, or bent connector. # A line page element.

docs/dyn/slides_v1.presentations.pages.html

diff --git a/docs/dyn/slides_v1.presentations.pages.html b/docs/dyn/slides_v1.presentations.pages.html
index bb9f82c..aab9b5e 100644
--- a/docs/dyn/slides_v1.presentations.pages.html
+++ b/docs/dyn/slides_v1.presentations.pages.html
@@ -211,6 +211,11 @@
           },
           "transparency": 3.14, # The transparency effect of the image. The value should be in the interval [0.0, 1.0], where 0 means no effect and 1 means completely transparent. This property is read-only.
         },
+        "placeholder": { # The placeholder information that uniquely identifies a placeholder shape. # Placeholders are page elements that inherit from corresponding placeholders on layouts and masters. If set, the image is a placeholder image and any inherited properties can be resolved by looking at the parent placeholder identified by the Placeholder.parent_object_id field.
+          "index": 42, # The index of the placeholder. If the same placeholder types are present in the same page, they would have different index values.
+          "parentObjectId": "A String", # The object ID of this shape's parent placeholder. If unset, the parent placeholder shape does not exist, so the shape does not inherit properties from any other shape.
+          "type": "A String", # The type of the placeholder.
+        },
         "sourceUrl": "A String", # The source URL is the URL used to insert the image. The source URL can be empty.
       },
       "line": { # A PageElement kind representing a non-connector line, straight connector, curved connector, or bent connector. # A line page element.

docs/dyn/tagmanager_v2.accounts.containers.workspaces.clients.html

diff --git a/docs/dyn/tagmanager_v2.accounts.containers.workspaces.clients.html b/docs/dyn/tagmanager_v2.accounts.containers.workspaces.clients.html
new file mode 100644
index 0000000..6bad36e
--- /dev/null
+++ b/docs/dyn/tagmanager_v2.accounts.containers.workspaces.clients.html
@@ -0,0 +1,421 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="tagmanager_v2.html">Tag Manager API</a> . <a href="tagmanager_v2.accounts.html">accounts</a> . <a href="tagmanager_v2.accounts.containers.html">containers</a> . <a href="tagmanager_v2.accounts.containers.workspaces.html">workspaces</a> . <a href="tagmanager_v2.accounts.containers.workspaces.clients.html">clients</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#create">create(parent, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Creates a GTM Client.</p>
+<p class="toc_element">
+  <code><a href="#delete">delete(path, x__xgafv=None)</a></code></p>
+<p class="firstline">Deletes a GTM Client.</p>
+<p class="toc_element">
+  <code><a href="#get">get(path, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets a GTM Client.</p>
+<p class="toc_element">
+  <code><a href="#list">list(parent, pageToken=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Lists all GTM Clients of a GTM container workspace.</p>
+<p class="toc_element">
+  <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
+<p class="firstline">Retrieves the next page of results.</p>
+<p class="toc_element">
+  <code><a href="#revert">revert(path, fingerprint=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Reverts changes to a GTM Client in a GTM Workspace.</p>
+<p class="toc_element">
+  <code><a href="#update">update(path, body=None, fingerprint=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Updates a GTM Client.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="create">create(parent, body=None, x__xgafv=None)</code>
+  <pre>Creates a GTM Client.
+
+Args:
+  parent: string, GTM Workspace&#x27;s API relative path. Example: accounts/{account_id}/containers/{container_id}/workspaces/{workspace_id} (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{
+  &quot;accountId&quot;: &quot;A String&quot;, # GTM Account ID.
+  &quot;clientId&quot;: &quot;A String&quot;, # The Client ID uniquely identifies the GTM client.
+  &quot;containerId&quot;: &quot;A String&quot;, # GTM Container ID.
+  &quot;fingerprint&quot;: &quot;A String&quot;, # The fingerprint of the GTM Client as computed at storage time. This value is recomputed whenever the client is modified.
+  &quot;name&quot;: &quot;A String&quot;, # Client display name. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+  &quot;notes&quot;: &quot;A String&quot;, # User notes on how to apply this tag in the container. @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+  &quot;parameter&quot;: [ # The client&#x27;s parameters. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+    { # Represents a Google Tag Manager Parameter.
+      &quot;key&quot;: &quot;A String&quot;, # The named key that uniquely identifies a parameter. Required for top-level parameters, as well as map values. Ignored for list values. @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+      &quot;list&quot;: [ # This list parameter&#x27;s parameters (keys will be ignored). @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+        # Object with schema name: Parameter
+      ],
+      &quot;map&quot;: [ # This map parameter&#x27;s parameters (must have keys; keys must be unique). @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+        # Object with schema name: Parameter
+      ],
+      &quot;type&quot;: &quot;A String&quot;, # The parameter type. Valid values are: - boolean: The value represents a boolean, represented as &#x27;true&#x27; or &#x27;false&#x27; - integer: The value represents a 64-bit signed integer value, in base 10 - list: A list of parameters should be specified - map: A map of parameters should be specified - template: The value represents any text; this can include variable references (even variable references that might return non-string types) - trigger_reference: The value represents a trigger, represented as the trigger id - tag_reference: The value represents a tag, represented as the tag name @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+      &quot;value&quot;: &quot;A String&quot;, # A parameter&#x27;s value (may contain variable references such as &quot;{{myVariable}}&quot;) as appropriate to the specified type. @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+    },
+  ],
+  &quot;parentFolderId&quot;: &quot;A String&quot;, # Parent folder id.
+  &quot;path&quot;: &quot;A String&quot;, # GTM client&#x27;s API relative path.
