diff --git a/docs/dyn/androidenterprise_v1.devices.html b/docs/dyn/androidenterprise_v1.devices.html
index eeddbab..a110b0b 100644
--- a/docs/dyn/androidenterprise_v1.devices.html
+++ b/docs/dyn/androidenterprise_v1.devices.html
@@ -94,7 +94,7 @@
 <p class="firstline">Sets whether a device's access to Google services is enabled or disabled. The device state takes effect only if enforcing EMM policies on Android devices is enabled in the Google Admin Console. Otherwise, the device state is ignored and all devices are allowed access to Google services. This is only supported for Google-managed users.</p>
 <p class="toc_element">
   <code><a href="#update">update(enterpriseId, userId, deviceId, body=None, updateMask=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Updates the device policy. To ensure the policy is properly enforced, you need to prevent unmanaged accounts from accessing Google Play by setting the allowed_accounts in the managed configuration for the Google Play package. See restrict accounts in Google Play.</p>
+<p class="firstline">Updates the device policy. To ensure the policy is properly enforced, you need to prevent unmanaged accounts from accessing Google Play by setting the allowed_accounts in the managed configuration for the Google Play package. See restrict accounts in Google Play. When provisioning a new device, you should set the device policy using this method before adding the managed Google Play Account to the device, otherwise the policy will not be applied for a short period of time after adding the account to the device.</p>
 <h3>Method Details</h3>
 <div class="method">
     <code class="details" id="close">close()</code>
@@ -386,7 +386,7 @@
 
 <div class="method">
     <code class="details" id="update">update(enterpriseId, userId, deviceId, body=None, updateMask=None, x__xgafv=None)</code>
-  <pre>Updates the device policy. To ensure the policy is properly enforced, you need to prevent unmanaged accounts from accessing Google Play by setting the allowed_accounts in the managed configuration for the Google Play package. See restrict accounts in Google Play.
+  <pre>Updates the device policy. To ensure the policy is properly enforced, you need to prevent unmanaged accounts from accessing Google Play by setting the allowed_accounts in the managed configuration for the Google Play package. See restrict accounts in Google Play. When provisioning a new device, you should set the device policy using this method before adding the managed Google Play Account to the device, otherwise the policy will not be applied for a short period of time after adding the account to the device.
 
 Args:
   enterpriseId: string, The ID of the enterprise. (required)
diff --git a/docs/dyn/androidmanagement_v1.enterprises.devices.html b/docs/dyn/androidmanagement_v1.enterprises.devices.html
index 404be39..c67de4a 100644
--- a/docs/dyn/androidmanagement_v1.enterprises.devices.html
+++ b/docs/dyn/androidmanagement_v1.enterprises.devices.html
@@ -295,7 +295,7 @@
       &quot;eventType&quot;: &quot;A String&quot;, # Event type.
     },
   ],
-  &quot;memoryInfo&quot;: { # Information about device memory and storage. # Memory information. This information is only available if memoryInfoEnabled is true in the device&#x27;s policy.
+  &quot;memoryInfo&quot;: { # Information about device memory and storage. # Memory information: contains information about device memory and storage.
     &quot;totalInternalStorage&quot;: &quot;A String&quot;, # Total internal storage on device in bytes.
     &quot;totalRam&quot;: &quot;A String&quot;, # Total RAM on device in bytes.
   },
@@ -597,7 +597,7 @@
           &quot;eventType&quot;: &quot;A String&quot;, # Event type.
         },
       ],
-      &quot;memoryInfo&quot;: { # Information about device memory and storage. # Memory information. This information is only available if memoryInfoEnabled is true in the device&#x27;s policy.
+      &quot;memoryInfo&quot;: { # Information about device memory and storage. # Memory information: contains information about device memory and storage.
         &quot;totalInternalStorage&quot;: &quot;A String&quot;, # Total internal storage on device in bytes.
         &quot;totalRam&quot;: &quot;A String&quot;, # Total RAM on device in bytes.
       },
@@ -857,7 +857,7 @@
       &quot;eventType&quot;: &quot;A String&quot;, # Event type.
     },
   ],
-  &quot;memoryInfo&quot;: { # Information about device memory and storage. # Memory information. This information is only available if memoryInfoEnabled is true in the device&#x27;s policy.
+  &quot;memoryInfo&quot;: { # Information about device memory and storage. # Memory information: contains information about device memory and storage.
     &quot;totalInternalStorage&quot;: &quot;A String&quot;, # Total internal storage on device in bytes.
     &quot;totalRam&quot;: &quot;A String&quot;, # Total RAM on device in bytes.
   },
@@ -1099,7 +1099,7 @@
       &quot;eventType&quot;: &quot;A String&quot;, # Event type.
     },
   ],
-  &quot;memoryInfo&quot;: { # Information about device memory and storage. # Memory information. This information is only available if memoryInfoEnabled is true in the device&#x27;s policy.
+  &quot;memoryInfo&quot;: { # Information about device memory and storage. # Memory information: contains information about device memory and storage.
     &quot;totalInternalStorage&quot;: &quot;A String&quot;, # Total internal storage on device in bytes.
     &quot;totalRam&quot;: &quot;A String&quot;, # Total RAM on device in bytes.
   },
diff --git a/docs/dyn/androidmanagement_v1.enterprises.policies.html b/docs/dyn/androidmanagement_v1.enterprises.policies.html
index 6b16fe0..3d2e472 100644
--- a/docs/dyn/androidmanagement_v1.enterprises.policies.html
+++ b/docs/dyn/androidmanagement_v1.enterprises.policies.html
@@ -422,7 +422,7 @@
     &quot;deviceSettingsEnabled&quot;: True or False, # Whether device settings reporting is enabled.
     &quot;displayInfoEnabled&quot;: True or False, # Whether displays reporting is enabled. Report data is not available for personally owned devices with work profiles.
     &quot;hardwareStatusEnabled&quot;: True or False, # Whether hardware status reporting is enabled. Report data is not available for personally owned devices with work profiles.
-    &quot;memoryInfoEnabled&quot;: True or False, # Whether memory reporting is enabled.
+    &quot;memoryInfoEnabled&quot;: True or False, # Whether memory event reporting is enabled.
     &quot;networkInfoEnabled&quot;: True or False, # Whether network info reporting is enabled.
     &quot;powerManagementEventsEnabled&quot;: True or False, # Whether power management event reporting is enabled. Report data is not available for personally owned devices with work profiles.
     &quot;softwareInfoEnabled&quot;: True or False, # Whether software info reporting is enabled.
@@ -773,7 +773,7 @@
         &quot;deviceSettingsEnabled&quot;: True or False, # Whether device settings reporting is enabled.
         &quot;displayInfoEnabled&quot;: True or False, # Whether displays reporting is enabled. Report data is not available for personally owned devices with work profiles.
         &quot;hardwareStatusEnabled&quot;: True or False, # Whether hardware status reporting is enabled. Report data is not available for personally owned devices with work profiles.
-        &quot;memoryInfoEnabled&quot;: True or False, # Whether memory reporting is enabled.
+        &quot;memoryInfoEnabled&quot;: True or False, # Whether memory event reporting is enabled.
         &quot;networkInfoEnabled&quot;: True or False, # Whether network info reporting is enabled.
         &quot;powerManagementEventsEnabled&quot;: True or False, # Whether power management event reporting is enabled. Report data is not available for personally owned devices with work profiles.
         &quot;softwareInfoEnabled&quot;: True or False, # Whether software info reporting is enabled.
@@ -1130,7 +1130,7 @@
     &quot;deviceSettingsEnabled&quot;: True or False, # Whether device settings reporting is enabled.
     &quot;displayInfoEnabled&quot;: True or False, # Whether displays reporting is enabled. Report data is not available for personally owned devices with work profiles.
     &quot;hardwareStatusEnabled&quot;: True or False, # Whether hardware status reporting is enabled. Report data is not available for personally owned devices with work profiles.
-    &quot;memoryInfoEnabled&quot;: True or False, # Whether memory reporting is enabled.
+    &quot;memoryInfoEnabled&quot;: True or False, # Whether memory event reporting is enabled.
     &quot;networkInfoEnabled&quot;: True or False, # Whether network info reporting is enabled.
     &quot;powerManagementEventsEnabled&quot;: True or False, # Whether power management event reporting is enabled. Report data is not available for personally owned devices with work profiles.
     &quot;softwareInfoEnabled&quot;: True or False, # Whether software info reporting is enabled.
@@ -1470,7 +1470,7 @@
     &quot;deviceSettingsEnabled&quot;: True or False, # Whether device settings reporting is enabled.
     &quot;displayInfoEnabled&quot;: True or False, # Whether displays reporting is enabled. Report data is not available for personally owned devices with work profiles.
     &quot;hardwareStatusEnabled&quot;: True or False, # Whether hardware status reporting is enabled. Report data is not available for personally owned devices with work profiles.
-    &quot;memoryInfoEnabled&quot;: True or False, # Whether memory reporting is enabled.
+    &quot;memoryInfoEnabled&quot;: True or False, # Whether memory event reporting is enabled.
     &quot;networkInfoEnabled&quot;: True or False, # Whether network info reporting is enabled.
     &quot;powerManagementEventsEnabled&quot;: True or False, # Whether power management event reporting is enabled. Report data is not available for personally owned devices with work profiles.
     &quot;softwareInfoEnabled&quot;: True or False, # Whether software info reporting is enabled.
diff --git a/docs/dyn/androidpublisher_v3.inappproducts.html b/docs/dyn/androidpublisher_v3.inappproducts.html
index 2fc5364..8610b52 100644
--- a/docs/dyn/androidpublisher_v3.inappproducts.html
+++ b/docs/dyn/androidpublisher_v3.inappproducts.html
@@ -93,7 +93,7 @@
   <code><a href="#patch">patch(packageName, sku, autoConvertMissingPrices=None, body=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Patches an in-app product (i.e. a managed product or a subscriptions).</p>
 <p class="toc_element">
-  <code><a href="#update">update(packageName, sku, autoConvertMissingPrices=None, body=None, x__xgafv=None)</a></code></p>
+  <code><a href="#update">update(packageName, sku, allowMissing=None, autoConvertMissingPrices=None, body=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Updates an in-app product (i.e. a managed product or a subscriptions).</p>
 <h3>Method Details</h3>
 <div class="method">
@@ -383,7 +383,7 @@
 </div>
 
 <div class="method">
-    <code class="details" id="update">update(packageName, sku, autoConvertMissingPrices=None, body=None, x__xgafv=None)</code>
+    <code class="details" id="update">update(packageName, sku, allowMissing=None, autoConvertMissingPrices=None, body=None, x__xgafv=None)</code>
   <pre>Updates an in-app product (i.e. a managed product or a subscriptions).
 
 Args:
@@ -422,6 +422,7 @@
   &quot;trialPeriod&quot;: &quot;A String&quot;, # Trial period, specified in ISO 8601 format. Acceptable values are anything between P7D (seven days) and P999D (999 days).
 }
 
+  allowMissing: boolean, If set to true, and the in-app product with the given package_name and sku doesn&#x27;t exist, the in-app product will be created.
   autoConvertMissingPrices: boolean, If true the prices for all regions targeted by the parent app that don&#x27;t have a price specified for this in-app product will be auto converted to the target currency based on the default price. Defaults to false.
   x__xgafv: string, V1 error format.
     Allowed values
diff --git a/docs/dyn/apigee_v1.organizations.apis.deployments.html b/docs/dyn/apigee_v1.organizations.apis.deployments.html
index 8800245..9620cdd 100644
--- a/docs/dyn/apigee_v1.organizations.apis.deployments.html
+++ b/docs/dyn/apigee_v1.organizations.apis.deployments.html
@@ -162,6 +162,7 @@
           &quot;environmentGroup&quot;: &quot;A String&quot;, # Name of the environment group in which this conflict exists.
         },
       ],
+      &quot;serviceAccount&quot;: &quot;A String&quot;, # The full resource name of Cloud IAM Service Account that this deployment is using, eg, `projects/-/serviceAccounts/{email}`.
       &quot;state&quot;: &quot;A String&quot;, # Current state of the deployment. This field is not populated in List APIs.
     },
   ],
diff --git a/docs/dyn/apigee_v1.organizations.apis.html b/docs/dyn/apigee_v1.organizations.apis.html
index c9dfc7d..8837885 100644
--- a/docs/dyn/apigee_v1.organizations.apis.html
+++ b/docs/dyn/apigee_v1.organizations.apis.html
@@ -213,14 +213,17 @@
   An object of the form:
 
     { # Metadata describing the API proxy
-  &quot;latestRevisionId&quot;: &quot;A String&quot;, # The id of the most recently created revision for this api proxy.
-  &quot;metaData&quot;: { # Metadata common to many entities in this API. # Metadata describing the API proxy.
+  &quot;labels&quot;: { # User labels applied to this API Proxy.
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;latestRevisionId&quot;: &quot;A String&quot;, # Output only. The id of the most recently created revision for this api proxy.
+  &quot;metaData&quot;: { # Metadata common to many entities in this API. # Output only. Metadata describing the API proxy.
     &quot;createdAt&quot;: &quot;A String&quot;, # Time at which the API proxy was created, in milliseconds since epoch.
     &quot;lastModifiedAt&quot;: &quot;A String&quot;, # Time at which the API proxy was most recently modified, in milliseconds since epoch.
     &quot;subType&quot;: &quot;A String&quot;, # The type of entity described
   },
-  &quot;name&quot;: &quot;A String&quot;, # Name of the API proxy.
-  &quot;revision&quot;: [ # List of revisons defined for the API proxy.
+  &quot;name&quot;: &quot;A String&quot;, # Output only. Name of the API proxy.
+  &quot;revision&quot;: [ # Output only. List of revisons defined for the API proxy.
     &quot;A String&quot;,
   ],
 }</pre>
@@ -241,14 +244,17 @@
   An object of the form:
 
     { # Metadata describing the API proxy
-  &quot;latestRevisionId&quot;: &quot;A String&quot;, # The id of the most recently created revision for this api proxy.
-  &quot;metaData&quot;: { # Metadata common to many entities in this API. # Metadata describing the API proxy.
+  &quot;labels&quot;: { # User labels applied to this API Proxy.
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;latestRevisionId&quot;: &quot;A String&quot;, # Output only. The id of the most recently created revision for this api proxy.
+  &quot;metaData&quot;: { # Metadata common to many entities in this API. # Output only. Metadata describing the API proxy.
     &quot;createdAt&quot;: &quot;A String&quot;, # Time at which the API proxy was created, in milliseconds since epoch.
     &quot;lastModifiedAt&quot;: &quot;A String&quot;, # Time at which the API proxy was most recently modified, in milliseconds since epoch.
     &quot;subType&quot;: &quot;A String&quot;, # The type of entity described
   },
-  &quot;name&quot;: &quot;A String&quot;, # Name of the API proxy.
-  &quot;revision&quot;: [ # List of revisons defined for the API proxy.
+  &quot;name&quot;: &quot;A String&quot;, # Output only. Name of the API proxy.
+  &quot;revision&quot;: [ # Output only. List of revisons defined for the API proxy.
     &quot;A String&quot;,
   ],
 }</pre>
@@ -273,14 +279,17 @@
     {
   &quot;proxies&quot;: [
     { # Metadata describing the API proxy
-      &quot;latestRevisionId&quot;: &quot;A String&quot;, # The id of the most recently created revision for this api proxy.
-      &quot;metaData&quot;: { # Metadata common to many entities in this API. # Metadata describing the API proxy.
+      &quot;labels&quot;: { # User labels applied to this API Proxy.
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+      &quot;latestRevisionId&quot;: &quot;A String&quot;, # Output only. The id of the most recently created revision for this api proxy.
+      &quot;metaData&quot;: { # Metadata common to many entities in this API. # Output only. Metadata describing the API proxy.
         &quot;createdAt&quot;: &quot;A String&quot;, # Time at which the API proxy was created, in milliseconds since epoch.
         &quot;lastModifiedAt&quot;: &quot;A String&quot;, # Time at which the API proxy was most recently modified, in milliseconds since epoch.
         &quot;subType&quot;: &quot;A String&quot;, # The type of entity described
       },
-      &quot;name&quot;: &quot;A String&quot;, # Name of the API proxy.
-      &quot;revision&quot;: [ # List of revisons defined for the API proxy.
+      &quot;name&quot;: &quot;A String&quot;, # Output only. Name of the API proxy.
+      &quot;revision&quot;: [ # Output only. List of revisons defined for the API proxy.
         &quot;A String&quot;,
       ],
     },
diff --git a/docs/dyn/apigee_v1.organizations.apis.revisions.deployments.html b/docs/dyn/apigee_v1.organizations.apis.revisions.deployments.html
index 1e28535..702cef0 100644
--- a/docs/dyn/apigee_v1.organizations.apis.revisions.deployments.html
+++ b/docs/dyn/apigee_v1.organizations.apis.revisions.deployments.html
@@ -162,6 +162,7 @@
           &quot;environmentGroup&quot;: &quot;A String&quot;, # Name of the environment group in which this conflict exists.
         },
       ],
+      &quot;serviceAccount&quot;: &quot;A String&quot;, # The full resource name of Cloud IAM Service Account that this deployment is using, eg, `projects/-/serviceAccounts/{email}`.
       &quot;state&quot;: &quot;A String&quot;, # Current state of the deployment. This field is not populated in List APIs.
     },
   ],
diff --git a/docs/dyn/apigee_v1.organizations.deployments.html b/docs/dyn/apigee_v1.organizations.deployments.html
index 0ae570e..4ce3a3d 100644
--- a/docs/dyn/apigee_v1.organizations.deployments.html
+++ b/docs/dyn/apigee_v1.organizations.deployments.html
@@ -163,6 +163,7 @@
           &quot;environmentGroup&quot;: &quot;A String&quot;, # Name of the environment group in which this conflict exists.
         },
       ],
+      &quot;serviceAccount&quot;: &quot;A String&quot;, # The full resource name of Cloud IAM Service Account that this deployment is using, eg, `projects/-/serviceAccounts/{email}`.
       &quot;state&quot;: &quot;A String&quot;, # Current state of the deployment. This field is not populated in List APIs.
     },
   ],
diff --git a/docs/dyn/apigee_v1.organizations.environments.apis.deployments.html b/docs/dyn/apigee_v1.organizations.environments.apis.deployments.html
index 72b8196..d96f2a0 100644
--- a/docs/dyn/apigee_v1.organizations.environments.apis.deployments.html
+++ b/docs/dyn/apigee_v1.organizations.environments.apis.deployments.html
@@ -162,6 +162,7 @@
           &quot;environmentGroup&quot;: &quot;A String&quot;, # Name of the environment group in which this conflict exists.
         },
       ],
+      &quot;serviceAccount&quot;: &quot;A String&quot;, # The full resource name of Cloud IAM Service Account that this deployment is using, eg, `projects/-/serviceAccounts/{email}`.
       &quot;state&quot;: &quot;A String&quot;, # Current state of the deployment. This field is not populated in List APIs.
     },
   ],
diff --git a/docs/dyn/apigee_v1.organizations.environments.apis.revisions.html b/docs/dyn/apigee_v1.organizations.environments.apis.revisions.html
index 09a7e0b..8484bad 100644
--- a/docs/dyn/apigee_v1.organizations.environments.apis.revisions.html
+++ b/docs/dyn/apigee_v1.organizations.environments.apis.revisions.html
@@ -88,7 +88,7 @@
   <code><a href="#close">close()</a></code></p>
 <p class="firstline">Close httplib2 connections.</p>
 <p class="toc_element">
-  <code><a href="#deploy">deploy(name, override=None, sequencedRollout=None, x__xgafv=None)</a></code></p>
+  <code><a href="#deploy">deploy(name, override=None, sequencedRollout=None, serviceAccount=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Deploys a revision of an API proxy. If another revision of the same API proxy revision is currently deployed, set the `override` parameter to `true` to have this revision replace the currently deployed revision. You cannot invoke an API proxy until it has been deployed to an environment. After you deploy an API proxy revision, you cannot edit it. To edit the API proxy, you must create and deploy a new revision. For a request path `organizations/{org}/environments/{env}/apis/{api}/revisions/{rev}/deployments`, two permissions are required: * `apigee.deployments.create` on the resource `organizations/{org}/environments/{env}` * `apigee.proxyrevisions.deploy` on the resource `organizations/{org}/apis/{api}/revisions/{rev}` </p>
 <p class="toc_element">
   <code><a href="#getDeployments">getDeployments(name, x__xgafv=None)</a></code></p>
@@ -103,13 +103,14 @@
 </div>
 
 <div class="method">
-    <code class="details" id="deploy">deploy(name, override=None, sequencedRollout=None, x__xgafv=None)</code>
+    <code class="details" id="deploy">deploy(name, override=None, sequencedRollout=None, serviceAccount=None, x__xgafv=None)</code>
   <pre>Deploys a revision of an API proxy. If another revision of the same API proxy revision is currently deployed, set the `override` parameter to `true` to have this revision replace the currently deployed revision. You cannot invoke an API proxy until it has been deployed to an environment. After you deploy an API proxy revision, you cannot edit it. To edit the API proxy, you must create and deploy a new revision. For a request path `organizations/{org}/environments/{env}/apis/{api}/revisions/{rev}/deployments`, two permissions are required: * `apigee.deployments.create` on the resource `organizations/{org}/environments/{env}` * `apigee.proxyrevisions.deploy` on the resource `organizations/{org}/apis/{api}/revisions/{rev}` 
 