+  &quot;priority&quot;: 42, # Priority determines relative firing order. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+  &quot;tagManagerUrl&quot;: &quot;A String&quot;, # Auto generated link to the tag manager UI
+  &quot;type&quot;: &quot;A String&quot;, # Client type. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+  &quot;workspaceId&quot;: &quot;A String&quot;, # GTM Workspace ID.
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    {
+  &quot;accountId&quot;: &quot;A String&quot;, # GTM Account ID.
+  &quot;clientId&quot;: &quot;A String&quot;, # The Client ID uniquely identifies the GTM client.
+  &quot;containerId&quot;: &quot;A String&quot;, # GTM Container ID.
+  &quot;fingerprint&quot;: &quot;A String&quot;, # The fingerprint of the GTM Client as computed at storage time. This value is recomputed whenever the client is modified.
+  &quot;name&quot;: &quot;A String&quot;, # Client display name. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+  &quot;notes&quot;: &quot;A String&quot;, # User notes on how to apply this tag in the container. @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+  &quot;parameter&quot;: [ # The client&#x27;s parameters. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+    { # Represents a Google Tag Manager Parameter.
+      &quot;key&quot;: &quot;A String&quot;, # The named key that uniquely identifies a parameter. Required for top-level parameters, as well as map values. Ignored for list values. @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+      &quot;list&quot;: [ # This list parameter&#x27;s parameters (keys will be ignored). @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+        # Object with schema name: Parameter
+      ],
+      &quot;map&quot;: [ # This map parameter&#x27;s parameters (must have keys; keys must be unique). @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+        # Object with schema name: Parameter
+      ],
+      &quot;type&quot;: &quot;A String&quot;, # The parameter type. Valid values are: - boolean: The value represents a boolean, represented as &#x27;true&#x27; or &#x27;false&#x27; - integer: The value represents a 64-bit signed integer value, in base 10 - list: A list of parameters should be specified - map: A map of parameters should be specified - template: The value represents any text; this can include variable references (even variable references that might return non-string types) - trigger_reference: The value represents a trigger, represented as the trigger id - tag_reference: The value represents a tag, represented as the tag name @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+      &quot;value&quot;: &quot;A String&quot;, # A parameter&#x27;s value (may contain variable references such as &quot;{{myVariable}}&quot;) as appropriate to the specified type. @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+    },
+  ],
+  &quot;parentFolderId&quot;: &quot;A String&quot;, # Parent folder id.
+  &quot;path&quot;: &quot;A String&quot;, # GTM client&#x27;s API relative path.
+  &quot;priority&quot;: 42, # Priority determines relative firing order. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+  &quot;tagManagerUrl&quot;: &quot;A String&quot;, # Auto generated link to the tag manager UI
+  &quot;type&quot;: &quot;A String&quot;, # Client type. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+  &quot;workspaceId&quot;: &quot;A String&quot;, # GTM Workspace ID.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="delete">delete(path, x__xgafv=None)</code>
+  <pre>Deletes a GTM Client.
+
+Args:
+  path: string, GTM Client&#x27;s API relative path. Example: accounts/{account_id}/containers/{container_id}/workspaces/{workspace_id}/clients/{client_id} (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="get">get(path, x__xgafv=None)</code>
+  <pre>Gets a GTM Client.
+
+Args:
+  path: string, GTM Client&#x27;s API relative path. Example: accounts/{account_id}/containers/{container_id}/workspaces/{workspace_id}/clients/{client_id} (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    {
+  &quot;accountId&quot;: &quot;A String&quot;, # GTM Account ID.
+  &quot;clientId&quot;: &quot;A String&quot;, # The Client ID uniquely identifies the GTM client.
+  &quot;containerId&quot;: &quot;A String&quot;, # GTM Container ID.
+  &quot;fingerprint&quot;: &quot;A String&quot;, # The fingerprint of the GTM Client as computed at storage time. This value is recomputed whenever the client is modified.
+  &quot;name&quot;: &quot;A String&quot;, # Client display name. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+  &quot;notes&quot;: &quot;A String&quot;, # User notes on how to apply this tag in the container. @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+  &quot;parameter&quot;: [ # The client&#x27;s parameters. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+    { # Represents a Google Tag Manager Parameter.
+      &quot;key&quot;: &quot;A String&quot;, # The named key that uniquely identifies a parameter. Required for top-level parameters, as well as map values. Ignored for list values. @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+      &quot;list&quot;: [ # This list parameter&#x27;s parameters (keys will be ignored). @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+        # Object with schema name: Parameter
+      ],
+      &quot;map&quot;: [ # This map parameter&#x27;s parameters (must have keys; keys must be unique). @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+        # Object with schema name: Parameter
+      ],
+      &quot;type&quot;: &quot;A String&quot;, # The parameter type. Valid values are: - boolean: The value represents a boolean, represented as &#x27;true&#x27; or &#x27;false&#x27; - integer: The value represents a 64-bit signed integer value, in base 10 - list: A list of parameters should be specified - map: A map of parameters should be specified - template: The value represents any text; this can include variable references (even variable references that might return non-string types) - trigger_reference: The value represents a trigger, represented as the trigger id - tag_reference: The value represents a tag, represented as the tag name @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+      &quot;value&quot;: &quot;A String&quot;, # A parameter&#x27;s value (may contain variable references such as &quot;{{myVariable}}&quot;) as appropriate to the specified type. @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+    },
+  ],
+  &quot;parentFolderId&quot;: &quot;A String&quot;, # Parent folder id.
+  &quot;path&quot;: &quot;A String&quot;, # GTM client&#x27;s API relative path.
+  &quot;priority&quot;: 42, # Priority determines relative firing order. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+  &quot;tagManagerUrl&quot;: &quot;A String&quot;, # Auto generated link to the tag manager UI
+  &quot;type&quot;: &quot;A String&quot;, # Client type. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+  &quot;workspaceId&quot;: &quot;A String&quot;, # GTM Workspace ID.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list">list(parent, pageToken=None, x__xgafv=None)</code>
+  <pre>Lists all GTM Clients of a GTM container workspace.
+
+Args:
+  parent: string, GTM Workspace&#x27;s API relative path. Example: accounts/{account_id}/containers/{container_id}/workspaces/{workspace_id} (required)
+  pageToken: string, Continuation token for fetching the next page of results.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    {
+  &quot;client&quot;: [ # All GTM Clients of a GTM Container.
+    {
+      &quot;accountId&quot;: &quot;A String&quot;, # GTM Account ID.
+      &quot;clientId&quot;: &quot;A String&quot;, # The Client ID uniquely identifies the GTM client.
+      &quot;containerId&quot;: &quot;A String&quot;, # GTM Container ID.
+      &quot;fingerprint&quot;: &quot;A String&quot;, # The fingerprint of the GTM Client as computed at storage time. This value is recomputed whenever the client is modified.
+      &quot;name&quot;: &quot;A String&quot;, # Client display name. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+      &quot;notes&quot;: &quot;A String&quot;, # User notes on how to apply this tag in the container. @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+      &quot;parameter&quot;: [ # The client&#x27;s parameters. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+        { # Represents a Google Tag Manager Parameter.
+          &quot;key&quot;: &quot;A String&quot;, # The named key that uniquely identifies a parameter. Required for top-level parameters, as well as map values. Ignored for list values. @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+          &quot;list&quot;: [ # This list parameter&#x27;s parameters (keys will be ignored). @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+            # Object with schema name: Parameter
+          ],
+          &quot;map&quot;: [ # This map parameter&#x27;s parameters (must have keys; keys must be unique). @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+            # Object with schema name: Parameter
+          ],
+          &quot;type&quot;: &quot;A String&quot;, # The parameter type. Valid values are: - boolean: The value represents a boolean, represented as &#x27;true&#x27; or &#x27;false&#x27; - integer: The value represents a 64-bit signed integer value, in base 10 - list: A list of parameters should be specified - map: A map of parameters should be specified - template: The value represents any text; this can include variable references (even variable references that might return non-string types) - trigger_reference: The value represents a trigger, represented as the trigger id - tag_reference: The value represents a tag, represented as the tag name @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+          &quot;value&quot;: &quot;A String&quot;, # A parameter&#x27;s value (may contain variable references such as &quot;{{myVariable}}&quot;) as appropriate to the specified type. @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+        },
+      ],
+      &quot;parentFolderId&quot;: &quot;A String&quot;, # Parent folder id.
+      &quot;path&quot;: &quot;A String&quot;, # GTM client&#x27;s API relative path.
+      &quot;priority&quot;: 42, # Priority determines relative firing order. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+      &quot;tagManagerUrl&quot;: &quot;A String&quot;, # Auto generated link to the tag manager UI
+      &quot;type&quot;: &quot;A String&quot;, # Client type. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+      &quot;workspaceId&quot;: &quot;A String&quot;, # GTM Workspace ID.
+    },
+  ],
+  &quot;nextPageToken&quot;: &quot;A String&quot;, # Continuation token for fetching the next page of results.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
+  <pre>Retrieves the next page of results.
+
+Args:
+  previous_request: The request for the previous page. (required)
+  previous_response: The response from the request for the previous page. (required)
+
+Returns:
+  A request object that you can call &#x27;execute()&#x27; on to request the next
+  page. Returns None if there are no more items in the collection.
+    </pre>
+</div>
+
+<div class="method">
+    <code class="details" id="revert">revert(path, fingerprint=None, x__xgafv=None)</code>
+  <pre>Reverts changes to a GTM Client in a GTM Workspace.
+
+Args:
+  path: string, GTM Client&#x27;s API relative path. Example: accounts/{account_id}/containers/{container_id}/workspaces/{workspace_id}/clients/{client_id} (required)
+  fingerprint: string, When provided, this fingerprint must match the fingerprint of the client in storage.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # The result of reverting a client in a workspace.
+  &quot;client&quot;: { # Client as it appears in the latest container version since the last workspace synchronization operation. If no client is present, that means the client was deleted in the latest container version.
+    &quot;accountId&quot;: &quot;A String&quot;, # GTM Account ID.
+    &quot;clientId&quot;: &quot;A String&quot;, # The Client ID uniquely identifies the GTM client.
+    &quot;containerId&quot;: &quot;A String&quot;, # GTM Container ID.
+    &quot;fingerprint&quot;: &quot;A String&quot;, # The fingerprint of the GTM Client as computed at storage time. This value is recomputed whenever the client is modified.
+    &quot;name&quot;: &quot;A String&quot;, # Client display name. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+    &quot;notes&quot;: &quot;A String&quot;, # User notes on how to apply this tag in the container. @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+    &quot;parameter&quot;: [ # The client&#x27;s parameters. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+      { # Represents a Google Tag Manager Parameter.