 Args:
   name: string, Required. Name of the API proxy revision deployment in the following format: `organizations/{org}/environments/{env}/apis/{api}/revisions/{rev}` (required)
   override: boolean, Flag that specifies whether the new deployment replaces other deployed revisions of the API proxy in the environment. Set `override` to `true` to replace other deployed revisions. By default, `override` is `false` and the deployment is rejected if other revisions of the API proxy are deployed in the environment.
   sequencedRollout: boolean, Flag that specifies whether to enable sequenced rollout. If set to `true`, a best-effort attempt will be made to roll out the routing rules corresponding to this deployment and the environment changes to add this deployment in a safe order. This reduces the risk of downtime that could be caused by changing the environment group&#x27;s routing before the new destination for the affected traffic is ready to receive it. This should only be necessary if the new deployment will be capturing traffic from another environment under a shared environment group or if traffic will be rerouted to a different environment due to a base path removal. The [GenerateDeployChangeReport API](GenerateDeployChangeReport) may be used to examine routing changes before issuing the deployment request, and its response will indicate if a sequenced rollout is recommended for the deployment.
+  serviceAccount: string, Google Cloud IAM service account. The service account represents the identity of the deployed proxy, and determines what permissions it has. The format must be `{ACCOUNT_ID}@{PROJECT}.iam.gserviceaccount.com`.
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
@@ -178,6 +179,7 @@
       &quot;environmentGroup&quot;: &quot;A String&quot;, # Name of the environment group in which this conflict exists.
     },
   ],
+  &quot;serviceAccount&quot;: &quot;A String&quot;, # The full resource name of Cloud IAM Service Account that this deployment is using, eg, `projects/-/serviceAccounts/{email}`.
   &quot;state&quot;: &quot;A String&quot;, # Current state of the deployment. This field is not populated in List APIs.
 }</pre>
 </div>
@@ -256,6 +258,7 @@
       &quot;environmentGroup&quot;: &quot;A String&quot;, # Name of the environment group in which this conflict exists.
     },
   ],
+  &quot;serviceAccount&quot;: &quot;A String&quot;, # The full resource name of Cloud IAM Service Account that this deployment is using, eg, `projects/-/serviceAccounts/{email}`.
   &quot;state&quot;: &quot;A String&quot;, # Current state of the deployment. This field is not populated in List APIs.
 }</pre>
 </div>
diff --git a/docs/dyn/apigee_v1.organizations.environments.deployments.html b/docs/dyn/apigee_v1.organizations.environments.deployments.html
index 0a6d7b9..110b096 100644
--- a/docs/dyn/apigee_v1.organizations.environments.deployments.html
+++ b/docs/dyn/apigee_v1.organizations.environments.deployments.html
@@ -163,6 +163,7 @@
           &quot;environmentGroup&quot;: &quot;A String&quot;, # Name of the environment group in which this conflict exists.
         },
       ],
+      &quot;serviceAccount&quot;: &quot;A String&quot;, # The full resource name of Cloud IAM Service Account that this deployment is using, eg, `projects/-/serviceAccounts/{email}`.
       &quot;state&quot;: &quot;A String&quot;, # Current state of the deployment. This field is not populated in List APIs.
     },
   ],
diff --git a/docs/dyn/apigee_v1.organizations.environments.sharedflows.deployments.html b/docs/dyn/apigee_v1.organizations.environments.sharedflows.deployments.html
index 74a70e9..d223153 100644
--- a/docs/dyn/apigee_v1.organizations.environments.sharedflows.deployments.html
+++ b/docs/dyn/apigee_v1.organizations.environments.sharedflows.deployments.html
@@ -162,6 +162,7 @@
           &quot;environmentGroup&quot;: &quot;A String&quot;, # Name of the environment group in which this conflict exists.
         },
       ],
+      &quot;serviceAccount&quot;: &quot;A String&quot;, # The full resource name of Cloud IAM Service Account that this deployment is using, eg, `projects/-/serviceAccounts/{email}`.
       &quot;state&quot;: &quot;A String&quot;, # Current state of the deployment. This field is not populated in List APIs.
     },
   ],
diff --git a/docs/dyn/apigee_v1.organizations.environments.sharedflows.revisions.html b/docs/dyn/apigee_v1.organizations.environments.sharedflows.revisions.html
index ffa5efa..23ef5bd 100644
--- a/docs/dyn/apigee_v1.organizations.environments.sharedflows.revisions.html
+++ b/docs/dyn/apigee_v1.organizations.environments.sharedflows.revisions.html
@@ -78,7 +78,7 @@
   <code><a href="#close">close()</a></code></p>
 <p class="firstline">Close httplib2 connections.</p>
 <p class="toc_element">
-  <code><a href="#deploy">deploy(name, override=None, x__xgafv=None)</a></code></p>
+  <code><a href="#deploy">deploy(name, override=None, serviceAccount=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Deploys a revision of a shared flow. If another revision of the same shared flow is currently deployed, set the `override` parameter to `true` to have this revision replace the currently deployed revision. You cannot use a shared flow until it has been deployed to an environment. For a request path `organizations/{org}/environments/{env}/sharedflows/{sf}/revisions/{rev}/deployments`, two permissions are required: * `apigee.deployments.create` on the resource `organizations/{org}/environments/{env}` * `apigee.sharedflowrevisions.deploy` on the resource `organizations/{org}/sharedflows/{sf}/revisions/{rev}`</p>
 <p class="toc_element">
   <code><a href="#getDeployments">getDeployments(name, x__xgafv=None)</a></code></p>
@@ -93,12 +93,13 @@
 </div>
 
 <div class="method">
-    <code class="details" id="deploy">deploy(name, override=None, x__xgafv=None)</code>
+    <code class="details" id="deploy">deploy(name, override=None, serviceAccount=None, x__xgafv=None)</code>
   <pre>Deploys a revision of a shared flow. If another revision of the same shared flow is currently deployed, set the `override` parameter to `true` to have this revision replace the currently deployed revision. You cannot use a shared flow until it has been deployed to an environment. For a request path `organizations/{org}/environments/{env}/sharedflows/{sf}/revisions/{rev}/deployments`, two permissions are required: * `apigee.deployments.create` on the resource `organizations/{org}/environments/{env}` * `apigee.sharedflowrevisions.deploy` on the resource `organizations/{org}/sharedflows/{sf}/revisions/{rev}`
 
 Args:
   name: string, Required. Name of the shared flow revision to deploy in the following format: `organizations/{org}/environments/{env}/sharedflows/{sharedflow}/revisions/{rev}` (required)
   override: boolean, Flag that specifies whether the new deployment replaces other deployed revisions of the shared flow in the environment. Set `override` to `true` to replace other deployed revisions. By default, `override` is `false` and the deployment is rejected if other revisions of the shared flow are deployed in the environment.
+  serviceAccount: string, Google Cloud IAM service account. The service account represents the identity of the deployed proxy, and determines what permissions it has. The format must be `{ACCOUNT_ID}@{PROJECT}.iam.gserviceaccount.com`.
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
@@ -167,6 +168,7 @@
       &quot;environmentGroup&quot;: &quot;A String&quot;, # Name of the environment group in which this conflict exists.
     },
   ],
+  &quot;serviceAccount&quot;: &quot;A String&quot;, # The full resource name of Cloud IAM Service Account that this deployment is using, eg, `projects/-/serviceAccounts/{email}`.
   &quot;state&quot;: &quot;A String&quot;, # Current state of the deployment. This field is not populated in List APIs.
 }</pre>
 </div>
@@ -245,6 +247,7 @@
       &quot;environmentGroup&quot;: &quot;A String&quot;, # Name of the environment group in which this conflict exists.
     },
   ],
+  &quot;serviceAccount&quot;: &quot;A String&quot;, # The full resource name of Cloud IAM Service Account that this deployment is using, eg, `projects/-/serviceAccounts/{email}`.
   &quot;state&quot;: &quot;A String&quot;, # Current state of the deployment. This field is not populated in List APIs.
 }</pre>
 </div>
diff --git a/docs/dyn/apigee_v1.organizations.sharedflows.deployments.html b/docs/dyn/apigee_v1.organizations.sharedflows.deployments.html
index 145fac0..f7fd840 100644
--- a/docs/dyn/apigee_v1.organizations.sharedflows.deployments.html
+++ b/docs/dyn/apigee_v1.organizations.sharedflows.deployments.html
@@ -162,6 +162,7 @@
           &quot;environmentGroup&quot;: &quot;A String&quot;, # Name of the environment group in which this conflict exists.
         },
       ],
+      &quot;serviceAccount&quot;: &quot;A String&quot;, # The full resource name of Cloud IAM Service Account that this deployment is using, eg, `projects/-/serviceAccounts/{email}`.
       &quot;state&quot;: &quot;A String&quot;, # Current state of the deployment. This field is not populated in List APIs.
     },
   ],
diff --git a/docs/dyn/apigee_v1.organizations.sharedflows.revisions.deployments.html b/docs/dyn/apigee_v1.organizations.sharedflows.revisions.deployments.html
index b97e818..ff63b58 100644
--- a/docs/dyn/apigee_v1.organizations.sharedflows.revisions.deployments.html
+++ b/docs/dyn/apigee_v1.organizations.sharedflows.revisions.deployments.html
@@ -162,6 +162,7 @@
           &quot;environmentGroup&quot;: &quot;A String&quot;, # Name of the environment group in which this conflict exists.
         },
       ],
+      &quot;serviceAccount&quot;: &quot;A String&quot;, # The full resource name of Cloud IAM Service Account that this deployment is using, eg, `projects/-/serviceAccounts/{email}`.
       &quot;state&quot;: &quot;A String&quot;, # Current state of the deployment. This field is not populated in List APIs.
     },
   ],
diff --git a/docs/dyn/appengine_v1beta.apps.services.versions.html b/docs/dyn/appengine_v1beta.apps.services.versions.html
index 205b0d2..6771a5a 100644
--- a/docs/dyn/appengine_v1beta.apps.services.versions.html
+++ b/docs/dyn/appengine_v1beta.apps.services.versions.html
@@ -290,6 +290,7 @@
     &quot;forwardedPorts&quot;: [ # List of ports, or port pairs, to forward from the virtual machine to the application container. Only applicable in the App Engine flexible environment.
       &quot;A String&quot;,
     ],
+    &quot;instanceIpMode&quot;: &quot;A String&quot;, # The IP mode for instances. Only applicable in the App Engine flexible environment.
     &quot;instanceTag&quot;: &quot;A String&quot;, # Tag to apply to the instance during creation. Only applicable in the App Engine flexible environment.
     &quot;name&quot;: &quot;A String&quot;, # Google Compute Engine network where the virtual machines are created. Specify the short name, not the resource path.Defaults to default.
     &quot;sessionAffinity&quot;: True or False, # Enable session affinity. Only applicable in the App Engine flexible environment.
@@ -596,6 +597,7 @@
     &quot;forwardedPorts&quot;: [ # List of ports, or port pairs, to forward from the virtual machine to the application container. Only applicable in the App Engine flexible environment.
       &quot;A String&quot;,
     ],
+    &quot;instanceIpMode&quot;: &quot;A String&quot;, # The IP mode for instances. Only applicable in the App Engine flexible environment.
     &quot;instanceTag&quot;: &quot;A String&quot;, # Tag to apply to the instance during creation. Only applicable in the App Engine flexible environment.
     &quot;name&quot;: &quot;A String&quot;, # Google Compute Engine network where the virtual machines are created. Specify the short name, not the resource path.Defaults to default.
     &quot;sessionAffinity&quot;: True or False, # Enable session affinity. Only applicable in the App Engine flexible environment.
@@ -841,6 +843,7 @@
         &quot;forwardedPorts&quot;: [ # List of ports, or port pairs, to forward from the virtual machine to the application container. Only applicable in the App Engine flexible environment.
           &quot;A String&quot;,
         ],
+        &quot;instanceIpMode&quot;: &quot;A String&quot;, # The IP mode for instances. Only applicable in the App Engine flexible environment.
         &quot;instanceTag&quot;: &quot;A String&quot;, # Tag to apply to the instance during creation. Only applicable in the App Engine flexible environment.
         &quot;name&quot;: &quot;A String&quot;, # Google Compute Engine network where the virtual machines are created. Specify the short name, not the resource path.Defaults to default.
         &quot;sessionAffinity&quot;: True or False, # Enable session affinity. Only applicable in the App Engine flexible environment.
@@ -1089,6 +1092,7 @@
     &quot;forwardedPorts&quot;: [ # List of ports, or port pairs, to forward from the virtual machine to the application container. Only applicable in the App Engine flexible environment.
       &quot;A String&quot;,
     ],
+    &quot;instanceIpMode&quot;: &quot;A String&quot;, # The IP mode for instances. Only applicable in the App Engine flexible environment.
     &quot;instanceTag&quot;: &quot;A String&quot;, # Tag to apply to the instance during creation. Only applicable in the App Engine flexible environment.
     &quot;name&quot;: &quot;A String&quot;, # Google Compute Engine network where the virtual machines are created. Specify the short name, not the resource path.Defaults to default.
     &quot;sessionAffinity&quot;: True or False, # Enable session affinity. Only applicable in the App Engine flexible environment.
diff --git a/docs/dyn/assuredworkloads_v1.organizations.locations.workloads.html b/docs/dyn/assuredworkloads_v1.organizations.locations.workloads.html
index cf6360f..0fb6d01 100644
--- a/docs/dyn/assuredworkloads_v1.organizations.locations.workloads.html
+++ b/docs/dyn/assuredworkloads_v1.organizations.locations.workloads.html
@@ -124,7 +124,7 @@
     &quot;a_key&quot;: &quot;A String&quot;,
   },
   &quot;name&quot;: &quot;A String&quot;, # Optional. The resource name of the workload. Format: organizations/{organization}/locations/{location}/workloads/{workload} Read-only.
-  &quot;provisionedResourcesParent&quot;: &quot;A String&quot;, # Input only. The parent resource for the resources managed by this Assured Workload. May be either an organization or a folder. Must be the same or a child of the Workload parent. If not specified all resources are created under the Workload parent. Formats: folders/{folder_id} organizations/{organization_id}
+  &quot;provisionedResourcesParent&quot;: &quot;A String&quot;, # Input only. The parent resource for the resources managed by this Assured Workload. May be either empty or a folder resource which is a child of the Workload parent. If not specified all resources are created under the parent organization. Format: folders/{folder_id}
   &quot;resourceSettings&quot;: [ # Input only. Resource properties that are used to customize workload resources. These properties (such as custom project id) will be used to create workload resources if possible. This field is optional.
     { # Represent the custom settings for the resources to be created.
       &quot;displayName&quot;: &quot;A String&quot;, # User-assigned resource display name. If not empty it will be used to create a resource with the specified name.
@@ -217,7 +217,7 @@
     &quot;a_key&quot;: &quot;A String&quot;,
   },
   &quot;name&quot;: &quot;A String&quot;, # Optional. The resource name of the workload. Format: organizations/{organization}/locations/{location}/workloads/{workload} Read-only.
-  &quot;provisionedResourcesParent&quot;: &quot;A String&quot;, # Input only. The parent resource for the resources managed by this Assured Workload. May be either an organization or a folder. Must be the same or a child of the Workload parent. If not specified all resources are created under the Workload parent. Formats: folders/{folder_id} organizations/{organization_id}
+  &quot;provisionedResourcesParent&quot;: &quot;A String&quot;, # Input only. The parent resource for the resources managed by this Assured Workload. May be either empty or a folder resource which is a child of the Workload parent. If not specified all resources are created under the parent organization. Format: folders/{folder_id}
   &quot;resourceSettings&quot;: [ # Input only. Resource properties that are used to customize workload resources. These properties (such as custom project id) will be used to create workload resources if possible. This field is optional.
     { # Represent the custom settings for the resources to be created.
       &quot;displayName&quot;: &quot;A String&quot;, # User-assigned resource display name. If not empty it will be used to create a resource with the specified name.
@@ -268,7 +268,7 @@
         &quot;a_key&quot;: &quot;A String&quot;,
       },
       &quot;name&quot;: &quot;A String&quot;, # Optional. The resource name of the workload. Format: organizations/{organization}/locations/{location}/workloads/{workload} Read-only.
-      &quot;provisionedResourcesParent&quot;: &quot;A String&quot;, # Input only. The parent resource for the resources managed by this Assured Workload. May be either an organization or a folder. Must be the same or a child of the Workload parent. If not specified all resources are created under the Workload parent. Formats: folders/{folder_id} organizations/{organization_id}
+      &quot;provisionedResourcesParent&quot;: &quot;A String&quot;, # Input only. The parent resource for the resources managed by this Assured Workload. May be either empty or a folder resource which is a child of the Workload parent. If not specified all resources are created under the parent organization. Format: folders/{folder_id}
       &quot;resourceSettings&quot;: [ # Input only. Resource properties that are used to customize workload resources. These properties (such as custom project id) will be used to create workload resources if possible. This field is optional.
         { # Represent the custom settings for the resources to be created.
           &quot;displayName&quot;: &quot;A String&quot;, # User-assigned resource display name. If not empty it will be used to create a resource with the specified name.
@@ -324,7 +324,7 @@
     &quot;a_key&quot;: &quot;A String&quot;,
   },
   &quot;name&quot;: &quot;A String&quot;, # Optional. The resource name of the workload. Format: organizations/{organization}/locations/{location}/workloads/{workload} Read-only.
-  &quot;provisionedResourcesParent&quot;: &quot;A String&quot;, # Input only. The parent resource for the resources managed by this Assured Workload. May be either an organization or a folder. Must be the same or a child of the Workload parent. If not specified all resources are created under the Workload parent. Formats: folders/{folder_id} organizations/{organization_id}
+  &quot;provisionedResourcesParent&quot;: &quot;A String&quot;, # Input only. The parent resource for the resources managed by this Assured Workload. May be either empty or a folder resource which is a child of the Workload parent. If not specified all resources are created under the parent organization. Format: folders/{folder_id}
   &quot;resourceSettings&quot;: [ # Input only. Resource properties that are used to customize workload resources. These properties (such as custom project id) will be used to create workload resources if possible. This field is optional.
     { # Represent the custom settings for the resources to be created.
       &quot;displayName&quot;: &quot;A String&quot;, # User-assigned resource display name. If not empty it will be used to create a resource with the specified name.
@@ -363,7 +363,7 @@
     &quot;a_key&quot;: &quot;A String&quot;,
   },
   &quot;name&quot;: &quot;A String&quot;, # Optional. The resource name of the workload. Format: organizations/{organization}/locations/{location}/workloads/{workload} Read-only.
-  &quot;provisionedResourcesParent&quot;: &quot;A String&quot;, # Input only. The parent resource for the resources managed by this Assured Workload. May be either an organization or a folder. Must be the same or a child of the Workload parent. If not specified all resources are created under the Workload parent. Formats: folders/{folder_id} organizations/{organization_id}
+  &quot;provisionedResourcesParent&quot;: &quot;A String&quot;, # Input only. The parent resource for the resources managed by this Assured Workload. May be either empty or a folder resource which is a child of the Workload parent. If not specified all resources are created under the parent organization. Format: folders/{folder_id}
   &quot;resourceSettings&quot;: [ # Input only. Resource properties that are used to customize workload resources. These properties (such as custom project id) will be used to create workload resources if possible. This field is optional.
     { # Represent the custom settings for the resources to be created.
       &quot;displayName&quot;: &quot;A String&quot;, # User-assigned resource display name. If not empty it will be used to create a resource with the specified name.
diff --git a/docs/dyn/bigquerydatatransfer_v1.projects.locations.transferConfigs.html b/docs/dyn/bigquerydatatransfer_v1.projects.locations.transferConfigs.html
index b5b3603..8a2a0ae 100644
--- a/docs/dyn/bigquerydatatransfer_v1.projects.locations.transferConfigs.html
+++ b/docs/dyn/bigquerydatatransfer_v1.projects.locations.transferConfigs.html
@@ -93,7 +93,7 @@
 <p class="firstline">Returns information about a data transfer config.</p>
 <p class="toc_element">
   <code><a href="#list">list(parent, dataSourceIds=None, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Returns information about all data transfers in the project.</p>
+<p class="firstline">Returns information about all transfer configs owned by a project in the specified location.</p>
 <p class="toc_element">
   <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
 <p class="firstline">Retrieves the next page of results.</p>
@@ -249,7 +249,7 @@
 
 <div class="method">
     <code class="details" id="list">list(parent, dataSourceIds=None, pageSize=None, pageToken=None, x__xgafv=None)</code>
-  <pre>Returns information about all data transfers in the project.
+  <pre>Returns information about all transfer configs owned by a project in the specified location.
 
 Args:
   parent: string, Required. The BigQuery project id for which data sources should be returned: `projects/{project_id}` or `projects/{project_id}/locations/{location_id}` (required)
diff --git a/docs/dyn/bigquerydatatransfer_v1.projects.transferConfigs.html b/docs/dyn/bigquerydatatransfer_v1.projects.transferConfigs.html
index acff0cc..4862f36 100644
--- a/docs/dyn/bigquerydatatransfer_v1.projects.transferConfigs.html
+++ b/docs/dyn/bigquerydatatransfer_v1.projects.transferConfigs.html
@@ -93,7 +93,7 @@
 <p class="firstline">Returns information about a data transfer config.</p>
 <p class="toc_element">
   <code><a href="#list">list(parent, dataSourceIds=None, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Returns information about all data transfers in the project.</p>
+<p class="firstline">Returns information about all transfer configs owned by a project in the specified location.</p>
 <p class="toc_element">
   <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
 <p class="firstline">Retrieves the next page of results.</p>
@@ -249,7 +249,7 @@
 
 <div class="method">
     <code class="details" id="list">list(parent, dataSourceIds=None, pageSize=None, pageToken=None, x__xgafv=None)</code>
-  <pre>Returns information about all data transfers in the project.
+  <pre>Returns information about all transfer configs owned by a project in the specified location.
 
 Args:
   parent: string, Required. The BigQuery project id for which data sources should be returned: `projects/{project_id}` or `projects/{project_id}/locations/{location_id}` (required)
diff --git a/docs/dyn/chromepolicy_v1.customers.policySchemas.html b/docs/dyn/chromepolicy_v1.customers.policySchemas.html
index a7bacc2..01be377 100644
--- a/docs/dyn/chromepolicy_v1.customers.policySchemas.html
+++ b/docs/dyn/chromepolicy_v1.customers.policySchemas.html
@@ -173,6 +173,12 @@
     { # Provides detailed information for a particular field that is part of a PolicySchema.
       &quot;description&quot;: &quot;A String&quot;, # Output only. The description for the field.
       &quot;field&quot;: &quot;A String&quot;, # Output only. The name of the field for associated with this description.
+      &quot;fieldDependencies&quot;: [ # Output only. Provides a list of fields and the values they must have for this field to be allowed to be set.
+        { # The field and the value it must have for another field to be allowed to be set.
+          &quot;sourceField&quot;: &quot;A String&quot;, # The source field which this field depends on.
+          &quot;sourceFieldValue&quot;: &quot;A String&quot;, # The value which the source field must have for this field to be allowed to be set.
+        },
+      ],
       &quot;inputConstraint&quot;: &quot;A String&quot;, # Output only. Any input constraints associated on the values for the field.
       &quot;knownValueDescriptions&quot;: [ # Output only. If the field has a set of know values, this field will provide a description for these values.
         { # Provides detailed information about a known value that is allowed for a particular field in a PolicySchema.
@@ -287,6 +293,12 @@
         { # Provides detailed information for a particular field that is part of a PolicySchema.
           &quot;description&quot;: &quot;A String&quot;, # Output only. The description for the field.
           &quot;field&quot;: &quot;A String&quot;, # Output only. The name of the field for associated with this description.
+          &quot;fieldDependencies&quot;: [ # Output only. Provides a list of fields and the values they must have for this field to be allowed to be set.
+            { # The field and the value it must have for another field to be allowed to be set.
+              &quot;sourceField&quot;: &quot;A String&quot;, # The source field which this field depends on.
+              &quot;sourceFieldValue&quot;: &quot;A String&quot;, # The value which the source field must have for this field to be allowed to be set.
+            },
+          ],
           &quot;inputConstraint&quot;: &quot;A String&quot;, # Output only. Any input constraints associated on the values for the field.
           &quot;knownValueDescriptions&quot;: [ # Output only. If the field has a set of know values, this field will provide a description for these values.
             { # Provides detailed information about a known value that is allowed for a particular field in a PolicySchema.
diff --git a/docs/dyn/cloudasset_v1.assets.html b/docs/dyn/cloudasset_v1.assets.html
index eaf4d3a..29739ab 100644
--- a/docs/dyn/cloudasset_v1.assets.html
+++ b/docs/dyn/cloudasset_v1.assets.html
@@ -166,12 +166,12 @@
           },
         },
         &quot;description&quot;: &quot;A String&quot;, # Description of the `AccessLevel` and its use. Does not affect behavior.
-        &quot;name&quot;: &quot;A String&quot;, # Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and &#x27;_&#x27;. Format: `accessPolicies/{policy_id}/accessLevels/{short_name}`. The maximum length of the `short_name` component is 50 characters.
+        &quot;name&quot;: &quot;A String&quot;, # Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and &#x27;_&#x27;. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The maximum length of the `access_level` component is 50 characters.
         &quot;title&quot;: &quot;A String&quot;, # Human readable title. Must be unique within the Policy.
       },
       &quot;accessPolicy&quot;: { # `AccessPolicy` is a container for `AccessLevels` (which define the necessary attributes to use Google Cloud services) and `ServicePerimeters` (which define regions of services able to freely pass data within a perimeter). An access policy is globally visible within an organization, and the restrictions it specifies apply to all projects within an organization. # Please also refer to the [access policy user guide](https://cloud.google.com/access-context-manager/docs/overview#access-policies).
         &quot;etag&quot;: &quot;A String&quot;, # Output only. An opaque identifier for the current version of the `AccessPolicy`. This will always be a strongly validated etag, meaning that two Access Polices will be identical if and only if their etags are identical. Clients should not expect this to be in any specific format.
-        &quot;name&quot;: &quot;A String&quot;, # Output only. Resource name of the `AccessPolicy`. Format: `accessPolicies/{policy_id}`
+        &quot;name&quot;: &quot;A String&quot;, # Output only. Resource name of the `AccessPolicy`. Format: `accessPolicies/{access_policy}`
         &quot;parent&quot;: &quot;A String&quot;, # Required. The parent of this `AccessPolicy` in the Cloud Resource Hierarchy. Currently immutable once created. Format: `organizations/{organization_id}`
         &quot;title&quot;: &quot;A String&quot;, # Required. Human readable title. Does not affect behavior.
       },
@@ -387,7 +387,7 @@
       },
       &quot;servicePerimeter&quot;: { # `ServicePerimeter` describes a set of Google Cloud resources which can freely import and export data amongst themselves, but not export outside of the `ServicePerimeter`. If a request with a source within this `ServicePerimeter` has a target outside of the `ServicePerimeter`, the request will be blocked. Otherwise the request is allowed. There are two types of Service Perimeter - Regular and Bridge. Regular Service Perimeters cannot overlap, a single Google Cloud project can only belong to a single regular Service Perimeter. Service Perimeter Bridges can contain only Google Cloud projects as members, a single Google Cloud project may belong to multiple Service Perimeter Bridges. # Please also refer to the [service perimeter user guide](https://cloud.google.com/vpc-service-controls/docs/overview).
         &quot;description&quot;: &quot;A String&quot;, # Description of the `ServicePerimeter` and its use. Does not affect behavior.
-        &quot;name&quot;: &quot;A String&quot;, # Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and &#x27;_&#x27;. Format: `accessPolicies/{policy_id}/servicePerimeters/{short_name}`
+        &quot;name&quot;: &quot;A String&quot;, # Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and &#x27;_&#x27;. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`
         &quot;perimeterType&quot;: &quot;A String&quot;, # Perimeter type indicator. A single project is allowed to be a member of single regular perimeter, but multiple service perimeter bridges. A project cannot be a included in a perimeter bridge without being included in regular perimeter. For perimeter bridges, the restricted service list as well as access level lists must be empty.
         &quot;spec&quot;: { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that describe specific Service Perimeter configuration. # Proposed (or dry run) ServicePerimeter configuration. This configuration allows to specify and test ServicePerimeter configuration without enforcing actual access restrictions. Only allowed to be set when the &quot;use_explicit_dry_run_spec&quot; flag is set.
           &quot;accessLevels&quot;: [ # A list of `AccessLevel` resource names that allow resources within the `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed must be in the same policy as this `ServicePerimeter`. Referencing a nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: `&quot;accessPolicies/MY_POLICY/accessLevels/MY_LEVEL&quot;`. For Service Perimeter Bridge, must be empty.
diff --git a/docs/dyn/cloudasset_v1.v1.html b/docs/dyn/cloudasset_v1.v1.html
index 3f1a469..d49acda 100644
--- a/docs/dyn/cloudasset_v1.v1.html
+++ b/docs/dyn/cloudasset_v1.v1.html
@@ -553,12 +553,12 @@
             },
           },
           &quot;description&quot;: &quot;A String&quot;, # Description of the `AccessLevel` and its use. Does not affect behavior.
-          &quot;name&quot;: &quot;A String&quot;, # Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and &#x27;_&#x27;. Format: `accessPolicies/{policy_id}/accessLevels/{short_name}`. The maximum length of the `short_name` component is 50 characters.
+          &quot;name&quot;: &quot;A String&quot;, # Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and &#x27;_&#x27;. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The maximum length of the `access_level` component is 50 characters.
           &quot;title&quot;: &quot;A String&quot;, # Human readable title. Must be unique within the Policy.
         },
         &quot;accessPolicy&quot;: { # `AccessPolicy` is a container for `AccessLevels` (which define the necessary attributes to use Google Cloud services) and `ServicePerimeters` (which define regions of services able to freely pass data within a perimeter). An access policy is globally visible within an organization, and the restrictions it specifies apply to all projects within an organization. # Please also refer to the [access policy user guide](https://cloud.google.com/access-context-manager/docs/overview#access-policies).
           &quot;etag&quot;: &quot;A String&quot;, # Output only. An opaque identifier for the current version of the `AccessPolicy`. This will always be a strongly validated etag, meaning that two Access Polices will be identical if and only if their etags are identical. Clients should not expect this to be in any specific format.
-          &quot;name&quot;: &quot;A String&quot;, # Output only. Resource name of the `AccessPolicy`. Format: `accessPolicies/{policy_id}`
+          &quot;name&quot;: &quot;A String&quot;, # Output only. Resource name of the `AccessPolicy`. Format: `accessPolicies/{access_policy}`
           &quot;parent&quot;: &quot;A String&quot;, # Required. The parent of this `AccessPolicy` in the Cloud Resource Hierarchy. Currently immutable once created. Format: `organizations/{organization_id}`
           &quot;title&quot;: &quot;A String&quot;, # Required. Human readable title. Does not affect behavior.
         },
@@ -774,7 +774,7 @@
         },
         &quot;servicePerimeter&quot;: { # `ServicePerimeter` describes a set of Google Cloud resources which can freely import and export data amongst themselves, but not export outside of the `ServicePerimeter`. If a request with a source within this `ServicePerimeter` has a target outside of the `ServicePerimeter`, the request will be blocked. Otherwise the request is allowed. There are two types of Service Perimeter - Regular and Bridge. Regular Service Perimeters cannot overlap, a single Google Cloud project can only belong to a single regular Service Perimeter. Service Perimeter Bridges can contain only Google Cloud projects as members, a single Google Cloud project may belong to multiple Service Perimeter Bridges. # Please also refer to the [service perimeter user guide](https://cloud.google.com/vpc-service-controls/docs/overview).
           &quot;description&quot;: &quot;A String&quot;, # Description of the `ServicePerimeter` and its use. Does not affect behavior.
-          &quot;name&quot;: &quot;A String&quot;, # Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and &#x27;_&#x27;. Format: `accessPolicies/{policy_id}/servicePerimeters/{short_name}`
+          &quot;name&quot;: &quot;A String&quot;, # Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and &#x27;_&#x27;. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`
           &quot;perimeterType&quot;: &quot;A String&quot;, # Perimeter type indicator. A single project is allowed to be a member of single regular perimeter, but multiple service perimeter bridges. A project cannot be a included in a perimeter bridge without being included in regular perimeter. For perimeter bridges, the restricted service list as well as access level lists must be empty.
           &quot;spec&quot;: { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that describe specific Service Perimeter configuration. # Proposed (or dry run) ServicePerimeter configuration. This configuration allows to specify and test ServicePerimeter configuration without enforcing actual access restrictions. Only allowed to be set when the &quot;use_explicit_dry_run_spec&quot; flag is set.
             &quot;accessLevels&quot;: [ # A list of `AccessLevel` resource names that allow resources within the `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed must be in the same policy as this `ServicePerimeter`. Referencing a nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: `&quot;accessPolicies/MY_POLICY/accessLevels/MY_LEVEL&quot;`. For Service Perimeter Bridge, must be empty.
@@ -981,12 +981,12 @@
             },
           },
           &quot;description&quot;: &quot;A String&quot;, # Description of the `AccessLevel` and its use. Does not affect behavior.
-          &quot;name&quot;: &quot;A String&quot;, # Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and &#x27;_&#x27;. Format: `accessPolicies/{policy_id}/accessLevels/{short_name}`. The maximum length of the `short_name` component is 50 characters.
+          &quot;name&quot;: &quot;A String&quot;, # Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and &#x27;_&#x27;. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The maximum length of the `access_level` component is 50 characters.
           &quot;title&quot;: &quot;A String&quot;, # Human readable title. Must be unique within the Policy.
         },
         &quot;accessPolicy&quot;: { # `AccessPolicy` is a container for `AccessLevels` (which define the necessary attributes to use Google Cloud services) and `ServicePerimeters` (which define regions of services able to freely pass data within a perimeter). An access policy is globally visible within an organization, and the restrictions it specifies apply to all projects within an organization. # Please also refer to the [access policy user guide](https://cloud.google.com/access-context-manager/docs/overview#access-policies).
           &quot;etag&quot;: &quot;A String&quot;, # Output only. An opaque identifier for the current version of the `AccessPolicy`. This will always be a strongly validated etag, meaning that two Access Polices will be identical if and only if their etags are identical. Clients should not expect this to be in any specific format.
-          &quot;name&quot;: &quot;A String&quot;, # Output only. Resource name of the `AccessPolicy`. Format: `accessPolicies/{policy_id}`
+          &quot;name&quot;: &quot;A String&quot;, # Output only. Resource name of the `AccessPolicy`. Format: `accessPolicies/{access_policy}`
           &quot;parent&quot;: &quot;A String&quot;, # Required. The parent of this `AccessPolicy` in the Cloud Resource Hierarchy. Currently immutable once created. Format: `organizations/{organization_id}`
           &quot;title&quot;: &quot;A String&quot;, # Required. Human readable title. Does not affect behavior.
         },
@@ -1202,7 +1202,7 @@
         },
         &quot;servicePerimeter&quot;: { # `ServicePerimeter` describes a set of Google Cloud resources which can freely import and export data amongst themselves, but not export outside of the `ServicePerimeter`. If a request with a source within this `ServicePerimeter` has a target outside of the `ServicePerimeter`, the request will be blocked. Otherwise the request is allowed. There are two types of Service Perimeter - Regular and Bridge. Regular Service Perimeters cannot overlap, a single Google Cloud project can only belong to a single regular Service Perimeter. Service Perimeter Bridges can contain only Google Cloud projects as members, a single Google Cloud project may belong to multiple Service Perimeter Bridges. # Please also refer to the [service perimeter user guide](https://cloud.google.com/vpc-service-controls/docs/overview).
           &quot;description&quot;: &quot;A String&quot;, # Description of the `ServicePerimeter` and its use. Does not affect behavior.
-          &quot;name&quot;: &quot;A String&quot;, # Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and &#x27;_&#x27;. Format: `accessPolicies/{policy_id}/servicePerimeters/{short_name}`
+          &quot;name&quot;: &quot;A String&quot;, # Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and &#x27;_&#x27;. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`
           &quot;perimeterType&quot;: &quot;A String&quot;, # Perimeter type indicator. A single project is allowed to be a member of single regular perimeter, but multiple service perimeter bridges. A project cannot be a included in a perimeter bridge without being included in regular perimeter. For perimeter bridges, the restricted service list as well as access level lists must be empty.
           &quot;spec&quot;: { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that describe specific Service Perimeter configuration. # Proposed (or dry run) ServicePerimeter configuration. This configuration allows to specify and test ServicePerimeter configuration without enforcing actual access restrictions. Only allowed to be set when the &quot;use_explicit_dry_run_spec&quot; flag is set.
             &quot;accessLevels&quot;: [ # A list of `AccessLevel` resource names that allow resources within the `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed must be in the same policy as this `ServicePerimeter`. Referencing a nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: `&quot;accessPolicies/MY_POLICY/accessLevels/MY_LEVEL&quot;`. For Service Perimeter Bridge, must be empty.
diff --git a/docs/dyn/cloudasset_v1beta1.organizations.html b/docs/dyn/cloudasset_v1beta1.organizations.html
index 552d850..bd02138 100644
--- a/docs/dyn/cloudasset_v1beta1.organizations.html
+++ b/docs/dyn/cloudasset_v1beta1.organizations.html
@@ -163,12 +163,12 @@
             },
           },
           &quot;description&quot;: &quot;A String&quot;, # Description of the `AccessLevel` and its use. Does not affect behavior.
-          &quot;name&quot;: &quot;A String&quot;, # Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and &#x27;_&#x27;. Format: `accessPolicies/{policy_id}/accessLevels/{short_name}`. The maximum length of the `short_name` component is 50 characters.
+          &quot;name&quot;: &quot;A String&quot;, # Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and &#x27;_&#x27;. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The maximum length of the `access_level` component is 50 characters.
           &quot;title&quot;: &quot;A String&quot;, # Human readable title. Must be unique within the Policy.
         },
         &quot;accessPolicy&quot;: { # `AccessPolicy` is a container for `AccessLevels` (which define the necessary attributes to use Google Cloud services) and `ServicePerimeters` (which define regions of services able to freely pass data within a perimeter). An access policy is globally visible within an organization, and the restrictions it specifies apply to all projects within an organization. # Please also refer to the [access policy user guide](https://cloud.google.com/access-context-manager/docs/overview#access-policies).
           &quot;etag&quot;: &quot;A String&quot;, # Output only. An opaque identifier for the current version of the `AccessPolicy`. This will always be a strongly validated etag, meaning that two Access Polices will be identical if and only if their etags are identical. Clients should not expect this to be in any specific format.
-          &quot;name&quot;: &quot;A String&quot;, # Output only. Resource name of the `AccessPolicy`. Format: `accessPolicies/{policy_id}`
+          &quot;name&quot;: &quot;A String&quot;, # Output only. Resource name of the `AccessPolicy`. Format: `accessPolicies/{access_policy}`
           &quot;parent&quot;: &quot;A String&quot;, # Required. The parent of this `AccessPolicy` in the Cloud Resource Hierarchy. Currently immutable once created. Format: `organizations/{organization_id}`
           &quot;title&quot;: &quot;A String&quot;, # Required. Human readable title. Does not affect behavior.
         },
@@ -241,7 +241,7 @@
         },
         &quot;servicePerimeter&quot;: { # `ServicePerimeter` describes a set of Google Cloud resources which can freely import and export data amongst themselves, but not export outside of the `ServicePerimeter`. If a request with a source within this `ServicePerimeter` has a target outside of the `ServicePerimeter`, the request will be blocked. Otherwise the request is allowed. There are two types of Service Perimeter - Regular and Bridge. Regular Service Perimeters cannot overlap, a single Google Cloud project can only belong to a single regular Service Perimeter. Service Perimeter Bridges can contain only Google Cloud projects as members, a single Google Cloud project may belong to multiple Service Perimeter Bridges. # Please also refer to the [service perimeter user guide](https://cloud.google.com/vpc-service-controls/docs/overview).
           &quot;description&quot;: &quot;A String&quot;, # Description of the `ServicePerimeter` and its use. Does not affect behavior.
-          &quot;name&quot;: &quot;A String&quot;, # Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and &#x27;_&#x27;. Format: `accessPolicies/{policy_id}/servicePerimeters/{short_name}`
+          &quot;name&quot;: &quot;A String&quot;, # Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and &#x27;_&#x27;. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`
           &quot;perimeterType&quot;: &quot;A String&quot;, # Perimeter type indicator. A single project is allowed to be a member of single regular perimeter, but multiple service perimeter bridges. A project cannot be a included in a perimeter bridge without being included in regular perimeter. For perimeter bridges, the restricted service list as well as access level lists must be empty.
           &quot;spec&quot;: { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that describe specific Service Perimeter configuration. # Proposed (or dry run) ServicePerimeter configuration. This configuration allows to specify and test ServicePerimeter configuration without enforcing actual access restrictions. Only allowed to be set when the &quot;use_explicit_dry_run_spec&quot; flag is set.
             &quot;accessLevels&quot;: [ # A list of `AccessLevel` resource names that allow resources within the `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed must be in the same policy as this `ServicePerimeter`. Referencing a nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: `&quot;accessPolicies/MY_POLICY/accessLevels/MY_LEVEL&quot;`. For Service Perimeter Bridge, must be empty.
diff --git a/docs/dyn/cloudasset_v1beta1.projects.html b/docs/dyn/cloudasset_v1beta1.projects.html
index 0b85da0..a3c72db 100644
--- a/docs/dyn/cloudasset_v1beta1.projects.html
+++ b/docs/dyn/cloudasset_v1beta1.projects.html
@@ -163,12 +163,12 @@
             },
           },
           &quot;description&quot;: &quot;A String&quot;, # Description of the `AccessLevel` and its use. Does not affect behavior.
-          &quot;name&quot;: &quot;A String&quot;, # Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and &#x27;_&#x27;. Format: `accessPolicies/{policy_id}/accessLevels/{short_name}`. The maximum length of the `short_name` component is 50 characters.
+          &quot;name&quot;: &quot;A String&quot;, # Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and &#x27;_&#x27;. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The maximum length of the `access_level` component is 50 characters.
           &quot;title&quot;: &quot;A String&quot;, # Human readable title. Must be unique within the Policy.
         },
         &quot;accessPolicy&quot;: { # `AccessPolicy` is a container for `AccessLevels` (which define the necessary attributes to use Google Cloud services) and `ServicePerimeters` (which define regions of services able to freely pass data within a perimeter). An access policy is globally visible within an organization, and the restrictions it specifies apply to all projects within an organization. # Please also refer to the [access policy user guide](https://cloud.google.com/access-context-manager/docs/overview#access-policies).
           &quot;etag&quot;: &quot;A String&quot;, # Output only. An opaque identifier for the current version of the `AccessPolicy`. This will always be a strongly validated etag, meaning that two Access Polices will be identical if and only if their etags are identical. Clients should not expect this to be in any specific format.
-          &quot;name&quot;: &quot;A String&quot;, # Output only. Resource name of the `AccessPolicy`. Format: `accessPolicies/{policy_id}`
+          &quot;name&quot;: &quot;A String&quot;, # Output only. Resource name of the `AccessPolicy`. Format: `accessPolicies/{access_policy}`
           &quot;parent&quot;: &quot;A String&quot;, # Required. The parent of this `AccessPolicy` in the Cloud Resource Hierarchy. Currently immutable once created. Format: `organizations/{organization_id}`
           &quot;title&quot;: &quot;A String&quot;, # Required. Human readable title. Does not affect behavior.
         },
@@ -241,7 +241,7 @@
         },
         &quot;servicePerimeter&quot;: { # `ServicePerimeter` describes a set of Google Cloud resources which can freely import and export data amongst themselves, but not export outside of the `ServicePerimeter`. If a request with a source within this `ServicePerimeter` has a target outside of the `ServicePerimeter`, the request will be blocked. Otherwise the request is allowed. There are two types of Service Perimeter - Regular and Bridge. Regular Service Perimeters cannot overlap, a single Google Cloud project can only belong to a single regular Service Perimeter. Service Perimeter Bridges can contain only Google Cloud projects as members, a single Google Cloud project may belong to multiple Service Perimeter Bridges. # Please also refer to the [service perimeter user guide](https://cloud.google.com/vpc-service-controls/docs/overview).
           &quot;description&quot;: &quot;A String&quot;, # Description of the `ServicePerimeter` and its use. Does not affect behavior.
-          &quot;name&quot;: &quot;A String&quot;, # Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and &#x27;_&#x27;. Format: `accessPolicies/{policy_id}/servicePerimeters/{short_name}`
+          &quot;name&quot;: &quot;A String&quot;, # Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and &#x27;_&#x27;. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`
           &quot;perimeterType&quot;: &quot;A String&quot;, # Perimeter type indicator. A single project is allowed to be a member of single regular perimeter, but multiple service perimeter bridges. A project cannot be a included in a perimeter bridge without being included in regular perimeter. For perimeter bridges, the restricted service list as well as access level lists must be empty.
           &quot;spec&quot;: { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that describe specific Service Perimeter configuration. # Proposed (or dry run) ServicePerimeter configuration. This configuration allows to specify and test ServicePerimeter configuration without enforcing actual access restrictions. Only allowed to be set when the &quot;use_explicit_dry_run_spec&quot; flag is set.
             &quot;accessLevels&quot;: [ # A list of `AccessLevel` resource names that allow resources within the `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed must be in the same policy as this `ServicePerimeter`. Referencing a nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: `&quot;accessPolicies/MY_POLICY/accessLevels/MY_LEVEL&quot;`. For Service Perimeter Bridge, must be empty.
diff --git a/docs/dyn/cloudasset_v1p5beta1.assets.html b/docs/dyn/cloudasset_v1p5beta1.assets.html
index a2c7123..b3a65e6 100644
--- a/docs/dyn/cloudasset_v1p5beta1.assets.html
+++ b/docs/dyn/cloudasset_v1p5beta1.assets.html
@@ -165,12 +165,12 @@
           },
         },
         &quot;description&quot;: &quot;A String&quot;, # Description of the `AccessLevel` and its use. Does not affect behavior.
-        &quot;name&quot;: &quot;A String&quot;, # Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and &#x27;_&#x27;. Format: `accessPolicies/{policy_id}/accessLevels/{short_name}`. The maximum length of the `short_name` component is 50 characters.
+        &quot;name&quot;: &quot;A String&quot;, # Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and &#x27;_&#x27;. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The maximum length of the `access_level` component is 50 characters.
         &quot;title&quot;: &quot;A String&quot;, # Human readable title. Must be unique within the Policy.
       },
       &quot;accessPolicy&quot;: { # `AccessPolicy` is a container for `AccessLevels` (which define the necessary attributes to use Google Cloud services) and `ServicePerimeters` (which define regions of services able to freely pass data within a perimeter). An access policy is globally visible within an organization, and the restrictions it specifies apply to all projects within an organization. # Please also refer to the [access policy user guide](https://cloud.google.com/access-context-manager/docs/overview#access-policies).
         &quot;etag&quot;: &quot;A String&quot;, # Output only. An opaque identifier for the current version of the `AccessPolicy`. This will always be a strongly validated etag, meaning that two Access Polices will be identical if and only if their etags are identical. Clients should not expect this to be in any specific format.
-        &quot;name&quot;: &quot;A String&quot;, # Output only. Resource name of the `AccessPolicy`. Format: `accessPolicies/{policy_id}`
+        &quot;name&quot;: &quot;A String&quot;, # Output only. Resource name of the `AccessPolicy`. Format: `accessPolicies/{access_policy}`
         &quot;parent&quot;: &quot;A String&quot;, # Required. The parent of this `AccessPolicy` in the Cloud Resource Hierarchy. Currently immutable once created. Format: `organizations/{organization_id}`
         &quot;title&quot;: &quot;A String&quot;, # Required. Human readable title. Does not affect behavior.
       },
@@ -246,7 +246,7 @@
       },
       &quot;servicePerimeter&quot;: { # `ServicePerimeter` describes a set of Google Cloud resources which can freely import and export data amongst themselves, but not export outside of the `ServicePerimeter`. If a request with a source within this `ServicePerimeter` has a target outside of the `ServicePerimeter`, the request will be blocked. Otherwise the request is allowed. There are two types of Service Perimeter - Regular and Bridge. Regular Service Perimeters cannot overlap, a single Google Cloud project can only belong to a single regular Service Perimeter. Service Perimeter Bridges can contain only Google Cloud projects as members, a single Google Cloud project may belong to multiple Service Perimeter Bridges. # Please also refer to the [service perimeter user guide](https://cloud.google.com/vpc-service-controls/docs/overview).
         &quot;description&quot;: &quot;A String&quot;, # Description of the `ServicePerimeter` and its use. Does not affect behavior.
-        &quot;name&quot;: &quot;A String&quot;, # Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and &#x27;_&#x27;. Format: `accessPolicies/{policy_id}/servicePerimeters/{short_name}`
+        &quot;name&quot;: &quot;A String&quot;, # Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and &#x27;_&#x27;. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`
         &quot;perimeterType&quot;: &quot;A String&quot;, # Perimeter type indicator. A single project is allowed to be a member of single regular perimeter, but multiple service perimeter bridges. A project cannot be a included in a perimeter bridge without being included in regular perimeter. For perimeter bridges, the restricted service list as well as access level lists must be empty.
         &quot;spec&quot;: { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that describe specific Service Perimeter configuration. # Proposed (or dry run) ServicePerimeter configuration. This configuration allows to specify and test ServicePerimeter configuration without enforcing actual access restrictions. Only allowed to be set when the &quot;use_explicit_dry_run_spec&quot; flag is set.
           &quot;accessLevels&quot;: [ # A list of `AccessLevel` resource names that allow resources within the `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed must be in the same policy as this `ServicePerimeter`. Referencing a nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: `&quot;accessPolicies/MY_POLICY/accessLevels/MY_LEVEL&quot;`. For Service Perimeter Bridge, must be empty.
diff --git a/docs/dyn/cloudbuild_v1.html b/docs/dyn/cloudbuild_v1.html
index 5a689ed..ed9c61f 100644
--- a/docs/dyn/cloudbuild_v1.html
+++ b/docs/dyn/cloudbuild_v1.html
@@ -85,6 +85,11 @@
 <p class="firstline">Returns the projects Resource.</p>
 