+        &quot;key&quot;: &quot;A String&quot;, # The named key that uniquely identifies a parameter. Required for top-level parameters, as well as map values. Ignored for list values. @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+        &quot;list&quot;: [ # This list parameter&#x27;s parameters (keys will be ignored). @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+          # Object with schema name: Parameter
+        ],
+        &quot;map&quot;: [ # This map parameter&#x27;s parameters (must have keys; keys must be unique). @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+          # Object with schema name: Parameter
+        ],
+        &quot;type&quot;: &quot;A String&quot;, # The parameter type. Valid values are: - boolean: The value represents a boolean, represented as &#x27;true&#x27; or &#x27;false&#x27; - integer: The value represents a 64-bit signed integer value, in base 10 - list: A list of parameters should be specified - map: A map of parameters should be specified - template: The value represents any text; this can include variable references (even variable references that might return non-string types) - trigger_reference: The value represents a trigger, represented as the trigger id - tag_reference: The value represents a tag, represented as the tag name @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+        &quot;value&quot;: &quot;A String&quot;, # A parameter&#x27;s value (may contain variable references such as &quot;{{myVariable}}&quot;) as appropriate to the specified type. @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+      },
+    ],
+    &quot;parentFolderId&quot;: &quot;A String&quot;, # Parent folder id.
+    &quot;path&quot;: &quot;A String&quot;, # GTM client&#x27;s API relative path.
+    &quot;priority&quot;: 42, # Priority determines relative firing order. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+    &quot;tagManagerUrl&quot;: &quot;A String&quot;, # Auto generated link to the tag manager UI
+    &quot;type&quot;: &quot;A String&quot;, # Client type. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+    &quot;workspaceId&quot;: &quot;A String&quot;, # GTM Workspace ID.
+  },
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="update">update(path, body=None, fingerprint=None, x__xgafv=None)</code>
+  <pre>Updates a GTM Client.
+
+Args:
+  path: string, GTM Client&#x27;s API relative path. Example: accounts/{account_id}/containers/{container_id}/workspaces/{workspace_id}/clients/{client_id} (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{
+  &quot;accountId&quot;: &quot;A String&quot;, # GTM Account ID.
+  &quot;clientId&quot;: &quot;A String&quot;, # The Client ID uniquely identifies the GTM client.
+  &quot;containerId&quot;: &quot;A String&quot;, # GTM Container ID.
+  &quot;fingerprint&quot;: &quot;A String&quot;, # The fingerprint of the GTM Client as computed at storage time. This value is recomputed whenever the client is modified.
+  &quot;name&quot;: &quot;A String&quot;, # Client display name. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+  &quot;notes&quot;: &quot;A String&quot;, # User notes on how to apply this tag in the container. @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+  &quot;parameter&quot;: [ # The client&#x27;s parameters. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+    { # Represents a Google Tag Manager Parameter.
+      &quot;key&quot;: &quot;A String&quot;, # The named key that uniquely identifies a parameter. Required for top-level parameters, as well as map values. Ignored for list values. @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+      &quot;list&quot;: [ # This list parameter&#x27;s parameters (keys will be ignored). @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+        # Object with schema name: Parameter
+      ],
+      &quot;map&quot;: [ # This map parameter&#x27;s parameters (must have keys; keys must be unique). @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+        # Object with schema name: Parameter
+      ],
+      &quot;type&quot;: &quot;A String&quot;, # The parameter type. Valid values are: - boolean: The value represents a boolean, represented as &#x27;true&#x27; or &#x27;false&#x27; - integer: The value represents a 64-bit signed integer value, in base 10 - list: A list of parameters should be specified - map: A map of parameters should be specified - template: The value represents any text; this can include variable references (even variable references that might return non-string types) - trigger_reference: The value represents a trigger, represented as the trigger id - tag_reference: The value represents a tag, represented as the tag name @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+      &quot;value&quot;: &quot;A String&quot;, # A parameter&#x27;s value (may contain variable references such as &quot;{{myVariable}}&quot;) as appropriate to the specified type. @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+    },
+  ],
+  &quot;parentFolderId&quot;: &quot;A String&quot;, # Parent folder id.
+  &quot;path&quot;: &quot;A String&quot;, # GTM client&#x27;s API relative path.
+  &quot;priority&quot;: 42, # Priority determines relative firing order. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+  &quot;tagManagerUrl&quot;: &quot;A String&quot;, # Auto generated link to the tag manager UI
+  &quot;type&quot;: &quot;A String&quot;, # Client type. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+  &quot;workspaceId&quot;: &quot;A String&quot;, # GTM Workspace ID.
+}
+
+  fingerprint: string, When provided, this fingerprint must match the fingerprint of the client in storage.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    {
+  &quot;accountId&quot;: &quot;A String&quot;, # GTM Account ID.
+  &quot;clientId&quot;: &quot;A String&quot;, # The Client ID uniquely identifies the GTM client.
+  &quot;containerId&quot;: &quot;A String&quot;, # GTM Container ID.
+  &quot;fingerprint&quot;: &quot;A String&quot;, # The fingerprint of the GTM Client as computed at storage time. This value is recomputed whenever the client is modified.
+  &quot;name&quot;: &quot;A String&quot;, # Client display name. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+  &quot;notes&quot;: &quot;A String&quot;, # User notes on how to apply this tag in the container. @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+  &quot;parameter&quot;: [ # The client&#x27;s parameters. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+    { # Represents a Google Tag Manager Parameter.
+      &quot;key&quot;: &quot;A String&quot;, # The named key that uniquely identifies a parameter. Required for top-level parameters, as well as map values. Ignored for list values. @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+      &quot;list&quot;: [ # This list parameter&#x27;s parameters (keys will be ignored). @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+        # Object with schema name: Parameter
+      ],
+      &quot;map&quot;: [ # This map parameter&#x27;s parameters (must have keys; keys must be unique). @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+        # Object with schema name: Parameter
+      ],
+      &quot;type&quot;: &quot;A String&quot;, # The parameter type. Valid values are: - boolean: The value represents a boolean, represented as &#x27;true&#x27; or &#x27;false&#x27; - integer: The value represents a 64-bit signed integer value, in base 10 - list: A list of parameters should be specified - map: A map of parameters should be specified - template: The value represents any text; this can include variable references (even variable references that might return non-string types) - trigger_reference: The value represents a trigger, represented as the trigger id - tag_reference: The value represents a tag, represented as the tag name @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+      &quot;value&quot;: &quot;A String&quot;, # A parameter&#x27;s value (may contain variable references such as &quot;{{myVariable}}&quot;) as appropriate to the specified type. @mutable tagmanager.accounts.containers.workspaces.variables.create @mutable tagmanager.accounts.containers.workspaces.variables.update @mutable tagmanager.accounts.containers.workspaces.triggers.create @mutable tagmanager.accounts.containers.workspaces.triggers.update @mutable tagmanager.accounts.containers.workspaces.tags.create @mutable tagmanager.accounts.containers.workspaces.tags.update
+    },
+  ],
+  &quot;parentFolderId&quot;: &quot;A String&quot;, # Parent folder id.
+  &quot;path&quot;: &quot;A String&quot;, # GTM client&#x27;s API relative path.
+  &quot;priority&quot;: 42, # Priority determines relative firing order. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+  &quot;tagManagerUrl&quot;: &quot;A String&quot;, # Auto generated link to the tag manager UI
+  &quot;type&quot;: &quot;A String&quot;, # Client type. @mutable tagmanager.accounts.containers.workspaces.clients.create @mutable tagmanager.accounts.containers.workspaces.clients.update
+  &quot;workspaceId&quot;: &quot;A String&quot;, # GTM Workspace ID.
+}</pre>
+</div>
+
+</body></html>
\ No newline at end of file

docs/dyn/tagmanager_v2.accounts.containers.workspaces.html

diff --git a/docs/dyn/tagmanager_v2.accounts.containers.workspaces.html b/docs/dyn/tagmanager_v2.accounts.containers.workspaces.html
index 99e750a..9c5bb4a 100644
--- a/docs/dyn/tagmanager_v2.accounts.containers.workspaces.html
+++ b/docs/dyn/tagmanager_v2.accounts.containers.workspaces.html
@@ -80,6 +80,11 @@
 <p class="firstline">Returns the built_in_variables Resource.</p>
 
 <p class="toc_element">
+  <code><a href="tagmanager_v2.accounts.containers.workspaces.clients.html">clients()</a></code>
+</p>
+<p class="firstline">Returns the clients Resource.</p>
+
+<p class="toc_element">
   <code><a href="tagmanager_v2.accounts.containers.workspaces.folders.html">folders()</a></code>
 </p>
 <p class="firstline">Returns the folders Resource.</p>

docs/dyn/testing_v1.projects.testMatrices.html

diff --git a/docs/dyn/testing_v1.projects.testMatrices.html b/docs/dyn/testing_v1.projects.testMatrices.html
index 36ead43..34842a9 100644
--- a/docs/dyn/testing_v1.projects.testMatrices.html
+++ b/docs/dyn/testing_v1.projects.testMatrices.html
@@ -258,7 +258,7 @@
             "A String",
           ],
         },
-        "androidRoboTest": { # A test of an android application that explores the application on a virtual or physical Android Device, finding culprits and crashes as it goes. Next tag: 30 # An Android robo test.
+        "androidRoboTest": { # A test of an android application that explores the application on a virtual or physical Android Device, finding culprits and crashes as it goes. # An Android robo test.
           "appApk": { # A reference to a file, used for user inputs. # The APK for the application under test.
             "gcsPath": "A String", # A path to a file in Google Cloud Storage. Example: gs://build-app-1414623860166/app%40debug-unaligned.apk These paths are expected to be url encoded (percent encoding)
           },
@@ -332,7 +332,7 @@
             },
           ],
           "networkProfile": "A String", # The network traffic profile used for running the test. Available network profiles can be queried by using the NETWORK_CONFIGURATION environment type when calling TestEnvironmentDiscoveryService.GetTestEnvironmentCatalog.
-          "pullDirectories": [ # List of directories on the device to upload to Cloud Storage at the end of the test. Directories should either be in a shared directory (e.g. /private/var/mobile/Media) or within an accessible directory inside the app's filesystem (e.g. /Documents) by specifying the bundle id.
+          "pullDirectories": [ # List of directories on the device to upload to Cloud Storage at the end of the test. Directories should either be in a shared directory (such as /private/var/mobile/Media) or within an accessible directory inside the app's filesystem (such as /Documents) by specifying the bundle ID.
             { # A file or directory to install on the device before the test starts.
               "bundleId": "A String", # The bundle id of the app where this file lives. iOS apps sandbox their own filesystem, so app files must specify which app installed on the device.
               "content": { # A reference to a file, used for user inputs. # The source file
@@ -453,7 +453,7 @@
         "A String",
       ],
     },
-    "androidRoboTest": { # A test of an android application that explores the application on a virtual or physical Android Device, finding culprits and crashes as it goes. Next tag: 30 # An Android robo test.
+    "androidRoboTest": { # A test of an android application that explores the application on a virtual or physical Android Device, finding culprits and crashes as it goes. # An Android robo test.