 <p class="toc_element">
+  <code><a href="cloudbuild_v1.v1.html">v1()</a></code>
+</p>
+<p class="firstline">Returns the v1 Resource.</p>
+
+<p class="toc_element">
   <code><a href="#close">close()</a></code></p>
 <p class="firstline">Close httplib2 connections.</p>
 <p class="toc_element">
diff --git a/docs/dyn/cloudbuild_v1.projects.builds.html b/docs/dyn/cloudbuild_v1.projects.builds.html
index ffa4e80..bf6e40b 100644
--- a/docs/dyn/cloudbuild_v1.projects.builds.html
+++ b/docs/dyn/cloudbuild_v1.projects.builds.html
@@ -333,7 +333,7 @@
     &quot;A String&quot;,
   ],
   &quot;timeout&quot;: &quot;A String&quot;, # Amount of time that this build should be allowed to run, to second granularity. If this amount of time elapses, work on the build will cease and the build status will be `TIMEOUT`. `timeout` starts ticking from `startTime`. Default time is ten minutes.
-  &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. If the build does not specify source or images, these keys will not be included.
+  &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps. * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. * SETUPBUILD: time to set up build. If the build does not specify source or images, these keys will not be included.
     &quot;a_key&quot;: { # Start and end times for a build execution phase.
       &quot;endTime&quot;: &quot;A String&quot;, # End of time span.
       &quot;startTime&quot;: &quot;A String&quot;, # Start of time span.
@@ -575,7 +575,7 @@
     &quot;A String&quot;,
   ],
   &quot;timeout&quot;: &quot;A String&quot;, # Amount of time that this build should be allowed to run, to second granularity. If this amount of time elapses, work on the build will cease and the build status will be `TIMEOUT`. `timeout` starts ticking from `startTime`. Default time is ten minutes.
-  &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. If the build does not specify source or images, these keys will not be included.
+  &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps. * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. * SETUPBUILD: time to set up build. If the build does not specify source or images, these keys will not be included.
     &quot;a_key&quot;: { # Start and end times for a build execution phase.
       &quot;endTime&quot;: &quot;A String&quot;, # End of time span.
       &quot;startTime&quot;: &quot;A String&quot;, # Start of time span.
@@ -848,7 +848,7 @@
     &quot;A String&quot;,
   ],
   &quot;timeout&quot;: &quot;A String&quot;, # Amount of time that this build should be allowed to run, to second granularity. If this amount of time elapses, work on the build will cease and the build status will be `TIMEOUT`. `timeout` starts ticking from `startTime`. Default time is ten minutes.
-  &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. If the build does not specify source or images, these keys will not be included.
+  &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps. * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. * SETUPBUILD: time to set up build. If the build does not specify source or images, these keys will not be included.
     &quot;a_key&quot;: { # Start and end times for a build execution phase.
       &quot;endTime&quot;: &quot;A String&quot;, # End of time span.
       &quot;startTime&quot;: &quot;A String&quot;, # Start of time span.
@@ -1096,7 +1096,7 @@
         &quot;A String&quot;,
       ],
       &quot;timeout&quot;: &quot;A String&quot;, # Amount of time that this build should be allowed to run, to second granularity. If this amount of time elapses, work on the build will cease and the build status will be `TIMEOUT`. `timeout` starts ticking from `startTime`. Default time is ten minutes.
-      &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. If the build does not specify source or images, these keys will not be included.
+      &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps. * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. * SETUPBUILD: time to set up build. If the build does not specify source or images, these keys will not be included.
         &quot;a_key&quot;: { # Start and end times for a build execution phase.
           &quot;endTime&quot;: &quot;A String&quot;, # End of time span.
           &quot;startTime&quot;: &quot;A String&quot;, # Start of time span.
diff --git a/docs/dyn/cloudbuild_v1.projects.githubEnterpriseConfigs.html b/docs/dyn/cloudbuild_v1.projects.githubEnterpriseConfigs.html
new file mode 100644
index 0000000..944b2b4
--- /dev/null
+++ b/docs/dyn/cloudbuild_v1.projects.githubEnterpriseConfigs.html
@@ -0,0 +1,337 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="cloudbuild_v1.html">Cloud Build API</a> . <a href="cloudbuild_v1.projects.html">projects</a> . <a href="cloudbuild_v1.projects.githubEnterpriseConfigs.html">githubEnterpriseConfigs</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#create">create(parent, body=None, projectId=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Create an association between a GCP project and a GitHub Enterprise server. This API is experimental.</p>
+<p class="toc_element">
+  <code><a href="#delete">delete(name, configId=None, projectId=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Delete an association between a GCP project and a GitHub Enterprise server. This API is experimental.</p>
+<p class="toc_element">
+  <code><a href="#get">get(name, configId=None, projectId=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Retrieve a GitHubEnterpriseConfig. This API is experimental.</p>
+<p class="toc_element">
+  <code><a href="#list">list(parent, projectId=None, x__xgafv=None)</a></code></p>
+<p class="firstline">List all GitHubEnterpriseConfigs for a given project. This API is experimental.</p>
+<p class="toc_element">
+  <code><a href="#patch">patch(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Update an association between a GCP project and a GitHub Enterprise server. This API is experimental.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="create">create(parent, body=None, projectId=None, x__xgafv=None)</code>
+  <pre>Create an association between a GCP project and a GitHub Enterprise server. This API is experimental.
+
+Args:
+  parent: string, Name of the parent project. For example: projects/{$project_number} or projects/{$project_id} (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # GitHubEnterpriseConfig represents a configuration for a GitHub Enterprise server.
+  &quot;appId&quot;: &quot;A String&quot;, # Required. The GitHub app id of the Cloud Build app on the GitHub Enterprise server.
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. Time when the installation was associated with the project.
+  &quot;displayName&quot;: &quot;A String&quot;, # Name to display for this config.
+  &quot;hostUrl&quot;: &quot;A String&quot;, # The URL of the github enterprise host the configuration is for.
+  &quot;name&quot;: &quot;A String&quot;, # Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
+  &quot;peeredNetwork&quot;: &quot;A String&quot;, # Optional. The network to be used when reaching out to the GitHub Enterprise server. The VPC network must be enabled for private service connection. This should be set if the GitHub Enterprise server is hosted on-premises and not reachable by public internet. If this field is left empty, no network peering will occur and calls to the GitHub Enterprise server will be made over the public internet. Must be in the format `projects/{project}/global/networks/{network}`, where {project} is a project number or id and {network} is the name of a VPC network in the project.
+  &quot;secrets&quot;: { # GitHubEnterpriseSecrets represents the names of all necessary secrets in Secret Manager for a GitHub Enterprise server. Format is: projects//secrets/. # Names of secrets in Secret Manager.
+    &quot;oauthClientIdName&quot;: &quot;A String&quot;, # The resource name for the OAuth client ID secret in Secret Manager.
+    &quot;oauthClientIdVersionName&quot;: &quot;A String&quot;, # The resource name for the OAuth client ID secret version in Secret Manager.
+    &quot;oauthSecretName&quot;: &quot;A String&quot;, # The resource name for the OAuth secret in Secret Manager.
+    &quot;oauthSecretVersionName&quot;: &quot;A String&quot;, # The resource name for the OAuth secret secret version in Secret Manager.
+    &quot;privateKeyName&quot;: &quot;A String&quot;, # The resource name for the private key secret.
+    &quot;privateKeyVersionName&quot;: &quot;A String&quot;, # The resource name for the private key secret version.
+    &quot;webhookSecretName&quot;: &quot;A String&quot;, # The resource name for the webhook secret in Secret Manager.
+    &quot;webhookSecretVersionName&quot;: &quot;A String&quot;, # The resource name for the webhook secret secret version in Secret Manager.
+  },
+  &quot;sslCa&quot;: &quot;A String&quot;, # Optional. SSL certificate to use for requests to GitHub Enterprise.
+  &quot;webhookKey&quot;: &quot;A String&quot;, # The key that should be attached to webhook calls to the ReceiveWebhook endpoint.
+}
+
+  projectId: string, ID of the project.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="delete">delete(name, configId=None, projectId=None, x__xgafv=None)</code>
+  <pre>Delete an association between a GCP project and a GitHub Enterprise server. This API is experimental.
+
+Args:
+  name: string, This field should contain the name of the enterprise config resource. For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot; (required)
+  configId: string, Unique identifier of the `GitHubEnterpriseConfig`
+  projectId: string, ID of the project
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="get">get(name, configId=None, projectId=None, x__xgafv=None)</code>
+  <pre>Retrieve a GitHubEnterpriseConfig. This API is experimental.
+
+Args:
+  name: string, This field should contain the name of the enterprise config resource. For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot; (required)
+  configId: string, Unique identifier of the `GitHubEnterpriseConfig`
+  projectId: string, ID of the project
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # GitHubEnterpriseConfig represents a configuration for a GitHub Enterprise server.
+  &quot;appId&quot;: &quot;A String&quot;, # Required. The GitHub app id of the Cloud Build app on the GitHub Enterprise server.
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. Time when the installation was associated with the project.
+  &quot;displayName&quot;: &quot;A String&quot;, # Name to display for this config.
+  &quot;hostUrl&quot;: &quot;A String&quot;, # The URL of the github enterprise host the configuration is for.
+  &quot;name&quot;: &quot;A String&quot;, # Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
+  &quot;peeredNetwork&quot;: &quot;A String&quot;, # Optional. The network to be used when reaching out to the GitHub Enterprise server. The VPC network must be enabled for private service connection. This should be set if the GitHub Enterprise server is hosted on-premises and not reachable by public internet. If this field is left empty, no network peering will occur and calls to the GitHub Enterprise server will be made over the public internet. Must be in the format `projects/{project}/global/networks/{network}`, where {project} is a project number or id and {network} is the name of a VPC network in the project.
+  &quot;secrets&quot;: { # GitHubEnterpriseSecrets represents the names of all necessary secrets in Secret Manager for a GitHub Enterprise server. Format is: projects//secrets/. # Names of secrets in Secret Manager.
+    &quot;oauthClientIdName&quot;: &quot;A String&quot;, # The resource name for the OAuth client ID secret in Secret Manager.
+    &quot;oauthClientIdVersionName&quot;: &quot;A String&quot;, # The resource name for the OAuth client ID secret version in Secret Manager.
+    &quot;oauthSecretName&quot;: &quot;A String&quot;, # The resource name for the OAuth secret in Secret Manager.
+    &quot;oauthSecretVersionName&quot;: &quot;A String&quot;, # The resource name for the OAuth secret secret version in Secret Manager.
+    &quot;privateKeyName&quot;: &quot;A String&quot;, # The resource name for the private key secret.
+    &quot;privateKeyVersionName&quot;: &quot;A String&quot;, # The resource name for the private key secret version.
+    &quot;webhookSecretName&quot;: &quot;A String&quot;, # The resource name for the webhook secret in Secret Manager.
+    &quot;webhookSecretVersionName&quot;: &quot;A String&quot;, # The resource name for the webhook secret secret version in Secret Manager.
+  },
+  &quot;sslCa&quot;: &quot;A String&quot;, # Optional. SSL certificate to use for requests to GitHub Enterprise.
+  &quot;webhookKey&quot;: &quot;A String&quot;, # The key that should be attached to webhook calls to the ReceiveWebhook endpoint.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list">list(parent, projectId=None, x__xgafv=None)</code>
+  <pre>List all GitHubEnterpriseConfigs for a given project. This API is experimental.
+
+Args:
+  parent: string, Name of the parent project. For example: projects/{$project_number} or projects/{$project_id} (required)
+  projectId: string, ID of the project
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # RPC response object returned by ListGithubEnterpriseConfigs RPC method.
+  &quot;configs&quot;: [ # A list of GitHubEnterpriseConfigs
+    { # GitHubEnterpriseConfig represents a configuration for a GitHub Enterprise server.
+      &quot;appId&quot;: &quot;A String&quot;, # Required. The GitHub app id of the Cloud Build app on the GitHub Enterprise server.
+      &quot;createTime&quot;: &quot;A String&quot;, # Output only. Time when the installation was associated with the project.
+      &quot;displayName&quot;: &quot;A String&quot;, # Name to display for this config.
+      &quot;hostUrl&quot;: &quot;A String&quot;, # The URL of the github enterprise host the configuration is for.
+      &quot;name&quot;: &quot;A String&quot;, # Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
+      &quot;peeredNetwork&quot;: &quot;A String&quot;, # Optional. The network to be used when reaching out to the GitHub Enterprise server. The VPC network must be enabled for private service connection. This should be set if the GitHub Enterprise server is hosted on-premises and not reachable by public internet. If this field is left empty, no network peering will occur and calls to the GitHub Enterprise server will be made over the public internet. Must be in the format `projects/{project}/global/networks/{network}`, where {project} is a project number or id and {network} is the name of a VPC network in the project.
+      &quot;secrets&quot;: { # GitHubEnterpriseSecrets represents the names of all necessary secrets in Secret Manager for a GitHub Enterprise server. Format is: projects//secrets/. # Names of secrets in Secret Manager.
+        &quot;oauthClientIdName&quot;: &quot;A String&quot;, # The resource name for the OAuth client ID secret in Secret Manager.
+        &quot;oauthClientIdVersionName&quot;: &quot;A String&quot;, # The resource name for the OAuth client ID secret version in Secret Manager.
+        &quot;oauthSecretName&quot;: &quot;A String&quot;, # The resource name for the OAuth secret in Secret Manager.
+        &quot;oauthSecretVersionName&quot;: &quot;A String&quot;, # The resource name for the OAuth secret secret version in Secret Manager.
+        &quot;privateKeyName&quot;: &quot;A String&quot;, # The resource name for the private key secret.
+        &quot;privateKeyVersionName&quot;: &quot;A String&quot;, # The resource name for the private key secret version.
+        &quot;webhookSecretName&quot;: &quot;A String&quot;, # The resource name for the webhook secret in Secret Manager.
+        &quot;webhookSecretVersionName&quot;: &quot;A String&quot;, # The resource name for the webhook secret secret version in Secret Manager.
+      },
+      &quot;sslCa&quot;: &quot;A String&quot;, # Optional. SSL certificate to use for requests to GitHub Enterprise.
+      &quot;webhookKey&quot;: &quot;A String&quot;, # The key that should be attached to webhook calls to the ReceiveWebhook endpoint.
+    },
+  ],
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="patch">patch(name, body=None, updateMask=None, x__xgafv=None)</code>
+  <pre>Update an association between a GCP project and a GitHub Enterprise server. This API is experimental.
+
+Args:
+  name: string, Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot; (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # GitHubEnterpriseConfig represents a configuration for a GitHub Enterprise server.
+  &quot;appId&quot;: &quot;A String&quot;, # Required. The GitHub app id of the Cloud Build app on the GitHub Enterprise server.
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. Time when the installation was associated with the project.
+  &quot;displayName&quot;: &quot;A String&quot;, # Name to display for this config.
+  &quot;hostUrl&quot;: &quot;A String&quot;, # The URL of the github enterprise host the configuration is for.
+  &quot;name&quot;: &quot;A String&quot;, # Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
+  &quot;peeredNetwork&quot;: &quot;A String&quot;, # Optional. The network to be used when reaching out to the GitHub Enterprise server. The VPC network must be enabled for private service connection. This should be set if the GitHub Enterprise server is hosted on-premises and not reachable by public internet. If this field is left empty, no network peering will occur and calls to the GitHub Enterprise server will be made over the public internet. Must be in the format `projects/{project}/global/networks/{network}`, where {project} is a project number or id and {network} is the name of a VPC network in the project.
+  &quot;secrets&quot;: { # GitHubEnterpriseSecrets represents the names of all necessary secrets in Secret Manager for a GitHub Enterprise server. Format is: projects//secrets/. # Names of secrets in Secret Manager.
+    &quot;oauthClientIdName&quot;: &quot;A String&quot;, # The resource name for the OAuth client ID secret in Secret Manager.
+    &quot;oauthClientIdVersionName&quot;: &quot;A String&quot;, # The resource name for the OAuth client ID secret version in Secret Manager.
+    &quot;oauthSecretName&quot;: &quot;A String&quot;, # The resource name for the OAuth secret in Secret Manager.
+    &quot;oauthSecretVersionName&quot;: &quot;A String&quot;, # The resource name for the OAuth secret secret version in Secret Manager.
+    &quot;privateKeyName&quot;: &quot;A String&quot;, # The resource name for the private key secret.
+    &quot;privateKeyVersionName&quot;: &quot;A String&quot;, # The resource name for the private key secret version.
+    &quot;webhookSecretName&quot;: &quot;A String&quot;, # The resource name for the webhook secret in Secret Manager.
+    &quot;webhookSecretVersionName&quot;: &quot;A String&quot;, # The resource name for the webhook secret secret version in Secret Manager.
+  },
+  &quot;sslCa&quot;: &quot;A String&quot;, # Optional. SSL certificate to use for requests to GitHub Enterprise.
+  &quot;webhookKey&quot;: &quot;A String&quot;, # The key that should be attached to webhook calls to the ReceiveWebhook endpoint.
+}
+
+  updateMask: string, Update mask for the resource. If this is set, the server will only update the fields specified in the field mask. Otherwise, a full update of the mutable resource fields will be performed.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/cloudbuild_v1.projects.html b/docs/dyn/cloudbuild_v1.projects.html
index 1ccb0cd..d8e4fa4 100644
--- a/docs/dyn/cloudbuild_v1.projects.html
+++ b/docs/dyn/cloudbuild_v1.projects.html
@@ -80,6 +80,11 @@
 <p class="firstline">Returns the builds Resource.</p>
 
 <p class="toc_element">
+  <code><a href="cloudbuild_v1.projects.githubEnterpriseConfigs.html">githubEnterpriseConfigs()</a></code>
+</p>
+<p class="firstline">Returns the githubEnterpriseConfigs Resource.</p>
+
+<p class="toc_element">
   <code><a href="cloudbuild_v1.projects.locations.html">locations()</a></code>
 </p>
 <p class="firstline">Returns the locations Resource.</p>
diff --git a/docs/dyn/cloudbuild_v1.projects.locations.builds.html b/docs/dyn/cloudbuild_v1.projects.locations.builds.html
index 3e2fd20..e53a725 100644
--- a/docs/dyn/cloudbuild_v1.projects.locations.builds.html
+++ b/docs/dyn/cloudbuild_v1.projects.locations.builds.html
@@ -332,7 +332,7 @@
     &quot;A String&quot;,
   ],
   &quot;timeout&quot;: &quot;A String&quot;, # Amount of time that this build should be allowed to run, to second granularity. If this amount of time elapses, work on the build will cease and the build status will be `TIMEOUT`. `timeout` starts ticking from `startTime`. Default time is ten minutes.
-  &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. If the build does not specify source or images, these keys will not be included.
+  &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps. * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. * SETUPBUILD: time to set up build. If the build does not specify source or images, these keys will not be included.
     &quot;a_key&quot;: { # Start and end times for a build execution phase.
       &quot;endTime&quot;: &quot;A String&quot;, # End of time span.
       &quot;startTime&quot;: &quot;A String&quot;, # Start of time span.
@@ -574,7 +574,7 @@
     &quot;A String&quot;,
   ],
   &quot;timeout&quot;: &quot;A String&quot;, # Amount of time that this build should be allowed to run, to second granularity. If this amount of time elapses, work on the build will cease and the build status will be `TIMEOUT`. `timeout` starts ticking from `startTime`. Default time is ten minutes.
-  &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. If the build does not specify source or images, these keys will not be included.
+  &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps. * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. * SETUPBUILD: time to set up build. If the build does not specify source or images, these keys will not be included.
     &quot;a_key&quot;: { # Start and end times for a build execution phase.
       &quot;endTime&quot;: &quot;A String&quot;, # End of time span.
       &quot;startTime&quot;: &quot;A String&quot;, # Start of time span.
@@ -847,7 +847,7 @@
     &quot;A String&quot;,
   ],
   &quot;timeout&quot;: &quot;A String&quot;, # Amount of time that this build should be allowed to run, to second granularity. If this amount of time elapses, work on the build will cease and the build status will be `TIMEOUT`. `timeout` starts ticking from `startTime`. Default time is ten minutes.
-  &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. If the build does not specify source or images, these keys will not be included.
+  &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps. * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. * SETUPBUILD: time to set up build. If the build does not specify source or images, these keys will not be included.
     &quot;a_key&quot;: { # Start and end times for a build execution phase.
       &quot;endTime&quot;: &quot;A String&quot;, # End of time span.
       &quot;startTime&quot;: &quot;A String&quot;, # Start of time span.
@@ -1095,7 +1095,7 @@
         &quot;A String&quot;,
       ],
       &quot;timeout&quot;: &quot;A String&quot;, # Amount of time that this build should be allowed to run, to second granularity. If this amount of time elapses, work on the build will cease and the build status will be `TIMEOUT`. `timeout` starts ticking from `startTime`. Default time is ten minutes.
-      &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. If the build does not specify source or images, these keys will not be included.
+      &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps. * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. * SETUPBUILD: time to set up build. If the build does not specify source or images, these keys will not be included.
         &quot;a_key&quot;: { # Start and end times for a build execution phase.
           &quot;endTime&quot;: &quot;A String&quot;, # End of time span.
           &quot;startTime&quot;: &quot;A String&quot;, # Start of time span.
diff --git a/docs/dyn/cloudbuild_v1.projects.locations.githubEnterpriseConfigs.html b/docs/dyn/cloudbuild_v1.projects.locations.githubEnterpriseConfigs.html
new file mode 100644
index 0000000..8a09497
--- /dev/null
+++ b/docs/dyn/cloudbuild_v1.projects.locations.githubEnterpriseConfigs.html
@@ -0,0 +1,337 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="cloudbuild_v1.html">Cloud Build API</a> . <a href="cloudbuild_v1.projects.html">projects</a> . <a href="cloudbuild_v1.projects.locations.html">locations</a> . <a href="cloudbuild_v1.projects.locations.githubEnterpriseConfigs.html">githubEnterpriseConfigs</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#create">create(parent, body=None, projectId=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Create an association between a GCP project and a GitHub Enterprise server. This API is experimental.</p>
+<p class="toc_element">
+  <code><a href="#delete">delete(name, configId=None, projectId=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Delete an association between a GCP project and a GitHub Enterprise server. This API is experimental.</p>
+<p class="toc_element">
+  <code><a href="#get">get(name, configId=None, projectId=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Retrieve a GitHubEnterpriseConfig. This API is experimental.</p>
+<p class="toc_element">
+  <code><a href="#list">list(parent, projectId=None, x__xgafv=None)</a></code></p>
+<p class="firstline">List all GitHubEnterpriseConfigs for a given project. This API is experimental.</p>
+<p class="toc_element">
+  <code><a href="#patch">patch(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Update an association between a GCP project and a GitHub Enterprise server. This API is experimental.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="create">create(parent, body=None, projectId=None, x__xgafv=None)</code>
+  <pre>Create an association between a GCP project and a GitHub Enterprise server. This API is experimental.
+
+Args:
+  parent: string, Name of the parent project. For example: projects/{$project_number} or projects/{$project_id} (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # GitHubEnterpriseConfig represents a configuration for a GitHub Enterprise server.
+  &quot;appId&quot;: &quot;A String&quot;, # Required. The GitHub app id of the Cloud Build app on the GitHub Enterprise server.
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. Time when the installation was associated with the project.
+  &quot;displayName&quot;: &quot;A String&quot;, # Name to display for this config.
+  &quot;hostUrl&quot;: &quot;A String&quot;, # The URL of the github enterprise host the configuration is for.
+  &quot;name&quot;: &quot;A String&quot;, # Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
+  &quot;peeredNetwork&quot;: &quot;A String&quot;, # Optional. The network to be used when reaching out to the GitHub Enterprise server. The VPC network must be enabled for private service connection. This should be set if the GitHub Enterprise server is hosted on-premises and not reachable by public internet. If this field is left empty, no network peering will occur and calls to the GitHub Enterprise server will be made over the public internet. Must be in the format `projects/{project}/global/networks/{network}`, where {project} is a project number or id and {network} is the name of a VPC network in the project.
+  &quot;secrets&quot;: { # GitHubEnterpriseSecrets represents the names of all necessary secrets in Secret Manager for a GitHub Enterprise server. Format is: projects//secrets/. # Names of secrets in Secret Manager.
+    &quot;oauthClientIdName&quot;: &quot;A String&quot;, # The resource name for the OAuth client ID secret in Secret Manager.
+    &quot;oauthClientIdVersionName&quot;: &quot;A String&quot;, # The resource name for the OAuth client ID secret version in Secret Manager.
+    &quot;oauthSecretName&quot;: &quot;A String&quot;, # The resource name for the OAuth secret in Secret Manager.
+    &quot;oauthSecretVersionName&quot;: &quot;A String&quot;, # The resource name for the OAuth secret secret version in Secret Manager.
+    &quot;privateKeyName&quot;: &quot;A String&quot;, # The resource name for the private key secret.
+    &quot;privateKeyVersionName&quot;: &quot;A String&quot;, # The resource name for the private key secret version.
+    &quot;webhookSecretName&quot;: &quot;A String&quot;, # The resource name for the webhook secret in Secret Manager.
+    &quot;webhookSecretVersionName&quot;: &quot;A String&quot;, # The resource name for the webhook secret secret version in Secret Manager.
+  },
+  &quot;sslCa&quot;: &quot;A String&quot;, # Optional. SSL certificate to use for requests to GitHub Enterprise.
+  &quot;webhookKey&quot;: &quot;A String&quot;, # The key that should be attached to webhook calls to the ReceiveWebhook endpoint.
+}
+
+  projectId: string, ID of the project.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="delete">delete(name, configId=None, projectId=None, x__xgafv=None)</code>
+  <pre>Delete an association between a GCP project and a GitHub Enterprise server. This API is experimental.
+
+Args:
+  name: string, This field should contain the name of the enterprise config resource. For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot; (required)
+  configId: string, Unique identifier of the `GitHubEnterpriseConfig`
+  projectId: string, ID of the project
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="get">get(name, configId=None, projectId=None, x__xgafv=None)</code>
+  <pre>Retrieve a GitHubEnterpriseConfig. This API is experimental.
+
+Args:
+  name: string, This field should contain the name of the enterprise config resource. For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot; (required)
+  configId: string, Unique identifier of the `GitHubEnterpriseConfig`
+  projectId: string, ID of the project
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # GitHubEnterpriseConfig represents a configuration for a GitHub Enterprise server.
+  &quot;appId&quot;: &quot;A String&quot;, # Required. The GitHub app id of the Cloud Build app on the GitHub Enterprise server.
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. Time when the installation was associated with the project.
+  &quot;displayName&quot;: &quot;A String&quot;, # Name to display for this config.
+  &quot;hostUrl&quot;: &quot;A String&quot;, # The URL of the github enterprise host the configuration is for.
+  &quot;name&quot;: &quot;A String&quot;, # Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
+  &quot;peeredNetwork&quot;: &quot;A String&quot;, # Optional. The network to be used when reaching out to the GitHub Enterprise server. The VPC network must be enabled for private service connection. This should be set if the GitHub Enterprise server is hosted on-premises and not reachable by public internet. If this field is left empty, no network peering will occur and calls to the GitHub Enterprise server will be made over the public internet. Must be in the format `projects/{project}/global/networks/{network}`, where {project} is a project number or id and {network} is the name of a VPC network in the project.
+  &quot;secrets&quot;: { # GitHubEnterpriseSecrets represents the names of all necessary secrets in Secret Manager for a GitHub Enterprise server. Format is: projects//secrets/. # Names of secrets in Secret Manager.
+    &quot;oauthClientIdName&quot;: &quot;A String&quot;, # The resource name for the OAuth client ID secret in Secret Manager.
+    &quot;oauthClientIdVersionName&quot;: &quot;A String&quot;, # The resource name for the OAuth client ID secret version in Secret Manager.
+    &quot;oauthSecretName&quot;: &quot;A String&quot;, # The resource name for the OAuth secret in Secret Manager.
+    &quot;oauthSecretVersionName&quot;: &quot;A String&quot;, # The resource name for the OAuth secret secret version in Secret Manager.
+    &quot;privateKeyName&quot;: &quot;A String&quot;, # The resource name for the private key secret.
+    &quot;privateKeyVersionName&quot;: &quot;A String&quot;, # The resource name for the private key secret version.
+    &quot;webhookSecretName&quot;: &quot;A String&quot;, # The resource name for the webhook secret in Secret Manager.
+    &quot;webhookSecretVersionName&quot;: &quot;A String&quot;, # The resource name for the webhook secret secret version in Secret Manager.
+  },
+  &quot;sslCa&quot;: &quot;A String&quot;, # Optional. SSL certificate to use for requests to GitHub Enterprise.
+  &quot;webhookKey&quot;: &quot;A String&quot;, # The key that should be attached to webhook calls to the ReceiveWebhook endpoint.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list">list(parent, projectId=None, x__xgafv=None)</code>
+  <pre>List all GitHubEnterpriseConfigs for a given project. This API is experimental.
+
+Args:
+  parent: string, Name of the parent project. For example: projects/{$project_number} or projects/{$project_id} (required)
+  projectId: string, ID of the project
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # RPC response object returned by ListGithubEnterpriseConfigs RPC method.
+  &quot;configs&quot;: [ # A list of GitHubEnterpriseConfigs
+    { # GitHubEnterpriseConfig represents a configuration for a GitHub Enterprise server.
+      &quot;appId&quot;: &quot;A String&quot;, # Required. The GitHub app id of the Cloud Build app on the GitHub Enterprise server.
+      &quot;createTime&quot;: &quot;A String&quot;, # Output only. Time when the installation was associated with the project.
+      &quot;displayName&quot;: &quot;A String&quot;, # Name to display for this config.
+      &quot;hostUrl&quot;: &quot;A String&quot;, # The URL of the github enterprise host the configuration is for.
+      &quot;name&quot;: &quot;A String&quot;, # Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
+      &quot;peeredNetwork&quot;: &quot;A String&quot;, # Optional. The network to be used when reaching out to the GitHub Enterprise server. The VPC network must be enabled for private service connection. This should be set if the GitHub Enterprise server is hosted on-premises and not reachable by public internet. If this field is left empty, no network peering will occur and calls to the GitHub Enterprise server will be made over the public internet. Must be in the format `projects/{project}/global/networks/{network}`, where {project} is a project number or id and {network} is the name of a VPC network in the project.
+      &quot;secrets&quot;: { # GitHubEnterpriseSecrets represents the names of all necessary secrets in Secret Manager for a GitHub Enterprise server. Format is: projects//secrets/. # Names of secrets in Secret Manager.
+        &quot;oauthClientIdName&quot;: &quot;A String&quot;, # The resource name for the OAuth client ID secret in Secret Manager.
+        &quot;oauthClientIdVersionName&quot;: &quot;A String&quot;, # The resource name for the OAuth client ID secret version in Secret Manager.
+        &quot;oauthSecretName&quot;: &quot;A String&quot;, # The resource name for the OAuth secret in Secret Manager.
+        &quot;oauthSecretVersionName&quot;: &quot;A String&quot;, # The resource name for the OAuth secret secret version in Secret Manager.
+        &quot;privateKeyName&quot;: &quot;A String&quot;, # The resource name for the private key secret.
+        &quot;privateKeyVersionName&quot;: &quot;A String&quot;, # The resource name for the private key secret version.
+        &quot;webhookSecretName&quot;: &quot;A String&quot;, # The resource name for the webhook secret in Secret Manager.
+        &quot;webhookSecretVersionName&quot;: &quot;A String&quot;, # The resource name for the webhook secret secret version in Secret Manager.
+      },
+      &quot;sslCa&quot;: &quot;A String&quot;, # Optional. SSL certificate to use for requests to GitHub Enterprise.
+      &quot;webhookKey&quot;: &quot;A String&quot;, # The key that should be attached to webhook calls to the ReceiveWebhook endpoint.
+    },
+  ],
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="patch">patch(name, body=None, updateMask=None, x__xgafv=None)</code>
+  <pre>Update an association between a GCP project and a GitHub Enterprise server. This API is experimental.
+
+Args:
+  name: string, Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot; (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # GitHubEnterpriseConfig represents a configuration for a GitHub Enterprise server.
+  &quot;appId&quot;: &quot;A String&quot;, # Required. The GitHub app id of the Cloud Build app on the GitHub Enterprise server.
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. Time when the installation was associated with the project.
+  &quot;displayName&quot;: &quot;A String&quot;, # Name to display for this config.
+  &quot;hostUrl&quot;: &quot;A String&quot;, # The URL of the github enterprise host the configuration is for.
+  &quot;name&quot;: &quot;A String&quot;, # Optional. The full resource name for the GitHubEnterpriseConfig For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
+  &quot;peeredNetwork&quot;: &quot;A String&quot;, # Optional. The network to be used when reaching out to the GitHub Enterprise server. The VPC network must be enabled for private service connection. This should be set if the GitHub Enterprise server is hosted on-premises and not reachable by public internet. If this field is left empty, no network peering will occur and calls to the GitHub Enterprise server will be made over the public internet. Must be in the format `projects/{project}/global/networks/{network}`, where {project} is a project number or id and {network} is the name of a VPC network in the project.
+  &quot;secrets&quot;: { # GitHubEnterpriseSecrets represents the names of all necessary secrets in Secret Manager for a GitHub Enterprise server. Format is: projects//secrets/. # Names of secrets in Secret Manager.
+    &quot;oauthClientIdName&quot;: &quot;A String&quot;, # The resource name for the OAuth client ID secret in Secret Manager.
+    &quot;oauthClientIdVersionName&quot;: &quot;A String&quot;, # The resource name for the OAuth client ID secret version in Secret Manager.
+    &quot;oauthSecretName&quot;: &quot;A String&quot;, # The resource name for the OAuth secret in Secret Manager.
+    &quot;oauthSecretVersionName&quot;: &quot;A String&quot;, # The resource name for the OAuth secret secret version in Secret Manager.
+    &quot;privateKeyName&quot;: &quot;A String&quot;, # The resource name for the private key secret.
+    &quot;privateKeyVersionName&quot;: &quot;A String&quot;, # The resource name for the private key secret version.
+    &quot;webhookSecretName&quot;: &quot;A String&quot;, # The resource name for the webhook secret in Secret Manager.
+    &quot;webhookSecretVersionName&quot;: &quot;A String&quot;, # The resource name for the webhook secret secret version in Secret Manager.
+  },
+  &quot;sslCa&quot;: &quot;A String&quot;, # Optional. SSL certificate to use for requests to GitHub Enterprise.
+  &quot;webhookKey&quot;: &quot;A String&quot;, # The key that should be attached to webhook calls to the ReceiveWebhook endpoint.
+}
+
+  updateMask: string, Update mask for the resource. If this is set, the server will only update the fields specified in the field mask. Otherwise, a full update of the mutable resource fields will be performed.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/cloudbuild_v1.projects.locations.html b/docs/dyn/cloudbuild_v1.projects.locations.html
index 19eeb55..a977d5c 100644
--- a/docs/dyn/cloudbuild_v1.projects.locations.html
+++ b/docs/dyn/cloudbuild_v1.projects.locations.html
@@ -80,6 +80,11 @@
 <p class="firstline">Returns the builds Resource.</p>
 