       "appApk": { # A reference to a file, used for user inputs. # The APK for the application under test.
         "gcsPath": "A String", # A path to a file in Google Cloud Storage. Example: gs://build-app-1414623860166/app%40debug-unaligned.apk These paths are expected to be url encoded (percent encoding)
       },
@@ -527,7 +527,7 @@
         },
       ],
       "networkProfile": "A String", # The network traffic profile used for running the test. Available network profiles can be queried by using the NETWORK_CONFIGURATION environment type when calling TestEnvironmentDiscoveryService.GetTestEnvironmentCatalog.
-      "pullDirectories": [ # List of directories on the device to upload to Cloud Storage at the end of the test. Directories should either be in a shared directory (e.g. /private/var/mobile/Media) or within an accessible directory inside the app's filesystem (e.g. /Documents) by specifying the bundle id.
+      "pullDirectories": [ # List of directories on the device to upload to Cloud Storage at the end of the test. Directories should either be in a shared directory (such as /private/var/mobile/Media) or within an accessible directory inside the app's filesystem (such as /Documents) by specifying the bundle ID.
         { # A file or directory to install on the device before the test starts.
           "bundleId": "A String", # The bundle id of the app where this file lives. iOS apps sandbox their own filesystem, so app files must specify which app installed on the device.
           "content": { # A reference to a file, used for user inputs. # The source file
@@ -752,7 +752,7 @@
             "A String",
           ],
         },
-        "androidRoboTest": { # A test of an android application that explores the application on a virtual or physical Android Device, finding culprits and crashes as it goes. Next tag: 30 # An Android robo test.
+        "androidRoboTest": { # A test of an android application that explores the application on a virtual or physical Android Device, finding culprits and crashes as it goes. # An Android robo test.
           "appApk": { # A reference to a file, used for user inputs. # The APK for the application under test.
             "gcsPath": "A String", # A path to a file in Google Cloud Storage. Example: gs://build-app-1414623860166/app%40debug-unaligned.apk These paths are expected to be url encoded (percent encoding)
           },
@@ -826,7 +826,7 @@
             },
           ],
           "networkProfile": "A String", # The network traffic profile used for running the test. Available network profiles can be queried by using the NETWORK_CONFIGURATION environment type when calling TestEnvironmentDiscoveryService.GetTestEnvironmentCatalog.
-          "pullDirectories": [ # List of directories on the device to upload to Cloud Storage at the end of the test. Directories should either be in a shared directory (e.g. /private/var/mobile/Media) or within an accessible directory inside the app's filesystem (e.g. /Documents) by specifying the bundle id.
+          "pullDirectories": [ # List of directories on the device to upload to Cloud Storage at the end of the test. Directories should either be in a shared directory (such as /private/var/mobile/Media) or within an accessible directory inside the app's filesystem (such as /Documents) by specifying the bundle ID.
             { # A file or directory to install on the device before the test starts.
               "bundleId": "A String", # The bundle id of the app where this file lives. iOS apps sandbox their own filesystem, so app files must specify which app installed on the device.
               "content": { # A reference to a file, used for user inputs. # The source file
@@ -947,7 +947,7 @@
         "A String",
       ],
     },
-    "androidRoboTest": { # A test of an android application that explores the application on a virtual or physical Android Device, finding culprits and crashes as it goes. Next tag: 30 # An Android robo test.
+    "androidRoboTest": { # A test of an android application that explores the application on a virtual or physical Android Device, finding culprits and crashes as it goes. # An Android robo test.
       "appApk": { # A reference to a file, used for user inputs. # The APK for the application under test.
         "gcsPath": "A String", # A path to a file in Google Cloud Storage. Example: gs://build-app-1414623860166/app%40debug-unaligned.apk These paths are expected to be url encoded (percent encoding)
       },
@@ -1021,7 +1021,7 @@
         },
       ],
       "networkProfile": "A String", # The network traffic profile used for running the test. Available network profiles can be queried by using the NETWORK_CONFIGURATION environment type when calling TestEnvironmentDiscoveryService.GetTestEnvironmentCatalog.
-      "pullDirectories": [ # List of directories on the device to upload to Cloud Storage at the end of the test. Directories should either be in a shared directory (e.g. /private/var/mobile/Media) or within an accessible directory inside the app's filesystem (e.g. /Documents) by specifying the bundle id.
+      "pullDirectories": [ # List of directories on the device to upload to Cloud Storage at the end of the test. Directories should either be in a shared directory (such as /private/var/mobile/Media) or within an accessible directory inside the app's filesystem (such as /Documents) by specifying the bundle ID.
         { # A file or directory to install on the device before the test starts.
           "bundleId": "A String", # The bundle id of the app where this file lives. iOS apps sandbox their own filesystem, so app files must specify which app installed on the device.
           "content": { # A reference to a file, used for user inputs. # The source file
@@ -1253,7 +1253,7 @@
             "A String",
           ],
         },
-        "androidRoboTest": { # A test of an android application that explores the application on a virtual or physical Android Device, finding culprits and crashes as it goes. Next tag: 30 # An Android robo test.
+        "androidRoboTest": { # A test of an android application that explores the application on a virtual or physical Android Device, finding culprits and crashes as it goes. # An Android robo test.
           "appApk": { # A reference to a file, used for user inputs. # The APK for the application under test.