 <p class="toc_element">
+  <code><a href="cloudbuild_v1.projects.locations.githubEnterpriseConfigs.html">githubEnterpriseConfigs()</a></code>
+</p>
+<p class="firstline">Returns the githubEnterpriseConfigs Resource.</p>
+
+<p class="toc_element">
   <code><a href="cloudbuild_v1.projects.locations.operations.html">operations()</a></code>
 </p>
 <p class="firstline">Returns the operations Resource.</p>
diff --git a/docs/dyn/cloudbuild_v1.projects.locations.triggers.html b/docs/dyn/cloudbuild_v1.projects.locations.triggers.html
index 5c2898e..dfc1f13 100644
--- a/docs/dyn/cloudbuild_v1.projects.locations.triggers.html
+++ b/docs/dyn/cloudbuild_v1.projects.locations.triggers.html
@@ -331,7 +331,7 @@
       &quot;A String&quot;,
     ],
     &quot;timeout&quot;: &quot;A String&quot;, # Amount of time that this build should be allowed to run, to second granularity. If this amount of time elapses, work on the build will cease and the build status will be `TIMEOUT`. `timeout` starts ticking from `startTime`. Default time is ten minutes.
-    &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. If the build does not specify source or images, these keys will not be included.
+    &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps. * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. * SETUPBUILD: time to set up build. If the build does not specify source or images, these keys will not be included.
       &quot;a_key&quot;: { # Start and end times for a build execution phase.
         &quot;endTime&quot;: &quot;A String&quot;, # End of time span.
         &quot;startTime&quot;: &quot;A String&quot;, # Start of time span.
@@ -349,7 +349,8 @@
   &quot;disabled&quot;: True or False, # If true, the trigger will never automatically execute a build.
   &quot;filename&quot;: &quot;A String&quot;, # Path, from the source root, to the build configuration file (i.e. cloudbuild.yaml).
   &quot;filter&quot;: &quot;A String&quot;, # Optional. A Common Expression Language string.
-  &quot;github&quot;: { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. This message is experimental. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
+  &quot;github&quot;: { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
+    &quot;enterpriseConfigResourceName&quot;: &quot;A String&quot;, # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
     &quot;installationId&quot;: &quot;A String&quot;, # The installationID that emits the GitHub event.
     &quot;name&quot;: &quot;A String&quot;, # Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is &quot;cloud-builders&quot;.
     &quot;owner&quot;: &quot;A String&quot;, # Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is &quot;googlecloudplatform&quot;.
@@ -379,6 +380,7 @@
     &quot;topic&quot;: &quot;A String&quot;, # The name of the topic from which this subscription is receiving messages. Format is `projects/{project}/topics/{topic}`.
   },
   &quot;resourceName&quot;: &quot;A String&quot;, # The `Trigger` name with format: `projects/{project}/locations/{location}/triggers/{trigger}`, where {trigger} is a unique identifier generated by the service.
+  &quot;serviceAccount&quot;: &quot;A String&quot;, # Optional. The service account used for all user-controlled operations including UpdateBuildTrigger, RunBuildTrigger, CreateBuild, and CancelBuild. If no service account is set, then the standard Cloud Build service account ([PROJECT_NUM]@system.gserviceaccount.com) will be used instead. Format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT_ID_OR_EMAIL}`
   &quot;sourceToBuild&quot;: { # GitRepoSource describes a repo and ref of a code repository. # The repo and ref of the repository from which to build. This field is used only for those triggers that do not respond to SCM events. Triggers that respond to such events build source at whatever commit caused the event. This field is currently only used by Webhook, Pub/Sub, Manual, and Cron triggers.
     &quot;ref&quot;: &quot;A String&quot;, # The branch or tag to use. Must start with &quot;refs/&quot; (required).
     &quot;repoType&quot;: &quot;A String&quot;, # See RepoType below.
@@ -632,7 +634,7 @@
       &quot;A String&quot;,
     ],
     &quot;timeout&quot;: &quot;A String&quot;, # Amount of time that this build should be allowed to run, to second granularity. If this amount of time elapses, work on the build will cease and the build status will be `TIMEOUT`. `timeout` starts ticking from `startTime`. Default time is ten minutes.
-    &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. If the build does not specify source or images, these keys will not be included.
+    &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps. * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. * SETUPBUILD: time to set up build. If the build does not specify source or images, these keys will not be included.
       &quot;a_key&quot;: { # Start and end times for a build execution phase.
         &quot;endTime&quot;: &quot;A String&quot;, # End of time span.
         &quot;startTime&quot;: &quot;A String&quot;, # Start of time span.
@@ -650,7 +652,8 @@
   &quot;disabled&quot;: True or False, # If true, the trigger will never automatically execute a build.
   &quot;filename&quot;: &quot;A String&quot;, # Path, from the source root, to the build configuration file (i.e. cloudbuild.yaml).
   &quot;filter&quot;: &quot;A String&quot;, # Optional. A Common Expression Language string.
-  &quot;github&quot;: { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. This message is experimental. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
+  &quot;github&quot;: { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
+    &quot;enterpriseConfigResourceName&quot;: &quot;A String&quot;, # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
     &quot;installationId&quot;: &quot;A String&quot;, # The installationID that emits the GitHub event.
     &quot;name&quot;: &quot;A String&quot;, # Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is &quot;cloud-builders&quot;.
     &quot;owner&quot;: &quot;A String&quot;, # Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is &quot;googlecloudplatform&quot;.
@@ -680,6 +683,7 @@
     &quot;topic&quot;: &quot;A String&quot;, # The name of the topic from which this subscription is receiving messages. Format is `projects/{project}/topics/{topic}`.
   },
   &quot;resourceName&quot;: &quot;A String&quot;, # The `Trigger` name with format: `projects/{project}/locations/{location}/triggers/{trigger}`, where {trigger} is a unique identifier generated by the service.
+  &quot;serviceAccount&quot;: &quot;A String&quot;, # Optional. The service account used for all user-controlled operations including UpdateBuildTrigger, RunBuildTrigger, CreateBuild, and CancelBuild. If no service account is set, then the standard Cloud Build service account ([PROJECT_NUM]@system.gserviceaccount.com) will be used instead. Format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT_ID_OR_EMAIL}`
   &quot;sourceToBuild&quot;: { # GitRepoSource describes a repo and ref of a code repository. # The repo and ref of the repository from which to build. This field is used only for those triggers that do not respond to SCM events. Triggers that respond to such events build source at whatever commit caused the event. This field is currently only used by Webhook, Pub/Sub, Manual, and Cron triggers.
     &quot;ref&quot;: &quot;A String&quot;, # The branch or tag to use. Must start with &quot;refs/&quot; (required).
     &quot;repoType&quot;: &quot;A String&quot;, # See RepoType below.
@@ -961,7 +965,7 @@
       &quot;A String&quot;,
     ],
     &quot;timeout&quot;: &quot;A String&quot;, # Amount of time that this build should be allowed to run, to second granularity. If this amount of time elapses, work on the build will cease and the build status will be `TIMEOUT`. `timeout` starts ticking from `startTime`. Default time is ten minutes.
-    &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. If the build does not specify source or images, these keys will not be included.
+    &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps. * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. * SETUPBUILD: time to set up build. If the build does not specify source or images, these keys will not be included.
       &quot;a_key&quot;: { # Start and end times for a build execution phase.
         &quot;endTime&quot;: &quot;A String&quot;, # End of time span.
         &quot;startTime&quot;: &quot;A String&quot;, # Start of time span.
@@ -979,7 +983,8 @@
   &quot;disabled&quot;: True or False, # If true, the trigger will never automatically execute a build.
   &quot;filename&quot;: &quot;A String&quot;, # Path, from the source root, to the build configuration file (i.e. cloudbuild.yaml).
   &quot;filter&quot;: &quot;A String&quot;, # Optional. A Common Expression Language string.
-  &quot;github&quot;: { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. This message is experimental. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
+  &quot;github&quot;: { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
+    &quot;enterpriseConfigResourceName&quot;: &quot;A String&quot;, # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
     &quot;installationId&quot;: &quot;A String&quot;, # The installationID that emits the GitHub event.
     &quot;name&quot;: &quot;A String&quot;, # Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is &quot;cloud-builders&quot;.
     &quot;owner&quot;: &quot;A String&quot;, # Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is &quot;googlecloudplatform&quot;.
@@ -1009,6 +1014,7 @@
     &quot;topic&quot;: &quot;A String&quot;, # The name of the topic from which this subscription is receiving messages. Format is `projects/{project}/topics/{topic}`.
   },
   &quot;resourceName&quot;: &quot;A String&quot;, # The `Trigger` name with format: `projects/{project}/locations/{location}/triggers/{trigger}`, where {trigger} is a unique identifier generated by the service.
+  &quot;serviceAccount&quot;: &quot;A String&quot;, # Optional. The service account used for all user-controlled operations including UpdateBuildTrigger, RunBuildTrigger, CreateBuild, and CancelBuild. If no service account is set, then the standard Cloud Build service account ([PROJECT_NUM]@system.gserviceaccount.com) will be used instead. Format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT_ID_OR_EMAIL}`
   &quot;sourceToBuild&quot;: { # GitRepoSource describes a repo and ref of a code repository. # The repo and ref of the repository from which to build. This field is used only for those triggers that do not respond to SCM events. Triggers that respond to such events build source at whatever commit caused the event. This field is currently only used by Webhook, Pub/Sub, Manual, and Cron triggers.
     &quot;ref&quot;: &quot;A String&quot;, # The branch or tag to use. Must start with &quot;refs/&quot; (required).
     &quot;repoType&quot;: &quot;A String&quot;, # See RepoType below.
@@ -1274,7 +1280,7 @@
           &quot;A String&quot;,
         ],
         &quot;timeout&quot;: &quot;A String&quot;, # Amount of time that this build should be allowed to run, to second granularity. If this amount of time elapses, work on the build will cease and the build status will be `TIMEOUT`. `timeout` starts ticking from `startTime`. Default time is ten minutes.
-        &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. If the build does not specify source or images, these keys will not be included.
+        &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps. * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. * SETUPBUILD: time to set up build. If the build does not specify source or images, these keys will not be included.
           &quot;a_key&quot;: { # Start and end times for a build execution phase.
             &quot;endTime&quot;: &quot;A String&quot;, # End of time span.
             &quot;startTime&quot;: &quot;A String&quot;, # Start of time span.
@@ -1292,7 +1298,8 @@
       &quot;disabled&quot;: True or False, # If true, the trigger will never automatically execute a build.
       &quot;filename&quot;: &quot;A String&quot;, # Path, from the source root, to the build configuration file (i.e. cloudbuild.yaml).
       &quot;filter&quot;: &quot;A String&quot;, # Optional. A Common Expression Language string.
-      &quot;github&quot;: { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. This message is experimental. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
+      &quot;github&quot;: { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
+        &quot;enterpriseConfigResourceName&quot;: &quot;A String&quot;, # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
         &quot;installationId&quot;: &quot;A String&quot;, # The installationID that emits the GitHub event.
         &quot;name&quot;: &quot;A String&quot;, # Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is &quot;cloud-builders&quot;.
         &quot;owner&quot;: &quot;A String&quot;, # Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is &quot;googlecloudplatform&quot;.
@@ -1322,6 +1329,7 @@
         &quot;topic&quot;: &quot;A String&quot;, # The name of the topic from which this subscription is receiving messages. Format is `projects/{project}/topics/{topic}`.
       },
       &quot;resourceName&quot;: &quot;A String&quot;, # The `Trigger` name with format: `projects/{project}/locations/{location}/triggers/{trigger}`, where {trigger} is a unique identifier generated by the service.
+      &quot;serviceAccount&quot;: &quot;A String&quot;, # Optional. The service account used for all user-controlled operations including UpdateBuildTrigger, RunBuildTrigger, CreateBuild, and CancelBuild. If no service account is set, then the standard Cloud Build service account ([PROJECT_NUM]@system.gserviceaccount.com) will be used instead. Format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT_ID_OR_EMAIL}`
       &quot;sourceToBuild&quot;: { # GitRepoSource describes a repo and ref of a code repository. # The repo and ref of the repository from which to build. This field is used only for those triggers that do not respond to SCM events. Triggers that respond to such events build source at whatever commit caused the event. This field is currently only used by Webhook, Pub/Sub, Manual, and Cron triggers.
         &quot;ref&quot;: &quot;A String&quot;, # The branch or tag to use. Must start with &quot;refs/&quot; (required).
         &quot;repoType&quot;: &quot;A String&quot;, # See RepoType below.
@@ -1592,7 +1600,7 @@
       &quot;A String&quot;,
     ],
     &quot;timeout&quot;: &quot;A String&quot;, # Amount of time that this build should be allowed to run, to second granularity. If this amount of time elapses, work on the build will cease and the build status will be `TIMEOUT`. `timeout` starts ticking from `startTime`. Default time is ten minutes.
-    &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. If the build does not specify source or images, these keys will not be included.
+    &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps. * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. * SETUPBUILD: time to set up build. If the build does not specify source or images, these keys will not be included.
       &quot;a_key&quot;: { # Start and end times for a build execution phase.
         &quot;endTime&quot;: &quot;A String&quot;, # End of time span.
         &quot;startTime&quot;: &quot;A String&quot;, # Start of time span.
@@ -1610,7 +1618,8 @@
   &quot;disabled&quot;: True or False, # If true, the trigger will never automatically execute a build.
   &quot;filename&quot;: &quot;A String&quot;, # Path, from the source root, to the build configuration file (i.e. cloudbuild.yaml).
   &quot;filter&quot;: &quot;A String&quot;, # Optional. A Common Expression Language string.
-  &quot;github&quot;: { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. This message is experimental. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
+  &quot;github&quot;: { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
+    &quot;enterpriseConfigResourceName&quot;: &quot;A String&quot;, # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
     &quot;installationId&quot;: &quot;A String&quot;, # The installationID that emits the GitHub event.
     &quot;name&quot;: &quot;A String&quot;, # Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is &quot;cloud-builders&quot;.
     &quot;owner&quot;: &quot;A String&quot;, # Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is &quot;googlecloudplatform&quot;.
@@ -1640,6 +1649,7 @@
     &quot;topic&quot;: &quot;A String&quot;, # The name of the topic from which this subscription is receiving messages. Format is `projects/{project}/topics/{topic}`.
   },
   &quot;resourceName&quot;: &quot;A String&quot;, # The `Trigger` name with format: `projects/{project}/locations/{location}/triggers/{trigger}`, where {trigger} is a unique identifier generated by the service.
+  &quot;serviceAccount&quot;: &quot;A String&quot;, # Optional. The service account used for all user-controlled operations including UpdateBuildTrigger, RunBuildTrigger, CreateBuild, and CancelBuild. If no service account is set, then the standard Cloud Build service account ([PROJECT_NUM]@system.gserviceaccount.com) will be used instead. Format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT_ID_OR_EMAIL}`
   &quot;sourceToBuild&quot;: { # GitRepoSource describes a repo and ref of a code repository. # The repo and ref of the repository from which to build. This field is used only for those triggers that do not respond to SCM events. Triggers that respond to such events build source at whatever commit caused the event. This field is currently only used by Webhook, Pub/Sub, Manual, and Cron triggers.
     &quot;ref&quot;: &quot;A String&quot;, # The branch or tag to use. Must start with &quot;refs/&quot; (required).
     &quot;repoType&quot;: &quot;A String&quot;, # See RepoType below.
@@ -1894,7 +1904,7 @@
       &quot;A String&quot;,
     ],
     &quot;timeout&quot;: &quot;A String&quot;, # Amount of time that this build should be allowed to run, to second granularity. If this amount of time elapses, work on the build will cease and the build status will be `TIMEOUT`. `timeout` starts ticking from `startTime`. Default time is ten minutes.
-    &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. If the build does not specify source or images, these keys will not be included.
+    &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps. * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. * SETUPBUILD: time to set up build. If the build does not specify source or images, these keys will not be included.
       &quot;a_key&quot;: { # Start and end times for a build execution phase.
         &quot;endTime&quot;: &quot;A String&quot;, # End of time span.
         &quot;startTime&quot;: &quot;A String&quot;, # Start of time span.
@@ -1912,7 +1922,8 @@
   &quot;disabled&quot;: True or False, # If true, the trigger will never automatically execute a build.
   &quot;filename&quot;: &quot;A String&quot;, # Path, from the source root, to the build configuration file (i.e. cloudbuild.yaml).
   &quot;filter&quot;: &quot;A String&quot;, # Optional. A Common Expression Language string.
-  &quot;github&quot;: { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. This message is experimental. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
+  &quot;github&quot;: { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
+    &quot;enterpriseConfigResourceName&quot;: &quot;A String&quot;, # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
     &quot;installationId&quot;: &quot;A String&quot;, # The installationID that emits the GitHub event.
     &quot;name&quot;: &quot;A String&quot;, # Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is &quot;cloud-builders&quot;.
     &quot;owner&quot;: &quot;A String&quot;, # Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is &quot;googlecloudplatform&quot;.
@@ -1942,6 +1953,7 @@
     &quot;topic&quot;: &quot;A String&quot;, # The name of the topic from which this subscription is receiving messages. Format is `projects/{project}/topics/{topic}`.
   },
   &quot;resourceName&quot;: &quot;A String&quot;, # The `Trigger` name with format: `projects/{project}/locations/{location}/triggers/{trigger}`, where {trigger} is a unique identifier generated by the service.
+  &quot;serviceAccount&quot;: &quot;A String&quot;, # Optional. The service account used for all user-controlled operations including UpdateBuildTrigger, RunBuildTrigger, CreateBuild, and CancelBuild. If no service account is set, then the standard Cloud Build service account ([PROJECT_NUM]@system.gserviceaccount.com) will be used instead. Format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT_ID_OR_EMAIL}`
   &quot;sourceToBuild&quot;: { # GitRepoSource describes a repo and ref of a code repository. # The repo and ref of the repository from which to build. This field is used only for those triggers that do not respond to SCM events. Triggers that respond to such events build source at whatever commit caused the event. This field is currently only used by Webhook, Pub/Sub, Manual, and Cron triggers.
     &quot;ref&quot;: &quot;A String&quot;, # The branch or tag to use. Must start with &quot;refs/&quot; (required).
     &quot;repoType&quot;: &quot;A String&quot;, # See RepoType below.
diff --git a/docs/dyn/cloudbuild_v1.projects.triggers.html b/docs/dyn/cloudbuild_v1.projects.triggers.html
index 14c7e60..5c499c3 100644
--- a/docs/dyn/cloudbuild_v1.projects.triggers.html
+++ b/docs/dyn/cloudbuild_v1.projects.triggers.html
@@ -331,7 +331,7 @@
       &quot;A String&quot;,
     ],
     &quot;timeout&quot;: &quot;A String&quot;, # Amount of time that this build should be allowed to run, to second granularity. If this amount of time elapses, work on the build will cease and the build status will be `TIMEOUT`. `timeout` starts ticking from `startTime`. Default time is ten minutes.
-    &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. If the build does not specify source or images, these keys will not be included.
+    &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps. * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. * SETUPBUILD: time to set up build. If the build does not specify source or images, these keys will not be included.
       &quot;a_key&quot;: { # Start and end times for a build execution phase.
         &quot;endTime&quot;: &quot;A String&quot;, # End of time span.
         &quot;startTime&quot;: &quot;A String&quot;, # Start of time span.
@@ -349,7 +349,8 @@
   &quot;disabled&quot;: True or False, # If true, the trigger will never automatically execute a build.
   &quot;filename&quot;: &quot;A String&quot;, # Path, from the source root, to the build configuration file (i.e. cloudbuild.yaml).
   &quot;filter&quot;: &quot;A String&quot;, # Optional. A Common Expression Language string.
-  &quot;github&quot;: { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. This message is experimental. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
+  &quot;github&quot;: { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
+    &quot;enterpriseConfigResourceName&quot;: &quot;A String&quot;, # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
     &quot;installationId&quot;: &quot;A String&quot;, # The installationID that emits the GitHub event.
     &quot;name&quot;: &quot;A String&quot;, # Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is &quot;cloud-builders&quot;.
     &quot;owner&quot;: &quot;A String&quot;, # Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is &quot;googlecloudplatform&quot;.
@@ -379,6 +380,7 @@
     &quot;topic&quot;: &quot;A String&quot;, # The name of the topic from which this subscription is receiving messages. Format is `projects/{project}/topics/{topic}`.
   },
   &quot;resourceName&quot;: &quot;A String&quot;, # The `Trigger` name with format: `projects/{project}/locations/{location}/triggers/{trigger}`, where {trigger} is a unique identifier generated by the service.
+  &quot;serviceAccount&quot;: &quot;A String&quot;, # Optional. The service account used for all user-controlled operations including UpdateBuildTrigger, RunBuildTrigger, CreateBuild, and CancelBuild. If no service account is set, then the standard Cloud Build service account ([PROJECT_NUM]@system.gserviceaccount.com) will be used instead. Format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT_ID_OR_EMAIL}`
   &quot;sourceToBuild&quot;: { # GitRepoSource describes a repo and ref of a code repository. # The repo and ref of the repository from which to build. This field is used only for those triggers that do not respond to SCM events. Triggers that respond to such events build source at whatever commit caused the event. This field is currently only used by Webhook, Pub/Sub, Manual, and Cron triggers.
     &quot;ref&quot;: &quot;A String&quot;, # The branch or tag to use. Must start with &quot;refs/&quot; (required).
     &quot;repoType&quot;: &quot;A String&quot;, # See RepoType below.
@@ -632,7 +634,7 @@
       &quot;A String&quot;,
     ],
     &quot;timeout&quot;: &quot;A String&quot;, # Amount of time that this build should be allowed to run, to second granularity. If this amount of time elapses, work on the build will cease and the build status will be `TIMEOUT`. `timeout` starts ticking from `startTime`. Default time is ten minutes.
-    &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. If the build does not specify source or images, these keys will not be included.
+    &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps. * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. * SETUPBUILD: time to set up build. If the build does not specify source or images, these keys will not be included.
       &quot;a_key&quot;: { # Start and end times for a build execution phase.
         &quot;endTime&quot;: &quot;A String&quot;, # End of time span.
         &quot;startTime&quot;: &quot;A String&quot;, # Start of time span.
@@ -650,7 +652,8 @@
   &quot;disabled&quot;: True or False, # If true, the trigger will never automatically execute a build.
   &quot;filename&quot;: &quot;A String&quot;, # Path, from the source root, to the build configuration file (i.e. cloudbuild.yaml).
   &quot;filter&quot;: &quot;A String&quot;, # Optional. A Common Expression Language string.
-  &quot;github&quot;: { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. This message is experimental. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
+  &quot;github&quot;: { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
+    &quot;enterpriseConfigResourceName&quot;: &quot;A String&quot;, # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
     &quot;installationId&quot;: &quot;A String&quot;, # The installationID that emits the GitHub event.
     &quot;name&quot;: &quot;A String&quot;, # Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is &quot;cloud-builders&quot;.
     &quot;owner&quot;: &quot;A String&quot;, # Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is &quot;googlecloudplatform&quot;.
@@ -680,6 +683,7 @@
     &quot;topic&quot;: &quot;A String&quot;, # The name of the topic from which this subscription is receiving messages. Format is `projects/{project}/topics/{topic}`.
   },
   &quot;resourceName&quot;: &quot;A String&quot;, # The `Trigger` name with format: `projects/{project}/locations/{location}/triggers/{trigger}`, where {trigger} is a unique identifier generated by the service.
+  &quot;serviceAccount&quot;: &quot;A String&quot;, # Optional. The service account used for all user-controlled operations including UpdateBuildTrigger, RunBuildTrigger, CreateBuild, and CancelBuild. If no service account is set, then the standard Cloud Build service account ([PROJECT_NUM]@system.gserviceaccount.com) will be used instead. Format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT_ID_OR_EMAIL}`
   &quot;sourceToBuild&quot;: { # GitRepoSource describes a repo and ref of a code repository. # The repo and ref of the repository from which to build. This field is used only for those triggers that do not respond to SCM events. Triggers that respond to such events build source at whatever commit caused the event. This field is currently only used by Webhook, Pub/Sub, Manual, and Cron triggers.
     &quot;ref&quot;: &quot;A String&quot;, # The branch or tag to use. Must start with &quot;refs/&quot; (required).
     &quot;repoType&quot;: &quot;A String&quot;, # See RepoType below.
@@ -961,7 +965,7 @@
       &quot;A String&quot;,
     ],
     &quot;timeout&quot;: &quot;A String&quot;, # Amount of time that this build should be allowed to run, to second granularity. If this amount of time elapses, work on the build will cease and the build status will be `TIMEOUT`. `timeout` starts ticking from `startTime`. Default time is ten minutes.
-    &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. If the build does not specify source or images, these keys will not be included.
+    &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps. * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. * SETUPBUILD: time to set up build. If the build does not specify source or images, these keys will not be included.
       &quot;a_key&quot;: { # Start and end times for a build execution phase.
         &quot;endTime&quot;: &quot;A String&quot;, # End of time span.
         &quot;startTime&quot;: &quot;A String&quot;, # Start of time span.
@@ -979,7 +983,8 @@
   &quot;disabled&quot;: True or False, # If true, the trigger will never automatically execute a build.
   &quot;filename&quot;: &quot;A String&quot;, # Path, from the source root, to the build configuration file (i.e. cloudbuild.yaml).
   &quot;filter&quot;: &quot;A String&quot;, # Optional. A Common Expression Language string.
-  &quot;github&quot;: { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. This message is experimental. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
+  &quot;github&quot;: { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
+    &quot;enterpriseConfigResourceName&quot;: &quot;A String&quot;, # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
     &quot;installationId&quot;: &quot;A String&quot;, # The installationID that emits the GitHub event.
     &quot;name&quot;: &quot;A String&quot;, # Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is &quot;cloud-builders&quot;.
     &quot;owner&quot;: &quot;A String&quot;, # Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is &quot;googlecloudplatform&quot;.
@@ -1009,6 +1014,7 @@
     &quot;topic&quot;: &quot;A String&quot;, # The name of the topic from which this subscription is receiving messages. Format is `projects/{project}/topics/{topic}`.
   },
   &quot;resourceName&quot;: &quot;A String&quot;, # The `Trigger` name with format: `projects/{project}/locations/{location}/triggers/{trigger}`, where {trigger} is a unique identifier generated by the service.
+  &quot;serviceAccount&quot;: &quot;A String&quot;, # Optional. The service account used for all user-controlled operations including UpdateBuildTrigger, RunBuildTrigger, CreateBuild, and CancelBuild. If no service account is set, then the standard Cloud Build service account ([PROJECT_NUM]@system.gserviceaccount.com) will be used instead. Format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT_ID_OR_EMAIL}`
   &quot;sourceToBuild&quot;: { # GitRepoSource describes a repo and ref of a code repository. # The repo and ref of the repository from which to build. This field is used only for those triggers that do not respond to SCM events. Triggers that respond to such events build source at whatever commit caused the event. This field is currently only used by Webhook, Pub/Sub, Manual, and Cron triggers.
     &quot;ref&quot;: &quot;A String&quot;, # The branch or tag to use. Must start with &quot;refs/&quot; (required).
     &quot;repoType&quot;: &quot;A String&quot;, # See RepoType below.
@@ -1274,7 +1280,7 @@
           &quot;A String&quot;,
         ],
         &quot;timeout&quot;: &quot;A String&quot;, # Amount of time that this build should be allowed to run, to second granularity. If this amount of time elapses, work on the build will cease and the build status will be `TIMEOUT`. `timeout` starts ticking from `startTime`. Default time is ten minutes.
-        &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. If the build does not specify source or images, these keys will not be included.
+        &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps. * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. * SETUPBUILD: time to set up build. If the build does not specify source or images, these keys will not be included.
           &quot;a_key&quot;: { # Start and end times for a build execution phase.
             &quot;endTime&quot;: &quot;A String&quot;, # End of time span.
             &quot;startTime&quot;: &quot;A String&quot;, # Start of time span.
@@ -1292,7 +1298,8 @@
       &quot;disabled&quot;: True or False, # If true, the trigger will never automatically execute a build.
       &quot;filename&quot;: &quot;A String&quot;, # Path, from the source root, to the build configuration file (i.e. cloudbuild.yaml).
       &quot;filter&quot;: &quot;A String&quot;, # Optional. A Common Expression Language string.
-      &quot;github&quot;: { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. This message is experimental. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
+      &quot;github&quot;: { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
+        &quot;enterpriseConfigResourceName&quot;: &quot;A String&quot;, # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
         &quot;installationId&quot;: &quot;A String&quot;, # The installationID that emits the GitHub event.
         &quot;name&quot;: &quot;A String&quot;, # Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is &quot;cloud-builders&quot;.
         &quot;owner&quot;: &quot;A String&quot;, # Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is &quot;googlecloudplatform&quot;.
@@ -1322,6 +1329,7 @@
         &quot;topic&quot;: &quot;A String&quot;, # The name of the topic from which this subscription is receiving messages. Format is `projects/{project}/topics/{topic}`.
       },
       &quot;resourceName&quot;: &quot;A String&quot;, # The `Trigger` name with format: `projects/{project}/locations/{location}/triggers/{trigger}`, where {trigger} is a unique identifier generated by the service.
+      &quot;serviceAccount&quot;: &quot;A String&quot;, # Optional. The service account used for all user-controlled operations including UpdateBuildTrigger, RunBuildTrigger, CreateBuild, and CancelBuild. If no service account is set, then the standard Cloud Build service account ([PROJECT_NUM]@system.gserviceaccount.com) will be used instead. Format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT_ID_OR_EMAIL}`
       &quot;sourceToBuild&quot;: { # GitRepoSource describes a repo and ref of a code repository. # The repo and ref of the repository from which to build. This field is used only for those triggers that do not respond to SCM events. Triggers that respond to such events build source at whatever commit caused the event. This field is currently only used by Webhook, Pub/Sub, Manual, and Cron triggers.
         &quot;ref&quot;: &quot;A String&quot;, # The branch or tag to use. Must start with &quot;refs/&quot; (required).
         &quot;repoType&quot;: &quot;A String&quot;, # See RepoType below.
@@ -1593,7 +1601,7 @@
       &quot;A String&quot;,
     ],
     &quot;timeout&quot;: &quot;A String&quot;, # Amount of time that this build should be allowed to run, to second granularity. If this amount of time elapses, work on the build will cease and the build status will be `TIMEOUT`. `timeout` starts ticking from `startTime`. Default time is ten minutes.
-    &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. If the build does not specify source or images, these keys will not be included.
+    &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps. * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. * SETUPBUILD: time to set up build. If the build does not specify source or images, these keys will not be included.
       &quot;a_key&quot;: { # Start and end times for a build execution phase.
         &quot;endTime&quot;: &quot;A String&quot;, # End of time span.
         &quot;startTime&quot;: &quot;A String&quot;, # Start of time span.
@@ -1611,7 +1619,8 @@
   &quot;disabled&quot;: True or False, # If true, the trigger will never automatically execute a build.
   &quot;filename&quot;: &quot;A String&quot;, # Path, from the source root, to the build configuration file (i.e. cloudbuild.yaml).
   &quot;filter&quot;: &quot;A String&quot;, # Optional. A Common Expression Language string.
-  &quot;github&quot;: { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. This message is experimental. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
+  &quot;github&quot;: { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
+    &quot;enterpriseConfigResourceName&quot;: &quot;A String&quot;, # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
     &quot;installationId&quot;: &quot;A String&quot;, # The installationID that emits the GitHub event.
     &quot;name&quot;: &quot;A String&quot;, # Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is &quot;cloud-builders&quot;.
     &quot;owner&quot;: &quot;A String&quot;, # Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is &quot;googlecloudplatform&quot;.
@@ -1641,6 +1650,7 @@
     &quot;topic&quot;: &quot;A String&quot;, # The name of the topic from which this subscription is receiving messages. Format is `projects/{project}/topics/{topic}`.
   },
   &quot;resourceName&quot;: &quot;A String&quot;, # The `Trigger` name with format: `projects/{project}/locations/{location}/triggers/{trigger}`, where {trigger} is a unique identifier generated by the service.
+  &quot;serviceAccount&quot;: &quot;A String&quot;, # Optional. The service account used for all user-controlled operations including UpdateBuildTrigger, RunBuildTrigger, CreateBuild, and CancelBuild. If no service account is set, then the standard Cloud Build service account ([PROJECT_NUM]@system.gserviceaccount.com) will be used instead. Format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT_ID_OR_EMAIL}`
   &quot;sourceToBuild&quot;: { # GitRepoSource describes a repo and ref of a code repository. # The repo and ref of the repository from which to build. This field is used only for those triggers that do not respond to SCM events. Triggers that respond to such events build source at whatever commit caused the event. This field is currently only used by Webhook, Pub/Sub, Manual, and Cron triggers.
     &quot;ref&quot;: &quot;A String&quot;, # The branch or tag to use. Must start with &quot;refs/&quot; (required).
     &quot;repoType&quot;: &quot;A String&quot;, # See RepoType below.
@@ -1893,7 +1903,7 @@
       &quot;A String&quot;,
     ],
     &quot;timeout&quot;: &quot;A String&quot;, # Amount of time that this build should be allowed to run, to second granularity. If this amount of time elapses, work on the build will cease and the build status will be `TIMEOUT`. `timeout` starts ticking from `startTime`. Default time is ten minutes.
-    &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. If the build does not specify source or images, these keys will not be included.
+    &quot;timing&quot;: { # Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps. * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. * SETUPBUILD: time to set up build. If the build does not specify source or images, these keys will not be included.
       &quot;a_key&quot;: { # Start and end times for a build execution phase.
         &quot;endTime&quot;: &quot;A String&quot;, # End of time span.
         &quot;startTime&quot;: &quot;A String&quot;, # Start of time span.
@@ -1911,7 +1921,8 @@
   &quot;disabled&quot;: True or False, # If true, the trigger will never automatically execute a build.
   &quot;filename&quot;: &quot;A String&quot;, # Path, from the source root, to the build configuration file (i.e. cloudbuild.yaml).
   &quot;filter&quot;: &quot;A String&quot;, # Optional. A Common Expression Language string.
-  &quot;github&quot;: { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. This message is experimental. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
+  &quot;github&quot;: { # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. # GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. Mutually exclusive with `trigger_template`.
+    &quot;enterpriseConfigResourceName&quot;: &quot;A String&quot;, # Optional. The resource name of the github enterprise config that should be applied to this installation. For example: &quot;projects/{$project_id}/githubEnterpriseConfig/{$config_id}&quot;
     &quot;installationId&quot;: &quot;A String&quot;, # The installationID that emits the GitHub event.
     &quot;name&quot;: &quot;A String&quot;, # Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is &quot;cloud-builders&quot;.
     &quot;owner&quot;: &quot;A String&quot;, # Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is &quot;googlecloudplatform&quot;.
@@ -1941,6 +1952,7 @@
     &quot;topic&quot;: &quot;A String&quot;, # The name of the topic from which this subscription is receiving messages. Format is `projects/{project}/topics/{topic}`.
   },
   &quot;resourceName&quot;: &quot;A String&quot;, # The `Trigger` name with format: `projects/{project}/locations/{location}/triggers/{trigger}`, where {trigger} is a unique identifier generated by the service.
+  &quot;serviceAccount&quot;: &quot;A String&quot;, # Optional. The service account used for all user-controlled operations including UpdateBuildTrigger, RunBuildTrigger, CreateBuild, and CancelBuild. If no service account is set, then the standard Cloud Build service account ([PROJECT_NUM]@system.gserviceaccount.com) will be used instead. Format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT_ID_OR_EMAIL}`
   &quot;sourceToBuild&quot;: { # GitRepoSource describes a repo and ref of a code repository. # The repo and ref of the repository from which to build. This field is used only for those triggers that do not respond to SCM events. Triggers that respond to such events build source at whatever commit caused the event. This field is currently only used by Webhook, Pub/Sub, Manual, and Cron triggers.
     &quot;ref&quot;: &quot;A String&quot;, # The branch or tag to use. Must start with &quot;refs/&quot; (required).
     &quot;repoType&quot;: &quot;A String&quot;, # See RepoType below.
diff --git a/docs/dyn/cloudbuild_v1.v1.html b/docs/dyn/cloudbuild_v1.v1.html
new file mode 100644
index 0000000..d71ac40
--- /dev/null
+++ b/docs/dyn/cloudbuild_v1.v1.html
@@ -0,0 +1,119 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="cloudbuild_v1.html">Cloud Build API</a> . <a href="cloudbuild_v1.v1.html">v1</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#webhook">webhook(body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">ReceiveWebhook is called when the API receives a GitHub webhook.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="webhook">webhook(body=None, x__xgafv=None)</code>
+  <pre>ReceiveWebhook is called when the API receives a GitHub webhook.
+
+Args:
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Message that represents an arbitrary HTTP body. It should only be used for payload formats that can&#x27;t be represented as JSON, such as raw binary or an HTML page. This message can be used both in streaming and non-streaming API methods in the request as well as the response. It can be used as a top-level request field, which is convenient if one wants to extract parameters from either the URL or HTTP template into the request fields and also want access to the raw HTTP body. Example: message GetResourceRequest { // A unique request id. string request_id = 1; // The raw HTTP body is bound to this field. google.api.HttpBody http_body = 2; } service ResourceService { rpc GetResource(GetResourceRequest) returns (google.api.HttpBody); rpc UpdateResource(google.api.HttpBody) returns (google.protobuf.Empty); } Example with streaming methods: service CaldavService { rpc GetCalendar(stream google.api.HttpBody) returns (stream google.api.HttpBody); rpc UpdateCalendar(stream google.api.HttpBody) returns (stream google.api.HttpBody); } Use of this type only changes how the request and response bodies are handled, all other features will continue to work unchanged.
+  &quot;contentType&quot;: &quot;A String&quot;, # The HTTP Content-Type header value specifying the content type of the body.
+  &quot;data&quot;: &quot;A String&quot;, # The HTTP request/response body as raw binary.
+  &quot;extensions&quot;: [ # Application specific response metadata. Must be set in the first response for streaming APIs.
+    {
+      &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+    },
+  ],
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); } The JSON representation for `Empty` is empty JSON object `{}`.
+}</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/cloudkms_v1.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.html b/docs/dyn/cloudkms_v1.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.html
index 47f7131..14a8c41 100644
--- a/docs/dyn/cloudkms_v1.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.html
+++ b/docs/dyn/cloudkms_v1.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.html
@@ -105,6 +105,12 @@
   <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
 <p class="firstline">Retrieves the next page of results.</p>
 <p class="toc_element">
+  <code><a href="#macSign">macSign(name, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Signs data using a CryptoKeyVersion with CryptoKey.purpose MAC, producing a tag that can be verified by another source with the same key.</p>
+<p class="toc_element">
+  <code><a href="#macVerify">macVerify(name, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Verifies MAC tag using a CryptoKeyVersion with CryptoKey.purpose MAC, and returns a response that indicates whether or not the verification was successful.</p>
+<p class="toc_element">
   <code><a href="#patch">patch(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Update a CryptoKeyVersion's metadata. state may be changed between ENABLED and DISABLED using this method. See DestroyCryptoKeyVersion and RestoreCryptoKeyVersion to move between other states.</p>
 <p class="toc_element">
@@ -518,6 +524,71 @@
 </div>
 