             "gcsPath": "A String", # A path to a file in Google Cloud Storage. Example: gs://build-app-1414623860166/app%40debug-unaligned.apk These paths are expected to be url encoded (percent encoding)
           },
@@ -1327,7 +1327,7 @@
             },
           ],
           "networkProfile": "A String", # The network traffic profile used for running the test. Available network profiles can be queried by using the NETWORK_CONFIGURATION environment type when calling TestEnvironmentDiscoveryService.GetTestEnvironmentCatalog.
-          "pullDirectories": [ # List of directories on the device to upload to Cloud Storage at the end of the test. Directories should either be in a shared directory (e.g. /private/var/mobile/Media) or within an accessible directory inside the app's filesystem (e.g. /Documents) by specifying the bundle id.
+          "pullDirectories": [ # List of directories on the device to upload to Cloud Storage at the end of the test. Directories should either be in a shared directory (such as /private/var/mobile/Media) or within an accessible directory inside the app's filesystem (such as /Documents) by specifying the bundle ID.
             { # A file or directory to install on the device before the test starts.
               "bundleId": "A String", # The bundle id of the app where this file lives. iOS apps sandbox their own filesystem, so app files must specify which app installed on the device.
               "content": { # A reference to a file, used for user inputs. # The source file
@@ -1448,7 +1448,7 @@
         "A String",
       ],
     },
-    "androidRoboTest": { # A test of an android application that explores the application on a virtual or physical Android Device, finding culprits and crashes as it goes. Next tag: 30 # An Android robo test.
+    "androidRoboTest": { # A test of an android application that explores the application on a virtual or physical Android Device, finding culprits and crashes as it goes. # An Android robo test.
       "appApk": { # A reference to a file, used for user inputs. # The APK for the application under test.
         "gcsPath": "A String", # A path to a file in Google Cloud Storage. Example: gs://build-app-1414623860166/app%40debug-unaligned.apk These paths are expected to be url encoded (percent encoding)
       },
@@ -1522,7 +1522,7 @@
         },
       ],
       "networkProfile": "A String", # The network traffic profile used for running the test. Available network profiles can be queried by using the NETWORK_CONFIGURATION environment type when calling TestEnvironmentDiscoveryService.GetTestEnvironmentCatalog.
-      "pullDirectories": [ # List of directories on the device to upload to Cloud Storage at the end of the test. Directories should either be in a shared directory (e.g. /private/var/mobile/Media) or within an accessible directory inside the app's filesystem (e.g. /Documents) by specifying the bundle id.
+      "pullDirectories": [ # List of directories on the device to upload to Cloud Storage at the end of the test. Directories should either be in a shared directory (such as /private/var/mobile/Media) or within an accessible directory inside the app's filesystem (such as /Documents) by specifying the bundle ID.
         { # A file or directory to install on the device before the test starts.
           "bundleId": "A String", # The bundle id of the app where this file lives. iOS apps sandbox their own filesystem, so app files must specify which app installed on the device.
           "content": { # A reference to a file, used for user inputs. # The source file

docs/dyn/vectortile_v1.terraintiles.html

diff --git a/docs/dyn/vectortile_v1.terraintiles.html b/docs/dyn/vectortile_v1.terraintiles.html
index 27dcc80..3164603 100644
--- a/docs/dyn/vectortile_v1.terraintiles.html
+++ b/docs/dyn/vectortile_v1.terraintiles.html
@@ -110,7 +110,7 @@
       WEB_GL - WebGL.
   clientInfo_userId: string, Required. A client-generated user ID. The ID should be generated and persisted during the first user session or whenever a pre-existing ID is not found. The exact format is up to the client. This must be non-empty in a GetFeatureTileRequest (whether via the header or GetFeatureTileRequest.client_info).
   maxElevationResolutionCells: integer, The maximum allowed resolution for the returned elevation heightmap. Possible values: between 1 and 1024 (and not less than min_elevation_resolution_cells). Over-sized heightmaps will be non-uniformly down-sampled such that each edge is no longer than this value. Non-uniformity is chosen to maximise the amount of preserved data. For example: Original resolution: 100px (width) * 30px (height) max_elevation_resolution: 30 New resolution: 30px (width) * 30px (height)
-  minElevationResolutionCells: integer, The minimum allowed resolution for the returned elevation heightmap. Possible values: between 0 and 1024 (and not more than max_elevation_resolution_cells). Zero is supported for backward compatibility. Under-sized heightmaps will be non-uniformly up-sampled such that each edge is no shorter than this value. Non-uniformity is chosen to maximise the amount of preserved data. For example: Original resolution: 30px (width) * 10px (height) min_elevation_resolution: 30 New resolution: 30px (width) * 30px (height)
+  minElevationResolutionCells: integer,  api-linter: core::0131::request-unknown-fields=disabled aip.dev/not-precedent: Maintaining existing request parameter pattern. The minimum allowed resolution for the returned elevation heightmap. Possible values: between 0 and 1024 (and not more than max_elevation_resolution_cells). Zero is supported for backward compatibility. Under-sized heightmaps will be non-uniformly up-sampled such that each edge is no shorter than this value. Non-uniformity is chosen to maximise the amount of preserved data. For example: Original resolution: 30px (width) * 10px (height) min_elevation_resolution: 30 New resolution: 30px (width) * 30px (height)
   terrainFormats: string, Terrain formats that the client understands. (repeated)
     Allowed values
       TERRAIN_FORMAT_UNKNOWN - An unknown or unspecified terrain format.
@@ -130,7 +130,7 @@
     "y": 42, # Required. The y coordinate.
     "zoom": 42, # Required. The Google Maps API zoom level.