 <div class="method">
+    <code class="details" id="macSign">macSign(name, body=None, x__xgafv=None)</code>
+  <pre>Signs data using a CryptoKeyVersion with CryptoKey.purpose MAC, producing a tag that can be verified by another source with the same key.
+
+Args:
+  name: string, Required. The resource name of the CryptoKeyVersion to use for signing. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request message for KeyManagementService.MacSign.
+  &quot;data&quot;: &quot;A String&quot;, # Required. The data to sign. The MAC tag is computed over this data field based on the specific algorithm.
+  &quot;dataCrc32c&quot;: &quot;A String&quot;, # Optional. An optional CRC32C checksum of the MacSignRequest.data. If specified, KeyManagementService will verify the integrity of the received MacSignRequest.data using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(MacSignRequest.data) is equal to MacSignRequest.data_crc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response message for KeyManagementService.MacSign.
+  &quot;mac&quot;: &quot;A String&quot;, # The created signature.
+  &quot;macCrc32c&quot;: &quot;A String&quot;, # Integrity verification field. A CRC32C checksum of the returned MacSignResponse.mac. An integrity check of MacSignResponse.mac can be performed by computing the CRC32C checksum of MacSignResponse.mac and comparing your results to this field. Discard the response in case of non-matching checksum values, and perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.
+  &quot;name&quot;: &quot;A String&quot;, # The resource name of the CryptoKeyVersion used for signing. Check this field to verify that the intended resource was used for signing.
+  &quot;protectionLevel&quot;: &quot;A String&quot;, # The ProtectionLevel of the CryptoKeyVersion used for signing.
+  &quot;verifiedDataCrc32c&quot;: True or False, # Integrity verification field. A flag indicating whether MacSignRequest.data_crc32c was received by KeyManagementService and used for the integrity verification of the data. A false value of this field indicates either that MacSignRequest.data_crc32c was left unset or that it was not delivered to KeyManagementService. If you&#x27;ve set MacSignRequest.data_crc32c but this field is still false, discard the response and perform a limited number of retries.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="macVerify">macVerify(name, body=None, x__xgafv=None)</code>
+  <pre>Verifies MAC tag using a CryptoKeyVersion with CryptoKey.purpose MAC, and returns a response that indicates whether or not the verification was successful.
+
+Args:
+  name: string, Required. The resource name of the CryptoKeyVersion to use for verification. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request message for KeyManagementService.MacVerify.
+  &quot;data&quot;: &quot;A String&quot;, # Required. The data used previously as a MacSignRequest.data to generate the MAC tag.
+  &quot;dataCrc32c&quot;: &quot;A String&quot;, # Optional. An optional CRC32C checksum of the MacVerifyRequest.data. If specified, KeyManagementService will verify the integrity of the received MacVerifyRequest.data using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(MacVerifyRequest.data) is equal to MacVerifyRequest.data_crc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.
+  &quot;mac&quot;: &quot;A String&quot;, # Required. The signature to verify.
+  &quot;macCrc32c&quot;: &quot;A String&quot;, # Optional. An optional CRC32C checksum of the MacVerifyRequest.mac. If specified, KeyManagementService will verify the integrity of the received MacVerifyRequest.mac using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(MacVerifyRequest.tag) is equal to MacVerifyRequest.mac_crc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response message for KeyManagementService.MacVerify.
+  &quot;name&quot;: &quot;A String&quot;, # The resource name of the CryptoKeyVersion used for verification. Check this field to verify that the intended resource was used for verification.
+  &quot;protectionLevel&quot;: &quot;A String&quot;, # The ProtectionLevel of the CryptoKeyVersion used for verification.
+  &quot;success&quot;: True or False, # This field indicates whether or not the verification operation for MacVerifyRequest.mac over MacVerifyRequest.data was successful.
+  &quot;verifiedDataCrc32c&quot;: True or False, # Integrity verification field. A flag indicating whether MacVerifyRequest.data_crc32c was received by KeyManagementService and used for the integrity verification of the data. A false value of this field indicates either that MacVerifyRequest.data_crc32c was left unset or that it was not delivered to KeyManagementService. If you&#x27;ve set MacVerifyRequest.data_crc32c but this field is still false, discard the response and perform a limited number of retries.
+  &quot;verifiedMacCrc32c&quot;: True or False, # Integrity verification field. A flag indicating whether MacVerifyRequest.mac_crc32c was received by KeyManagementService and used for the integrity verification of the data. A false value of this field indicates either that MacVerifyRequest.mac_crc32c was left unset or that it was not delivered to KeyManagementService. If you&#x27;ve set MacVerifyRequest.mac_crc32c but this field is still false, discard the response and perform a limited number of retries.
+  &quot;verifiedSuccessIntegrity&quot;: True or False, # Integrity verification field. This value is used for the integrity verification of [MacVerifyResponse.success]. If the value of this field contradicts the value of [MacVerifyResponse.success], discard the response and perform a limited number of retries.
+}</pre>
+</div>
+
+<div class="method">
     <code class="details" id="patch">patch(name, body=None, updateMask=None, x__xgafv=None)</code>
   <pre>Update a CryptoKeyVersion&#x27;s metadata. state may be changed between ENABLED and DISABLED using this method. See DestroyCryptoKeyVersion and RestoreCryptoKeyVersion to move between other states.
 