   },
-  "firstDerivative": { # A packed representation of a 2D grid of uniformly spaced points containing elevation data. Each point within the grid represents the altitude in meters above average sea level at that location within the tile. Elevations provided are (generally) relative to the EGM96 geoid, however some areas will be relative to NAVD88. EGM96 and NAVD88 are off by no more than 2 meters. The grid is oriented north-west to south-east, as illustrated: rows[0].a[0] rows[0].a[m] +-----------------+ | | | N | | ^ | | | | | W <-----> E | | | | | v | | S | | | +-----------------+ rows[n].a[0] rows[n].a[m] Rather than storing the altitudes directly, we store the diffs between them as integers at some requested level of precision to take advantage of integer packing. The actual altitude values a[] can be reconstructed using the scale and each row's first_altitude and altitude_diff fields. # Terrain elevation data encoded as a FirstDerivativeElevationGrid.
+  "firstDerivative": { # A packed representation of a 2D grid of uniformly spaced points containing elevation data. Each point within the grid represents the altitude in meters above average sea level at that location within the tile. Elevations provided are (generally) relative to the EGM96 geoid, however some areas will be relative to NAVD88. EGM96 and NAVD88 are off by no more than 2 meters. The grid is oriented north-west to south-east, as illustrated: rows[0].a[0] rows[0].a[m] +-----------------+ | | | N | | ^ | | | | | W <-----> E | | | | | v | | S | | | +-----------------+ rows[n].a[0] rows[n].a[m] Rather than storing the altitudes directly, we store the diffs between them as integers at some requested level of precision to take advantage of integer packing. The actual altitude values a[] can be reconstructed using the scale and each row's first_altitude and altitude_diff fields. More details in go/elevation-encoding-options-for-enduro under "Recommended implementation". # Terrain elevation data encoded as a FirstDerivativeElevationGrid. cs/symbol:FirstDerivativeElevationGrid.
     "altitudeMultiplier": 3.14, # A multiplier applied to the altitude fields below to extract the actual altitudes in meters from the elevation grid.
     "rows": [ # Rows of points containing altitude data making up the elevation grid. Each row is the same length. Rows are ordered from north to south. E.g: rows[0] is the north-most row, and rows[n] is the south-most row.
       { # A row of altitude points in the elevation grid, ordered from west to east.
@@ -141,7 +141,7 @@
     ],
   },
   "name": "A String", # Resource name of the tile. The tile resource name is prefixed by its collection ID `terrain/` followed by the resource ID, which encodes the tile's global x and y coordinates and zoom level as `@,,z`. For example, `terrain/@1,2,3z`.
-  "secondDerivative": { # A packed representation of a 2D grid of uniformly spaced points containing elevation data. Each point within the grid represents the altitude in meters above average sea level at that location within the tile. Elevations provided are (generally) relative to the EGM96 geoid, however some areas will be relative to NAVD88. EGM96 and NAVD88 are off by no more than 2 meters. The grid is oriented north-west to south-east, as illustrated: rows[0].a[0] rows[0].a[m] +-----------------+ | | | N | | ^ | | | | | W <-----> E | | | | | v | | S | | | +-----------------+ rows[n].a[0] rows[n].a[m] Rather than storing the altitudes directly, we store the diffs of the diffs between them as integers at some requested level of precision to take advantage of integer packing. Note that the data is packed in such a way that is fast to decode in Unity and that further optimizes wire size. # Terrain elevation data encoded as a SecondDerivativeElevationGrid. .
+  "secondDerivative": { # A packed representation of a 2D grid of uniformly spaced points containing elevation data. Each point within the grid represents the altitude in meters above average sea level at that location within the tile. Elevations provided are (generally) relative to the EGM96 geoid, however some areas will be relative to NAVD88. EGM96 and NAVD88 are off by no more than 2 meters. The grid is oriented north-west to south-east, as illustrated: rows[0].a[0] rows[0].a[m] +-----------------+ | | | N | | ^ | | | | | W <-----> E | | | | | v | | S | | | +-----------------+ rows[n].a[0] rows[n].a[m] Rather than storing the altitudes directly, we store the diffs of the diffs between them as integers at some requested level of precision to take advantage of integer packing. Note that the data is packed in such a way that is fast to decode in Unity and that further optimizes wire size. # Terrain elevation data encoded as a SecondDerivativeElevationGrid. cs/symbol:SecondDerivativeElevationGrid. See go/byte-encoded-terrain for more details.
     "altitudeMultiplier": 3.14, # A multiplier applied to the elements in the encoded data to extract the actual altitudes in meters.
     "columnCount": 42, # The number of columns included in the encoded elevation data (i.e. the horizontal resolution of the grid).
     "encodedData": "A String", # A stream of elements each representing a point on the tile running across each row from left to right, top to bottom. There will be precisely horizontal_resolution * vertical_resolution elements in the stream. The elements are not the heights, rather the second order derivative of the values one would expect in a stream of height data. Each element is a varint with the following encoding: ------------------------------------------------------------------------| | Head Nibble | ------------------------------------------------------------------------| | Bit 0 | Bit 1 | Bits 2-3 | | Terminator| Sign (1=neg) | Least significant 2 bits of absolute error | ------------------------------------------------------------------------| | Tail Nibble #1 | ------------------------------------------------------------------------| | Bit 0 | Bit 1-3 | | Terminator| Least significant 3 bits of absolute error | ------------------------------------------------------------------------| | ... | Tail Nibble #n | ------------------------------------------------------------------------| | Bit 0 | Bit 1-3 | | Terminator| Least significant 3 bits of absolute error | ------------------------------------------------------------------------|