diff --git a/docs/dyn/composer_v1beta1.projects.locations.environments.html b/docs/dyn/composer_v1beta1.projects.locations.environments.html
index 769a7f7..9fc7677 100644
--- a/docs/dyn/composer_v1beta1.projects.locations.environments.html
+++ b/docs/dyn/composer_v1beta1.projects.locations.environments.html
@@ -162,10 +162,10 @@
   &quot;config&quot;: { # Configuration information for an environment. # Configuration parameters for this environment.
     &quot;airflowUri&quot;: &quot;A String&quot;, # Output only. The URI of the Apache Airflow Web UI hosted within this environment (see [Airflow web interface](/composer/docs/how-to/accessing/airflow-web-interface)).
     &quot;dagGcsPrefix&quot;: &quot;A String&quot;, # Output only. The Cloud Storage prefix of the DAGs for this environment. Although Cloud Storage objects reside in a flat namespace, a hierarchical file tree can be simulated using &quot;/&quot;-delimited object name prefixes. DAG objects for this environment reside in a simulated directory with the given prefix.
-    &quot;databaseConfig&quot;: { # The configuration of Cloud SQL instance that is used by the Apache Airflow software. # Optional. The configuration settings for Cloud SQL instance used internally by Apache Airflow software.
+    &quot;databaseConfig&quot;: { # The configuration of Cloud SQL instance that is used by the Apache Airflow software. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. # Optional. The configuration settings for Cloud SQL instance used internally by Apache Airflow software. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
       &quot;machineType&quot;: &quot;A String&quot;, # Optional. Cloud SQL machine type used by Airflow database. It has to be one of: db-n1-standard-2, db-n1-standard-4, db-n1-standard-8 or db-n1-standard-16. If not specified, db-n1-standard-2 will be used.
     },
-    &quot;encryptionConfig&quot;: { # The encryption options for the Cloud Composer environment and its dependencies. # Optional. The encryption options for the Cloud Composer environment and its dependencies. Cannot be updated.
+    &quot;encryptionConfig&quot;: { # The encryption options for the Cloud Composer environment and its dependencies. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. # Optional. The encryption options for the Cloud Composer environment and its dependencies. Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
       &quot;kmsKeyName&quot;: &quot;A String&quot;, # Optional. Customer-managed Encryption Key available through Google&#x27;s Key Management Service. Cannot be updated. If not specified, Google-managed key will be used.
     },
     &quot;environmentSize&quot;: &quot;A String&quot;, # Optional. The size of the Cloud Composer environment. This field is supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer.
@@ -176,40 +176,40 @@
       &quot;startTime&quot;: &quot;A String&quot;, # Required. Start time of the first recurrence of the maintenance window.
     },
     &quot;nodeConfig&quot;: { # The configuration information for the Kubernetes Engine nodes running the Apache Airflow software. # The configuration used for the Kubernetes Engine cluster.
-      &quot;diskSizeGb&quot;: 42, # Optional. The disk size in GB used for node VMs. Minimum size is 20GB. If unspecified, defaults to 100GB. Cannot be updated.
+      &quot;diskSizeGb&quot;: 42, # Optional. The disk size in GB used for node VMs. Minimum size is 20GB. If unspecified, defaults to 100GB. Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
       &quot;ipAllocationPolicy&quot;: { # Configuration for controlling how IPs are allocated in the GKE cluster. # Optional. The IPAllocationPolicy fields for the GKE cluster.
-        &quot;clusterIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The IP address range used to allocate IP addresses to pods in the cluster. This field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use. Specify `cluster_secondary_range_name` or `cluster_ipv4_cidr_block` but not both.
-        &quot;clusterSecondaryRangeName&quot;: &quot;A String&quot;, # Optional. The name of the cluster&#x27;s secondary range used to allocate IP addresses to pods. Specify either `cluster_secondary_range_name` or `cluster_ipv4_cidr_block` but not both. This field is applicable only when `use_ip_aliases` is true.
-        &quot;servicesIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The IP address range of the services IP addresses in this cluster. This field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use. Specify `services_secondary_range_name` or `services_ipv4_cidr_block` but not both.
-        &quot;servicesSecondaryRangeName&quot;: &quot;A String&quot;, # Optional. The name of the services&#x27; secondary range used to allocate IP addresses to the cluster. Specify either `services_secondary_range_name` or `services_ipv4_cidr_block` but not both. This field is applicable only when `use_ip_aliases` is true.
-        &quot;useIpAliases&quot;: True or False, # Optional. Whether or not to enable Alias IPs in the GKE cluster. If `true`, a VPC-native cluster is created.
+        &quot;clusterIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The IP address range used to allocate IP addresses to pods in the cluster. This field is applicable only when `use_ip_aliases` is true. For Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*, this field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use. Specify `cluster_secondary_range_name` or `cluster_ipv4_cidr_block` but not both.
+        &quot;clusterSecondaryRangeName&quot;: &quot;A String&quot;, # Optional. The name of the cluster&#x27;s secondary range used to allocate IP addresses to pods. Specify either `cluster_secondary_range_name` or `cluster_ipv4_cidr_block` but not both. This field is applicable only when `use_ip_aliases` is true. For Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*, this field is applicable only when `use_ip_aliases` is true.
+        &quot;servicesIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The IP address range of the services IP addresses in this cluster. This field is applicable only when `use_ip_aliases` is true. For Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*, this field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use. Specify `services_secondary_range_name` or `services_ipv4_cidr_block` but not both.
+        &quot;servicesSecondaryRangeName&quot;: &quot;A String&quot;, # Optional. The name of the services&#x27; secondary range used to allocate IP addresses to the cluster. Specify either `services_secondary_range_name` or `services_ipv4_cidr_block` but not both. This field is applicable only when `use_ip_aliases` is true. For Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*, this field is applicable only when `use_ip_aliases` is true.
+        &quot;useIpAliases&quot;: True or False, # Optional. Whether or not to enable Alias IPs in the GKE cluster. If `true`, a VPC-native cluster is created. This field is only supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. Environments in newer versions always use VPC-native GKE clusters.
       },
-      &quot;location&quot;: &quot;A String&quot;, # Optional. The Compute Engine [zone](/compute/docs/regions-zones) in which to deploy the VMs used to run the Apache Airflow software, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: &quot;projects/{projectId}/zones/{zoneId}&quot;. This `location` must belong to the enclosing environment&#x27;s project and location. If both this field and `nodeConfig.machineType` are specified, `nodeConfig.machineType` must belong to this `location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If only one field (`location` or `nodeConfig.machineType`) is specified, the location information from the specified field will be propagated to the unspecified field.
-      &quot;machineType&quot;: &quot;A String&quot;, # Optional. The Compute Engine [machine type](/compute/docs/machine-types) used for cluster instances, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: &quot;projects/{projectId}/zones/{zoneId}/machineTypes/{machineTypeId}&quot;. The `machineType` must belong to the enclosing environment&#x27;s project and location. If both this field and `nodeConfig.location` are specified, this `machineType` must belong to the `nodeConfig.location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If exactly one of this field and `nodeConfig.location` is specified, the location information from the specified field will be propagated to the unspecified field. The `machineTypeId` must not be a [shared-core machine type](/compute/docs/machine-types#sharedcore). If this field is unspecified, the `machineTypeId` defaults to &quot;n1-standard-1&quot;.
-      &quot;maxPodsPerNode&quot;: 42, # Optional. The maximum number of pods per node in the Cloud Composer GKE cluster. The value must be between 8 and 110 and it can be set only if the environment is VPC-native. The default value is 32. Values of this field will be propagated both to the `default-pool` node pool of the newly created GKE cluster, and to the default &quot;Maximum Pods per Node&quot; value which is used for newly created node pools if their value is not explicitly set during node pool creation. For more information, see [Optimizing IP address allocation] (https://cloud.google.com/kubernetes-engine/docs/how-to/flexible-pod-cidr). Cannot be updated.
+      &quot;location&quot;: &quot;A String&quot;, # Optional. The Compute Engine [zone](/compute/docs/regions-zones) in which to deploy the VMs used to run the Apache Airflow software, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: &quot;projects/{projectId}/zones/{zoneId}&quot;. This `location` must belong to the enclosing environment&#x27;s project and location. If both this field and `nodeConfig.machineType` are specified, `nodeConfig.machineType` must belong to this `location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If only one field (`location` or `nodeConfig.machineType`) is specified, the location information from the specified field will be propagated to the unspecified field. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
+      &quot;machineType&quot;: &quot;A String&quot;, # Optional. The Compute Engine [machine type](/compute/docs/machine-types) used for cluster instances, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: &quot;projects/{projectId}/zones/{zoneId}/machineTypes/{machineTypeId}&quot;. The `machineType` must belong to the enclosing environment&#x27;s project and location. If both this field and `nodeConfig.location` are specified, this `machineType` must belong to the `nodeConfig.location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If exactly one of this field and `nodeConfig.location` is specified, the location information from the specified field will be propagated to the unspecified field. The `machineTypeId` must not be a [shared-core machine type](/compute/docs/machine-types#sharedcore). If this field is unspecified, the `machineTypeId` defaults to &quot;n1-standard-1&quot;. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
+      &quot;maxPodsPerNode&quot;: 42, # Optional. The maximum number of pods per node in the Cloud Composer GKE cluster. The value must be between 8 and 110 and it can be set only if the environment is VPC-native. The default value is 32. Values of this field will be propagated both to the `default-pool` node pool of the newly created GKE cluster, and to the default &quot;Maximum Pods per Node&quot; value which is used for newly created node pools if their value is not explicitly set during node pool creation. For more information, see [Optimizing IP address allocation] (https://cloud.google.com/kubernetes-engine/docs/how-to/flexible-pod-cidr). Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
       &quot;network&quot;: &quot;A String&quot;, # Optional. The Compute Engine network to be used for machine communications, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: &quot;projects/{projectId}/global/networks/{networkId}&quot;. If unspecified, the default network in the environment&#x27;s project is used. If a [Custom Subnet Network](/vpc/docs/vpc#vpc_networks_and_subnets) is provided, `nodeConfig.subnetwork` must also be provided. For [Shared VPC](/vpc/docs/shared-vpc) subnetwork requirements, see `nodeConfig.subnetwork`.
-      &quot;oauthScopes&quot;: [ # Optional. The set of Google API scopes to be made available on all node VMs. If `oauth_scopes` is empty, defaults to [&quot;https://www.googleapis.com/auth/cloud-platform&quot;]. Cannot be updated.
+      &quot;oauthScopes&quot;: [ # Optional. The set of Google API scopes to be made available on all node VMs. If `oauth_scopes` is empty, defaults to [&quot;https://www.googleapis.com/auth/cloud-platform&quot;]. Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
         &quot;A String&quot;,
       ],
       &quot;serviceAccount&quot;: &quot;A String&quot;, # Optional. The Google Cloud Platform Service Account to be used by the workloads. If a service account is not specified, the &quot;default&quot; Compute Engine service account is used. Cannot be updated.
       &quot;subnetwork&quot;: &quot;A String&quot;, # Optional. The Compute Engine subnetwork to be used for machine communications, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: &quot;projects/{projectId}/regions/{regionId}/subnetworks/{subnetworkId}&quot; If a subnetwork is provided, `nodeConfig.network` must also be provided, and the subnetwork must belong to the enclosing environment&#x27;s project and location.
-      &quot;tags&quot;: [ # Optional. The list of instance tags applied to all node VMs. Tags are used to identify valid sources or targets for network firewalls. Each tag within the list must comply with [RFC1035](https://www.ietf.org/rfc/rfc1035.txt). Cannot be updated.
+      &quot;tags&quot;: [ # Optional. The list of instance tags applied to all node VMs. Tags are used to identify valid sources or targets for network firewalls. Each tag within the list must comply with [RFC1035](https://www.ietf.org/rfc/rfc1035.txt). Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
         &quot;A String&quot;,
       ],
     },
-    &quot;nodeCount&quot;: 42, # The number of nodes in the Kubernetes Engine cluster that will be used to run this environment.
+    &quot;nodeCount&quot;: 42, # The number of nodes in the Kubernetes Engine cluster that will be used to run this environment. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
     &quot;privateEnvironmentConfig&quot;: { # The configuration information for configuring a Private IP Cloud Composer environment. # The configuration used for the Private IP Cloud Composer environment.
       &quot;cloudComposerNetworkIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The CIDR block from which IP range for Cloud Composer Network in tenant project will be reserved. Needs to be disjoint from private_cluster_config.master_ipv4_cidr_block and cloud_sql_ipv4_cidr_block. This field is supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer.
       &quot;cloudComposerNetworkIpv4ReservedRange&quot;: &quot;A String&quot;, # Output only. The IP range reserved for the tenant project&#x27;s Cloud Composer network. This field is supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer.
       &quot;cloudSqlIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The CIDR block from which IP range in tenant project will be reserved for Cloud SQL. Needs to be disjoint from web_server_ipv4_cidr_block
-      &quot;enablePrivateEnvironment&quot;: True or False, # Optional. If `true`, a Private IP Cloud Composer environment is created. If this field is set to true, `IPAllocationPolicy.use_ip_aliases` must be set to true .
+      &quot;enablePrivateEnvironment&quot;: True or False, # Optional. If `true`, a Private IP Cloud Composer environment is created. If this field is set to true, `IPAllocationPolicy.use_ip_aliases` must be set to true for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
       &quot;privateClusterConfig&quot;: { # Configuration options for the private GKE cluster in a Cloud Composer environment. # Optional. Configuration for the private GKE cluster for a Private IP Cloud Composer environment.
         &quot;enablePrivateEndpoint&quot;: True or False, # Optional. If `true`, access to the public endpoint of the GKE cluster is denied.
         &quot;masterIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The CIDR block from which IPv4 range for GKE master will be reserved. If left blank, the default value of &#x27;172.16.0.0/23&#x27; is used.
         &quot;masterIpv4ReservedRange&quot;: &quot;A String&quot;, # Output only. The IP range in CIDR notation to use for the hosted master network. This range is used for assigning internal IP addresses to the cluster master or set of masters and to the internal load balancer virtual IP. This range must not overlap with any other ranges in use within the cluster&#x27;s network.
       },
-      &quot;webServerIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The CIDR block from which IP range for web server will be reserved. Needs to be disjoint from private_cluster_config.master_ipv4_cidr_block and cloud_sql_ipv4_cidr_block.
-      &quot;webServerIpv4ReservedRange&quot;: &quot;A String&quot;, # Output only. The IP range reserved for the tenant project&#x27;s App Engine VMs.
+      &quot;webServerIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The CIDR block from which IP range for web server will be reserved. Needs to be disjoint from private_cluster_config.master_ipv4_cidr_block and cloud_sql_ipv4_cidr_block. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
+      &quot;webServerIpv4ReservedRange&quot;: &quot;A String&quot;, # Output only. The IP range reserved for the tenant project&#x27;s App Engine VMs. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
     },
     &quot;softwareConfig&quot;: { # Specifies the selection and configuration of software inside the environment. # The configuration settings for software inside the environment.
       &quot;airflowConfigOverrides&quot;: { # Optional. Apache Airflow configuration properties to override. Property keys contain the section and property names, separated by a hyphen, for example &quot;core-dags_are_paused_at_creation&quot;. Section names must not contain hyphens (&quot;-&quot;), opening square brackets (&quot;[&quot;), or closing square brackets (&quot;]&quot;). The property name must not be empty and must not contain an equals sign (&quot;=&quot;) or semicolon (&quot;;&quot;). Section and property names must not contain a period (&quot;.&quot;). Apache Airflow configuration property names must be written in [snake_case](https://en.wikipedia.org/wiki/Snake_case). Property values can contain any character, and can be written in any lower/upper case format. Certain Apache Airflow configuration property values are [blocked](/composer/docs/concepts/airflow-configurations), and cannot be overridden.
@@ -222,13 +222,13 @@
       &quot;pypiPackages&quot;: { # Optional. Custom Python Package Index (PyPI) packages to be installed in the environment. Keys refer to the lowercase package name such as &quot;numpy&quot; and values are the lowercase extras and version specifier such as &quot;==1.12.0&quot;, &quot;[devel,gcp_api]&quot;, or &quot;[devel]&gt;=1.8.2, &lt;1.9.2&quot;. To specify a package without pinning it to a version specifier, use the empty string as the value.
         &quot;a_key&quot;: &quot;A String&quot;,
       },
-      &quot;pythonVersion&quot;: &quot;A String&quot;, # Optional. The major version of Python used to run the Apache Airflow scheduler, worker, and webserver processes. Can be set to &#x27;2&#x27; or &#x27;3&#x27;. If not specified, the default is &#x27;3&#x27;. Cannot be updated.
-      &quot;schedulerCount&quot;: 42, # Optional. The number of schedulers for Airflow.
+      &quot;pythonVersion&quot;: &quot;A String&quot;, # Optional. The major version of Python used to run the Apache Airflow scheduler, worker, and webserver processes. Can be set to &#x27;2&#x27; or &#x27;3&#x27;. If not specified, the default is &#x27;3&#x27;. Cannot be updated. This field is only supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. Environments in newer versions always use Python major version 3.
+      &quot;schedulerCount&quot;: 42, # Optional. The number of schedulers for Airflow. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-2.*.*.
     },
-    &quot;webServerConfig&quot;: { # The configuration settings for the Airflow web server App Engine instance. # Optional. The configuration settings for the Airflow web server App Engine instance.
+    &quot;webServerConfig&quot;: { # The configuration settings for the Airflow web server App Engine instance. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. # Optional. The configuration settings for the Airflow web server App Engine instance. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
       &quot;machineType&quot;: &quot;A String&quot;, # Optional. Machine type on which Airflow web server is running. It has to be one of: composer-n1-webserver-2, composer-n1-webserver-4 or composer-n1-webserver-8. If not specified, composer-n1-webserver-2 will be used. Value custom is returned only in response, if Airflow web server parameters were manually changed to a non-standard values.
     },
-    &quot;webServerNetworkAccessControl&quot;: { # Network-level access control policy for the Airflow web server. # Optional. The network-level access control policy for the Airflow web server. If unspecified, no network-level access restrictions will be applied.
+    &quot;webServerNetworkAccessControl&quot;: { # Network-level access control policy for the Airflow web server. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. # Optional. The network-level access control policy for the Airflow web server. If unspecified, no network-level access restrictions will be applied. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
       &quot;allowedIpRanges&quot;: [ # A collection of allowed IP ranges with descriptions.
         { # Allowed IP range with user-provided description.
           &quot;description&quot;: &quot;A String&quot;, # Optional. User-provided description. It must contain at most 300 characters.
@@ -349,10 +349,10 @@
   &quot;config&quot;: { # Configuration information for an environment. # Configuration parameters for this environment.
     &quot;airflowUri&quot;: &quot;A String&quot;, # Output only. The URI of the Apache Airflow Web UI hosted within this environment (see [Airflow web interface](/composer/docs/how-to/accessing/airflow-web-interface)).
     &quot;dagGcsPrefix&quot;: &quot;A String&quot;, # Output only. The Cloud Storage prefix of the DAGs for this environment. Although Cloud Storage objects reside in a flat namespace, a hierarchical file tree can be simulated using &quot;/&quot;-delimited object name prefixes. DAG objects for this environment reside in a simulated directory with the given prefix.
-    &quot;databaseConfig&quot;: { # The configuration of Cloud SQL instance that is used by the Apache Airflow software. # Optional. The configuration settings for Cloud SQL instance used internally by Apache Airflow software.
+    &quot;databaseConfig&quot;: { # The configuration of Cloud SQL instance that is used by the Apache Airflow software. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. # Optional. The configuration settings for Cloud SQL instance used internally by Apache Airflow software. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
       &quot;machineType&quot;: &quot;A String&quot;, # Optional. Cloud SQL machine type used by Airflow database. It has to be one of: db-n1-standard-2, db-n1-standard-4, db-n1-standard-8 or db-n1-standard-16. If not specified, db-n1-standard-2 will be used.
     },
-    &quot;encryptionConfig&quot;: { # The encryption options for the Cloud Composer environment and its dependencies. # Optional. The encryption options for the Cloud Composer environment and its dependencies. Cannot be updated.
+    &quot;encryptionConfig&quot;: { # The encryption options for the Cloud Composer environment and its dependencies. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. # Optional. The encryption options for the Cloud Composer environment and its dependencies. Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
       &quot;kmsKeyName&quot;: &quot;A String&quot;, # Optional. Customer-managed Encryption Key available through Google&#x27;s Key Management Service. Cannot be updated. If not specified, Google-managed key will be used.
     },
     &quot;environmentSize&quot;: &quot;A String&quot;, # Optional. The size of the Cloud Composer environment. This field is supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer.
@@ -363,40 +363,40 @@
       &quot;startTime&quot;: &quot;A String&quot;, # Required. Start time of the first recurrence of the maintenance window.
     },
     &quot;nodeConfig&quot;: { # The configuration information for the Kubernetes Engine nodes running the Apache Airflow software. # The configuration used for the Kubernetes Engine cluster.
-      &quot;diskSizeGb&quot;: 42, # Optional. The disk size in GB used for node VMs. Minimum size is 20GB. If unspecified, defaults to 100GB. Cannot be updated.
+      &quot;diskSizeGb&quot;: 42, # Optional. The disk size in GB used for node VMs. Minimum size is 20GB. If unspecified, defaults to 100GB. Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
       &quot;ipAllocationPolicy&quot;: { # Configuration for controlling how IPs are allocated in the GKE cluster. # Optional. The IPAllocationPolicy fields for the GKE cluster.
-        &quot;clusterIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The IP address range used to allocate IP addresses to pods in the cluster. This field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use. Specify `cluster_secondary_range_name` or `cluster_ipv4_cidr_block` but not both.
-        &quot;clusterSecondaryRangeName&quot;: &quot;A String&quot;, # Optional. The name of the cluster&#x27;s secondary range used to allocate IP addresses to pods. Specify either `cluster_secondary_range_name` or `cluster_ipv4_cidr_block` but not both. This field is applicable only when `use_ip_aliases` is true.
-        &quot;servicesIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The IP address range of the services IP addresses in this cluster. This field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use. Specify `services_secondary_range_name` or `services_ipv4_cidr_block` but not both.
-        &quot;servicesSecondaryRangeName&quot;: &quot;A String&quot;, # Optional. The name of the services&#x27; secondary range used to allocate IP addresses to the cluster. Specify either `services_secondary_range_name` or `services_ipv4_cidr_block` but not both. This field is applicable only when `use_ip_aliases` is true.
-        &quot;useIpAliases&quot;: True or False, # Optional. Whether or not to enable Alias IPs in the GKE cluster. If `true`, a VPC-native cluster is created.
+        &quot;clusterIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The IP address range used to allocate IP addresses to pods in the cluster. This field is applicable only when `use_ip_aliases` is true. For Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*, this field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use. Specify `cluster_secondary_range_name` or `cluster_ipv4_cidr_block` but not both.
+        &quot;clusterSecondaryRangeName&quot;: &quot;A String&quot;, # Optional. The name of the cluster&#x27;s secondary range used to allocate IP addresses to pods. Specify either `cluster_secondary_range_name` or `cluster_ipv4_cidr_block` but not both. This field is applicable only when `use_ip_aliases` is true. For Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*, this field is applicable only when `use_ip_aliases` is true.
+        &quot;servicesIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The IP address range of the services IP addresses in this cluster. This field is applicable only when `use_ip_aliases` is true. For Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*, this field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use. Specify `services_secondary_range_name` or `services_ipv4_cidr_block` but not both.
+        &quot;servicesSecondaryRangeName&quot;: &quot;A String&quot;, # Optional. The name of the services&#x27; secondary range used to allocate IP addresses to the cluster. Specify either `services_secondary_range_name` or `services_ipv4_cidr_block` but not both. This field is applicable only when `use_ip_aliases` is true. For Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*, this field is applicable only when `use_ip_aliases` is true.
+        &quot;useIpAliases&quot;: True or False, # Optional. Whether or not to enable Alias IPs in the GKE cluster. If `true`, a VPC-native cluster is created. This field is only supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. Environments in newer versions always use VPC-native GKE clusters.
       },
-      &quot;location&quot;: &quot;A String&quot;, # Optional. The Compute Engine [zone](/compute/docs/regions-zones) in which to deploy the VMs used to run the Apache Airflow software, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: &quot;projects/{projectId}/zones/{zoneId}&quot;. This `location` must belong to the enclosing environment&#x27;s project and location. If both this field and `nodeConfig.machineType` are specified, `nodeConfig.machineType` must belong to this `location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If only one field (`location` or `nodeConfig.machineType`) is specified, the location information from the specified field will be propagated to the unspecified field.
-      &quot;machineType&quot;: &quot;A String&quot;, # Optional. The Compute Engine [machine type](/compute/docs/machine-types) used for cluster instances, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: &quot;projects/{projectId}/zones/{zoneId}/machineTypes/{machineTypeId}&quot;. The `machineType` must belong to the enclosing environment&#x27;s project and location. If both this field and `nodeConfig.location` are specified, this `machineType` must belong to the `nodeConfig.location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If exactly one of this field and `nodeConfig.location` is specified, the location information from the specified field will be propagated to the unspecified field. The `machineTypeId` must not be a [shared-core machine type](/compute/docs/machine-types#sharedcore). If this field is unspecified, the `machineTypeId` defaults to &quot;n1-standard-1&quot;.
-      &quot;maxPodsPerNode&quot;: 42, # Optional. The maximum number of pods per node in the Cloud Composer GKE cluster. The value must be between 8 and 110 and it can be set only if the environment is VPC-native. The default value is 32. Values of this field will be propagated both to the `default-pool` node pool of the newly created GKE cluster, and to the default &quot;Maximum Pods per Node&quot; value which is used for newly created node pools if their value is not explicitly set during node pool creation. For more information, see [Optimizing IP address allocation] (https://cloud.google.com/kubernetes-engine/docs/how-to/flexible-pod-cidr). Cannot be updated.
+      &quot;location&quot;: &quot;A String&quot;, # Optional. The Compute Engine [zone](/compute/docs/regions-zones) in which to deploy the VMs used to run the Apache Airflow software, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: &quot;projects/{projectId}/zones/{zoneId}&quot;. This `location` must belong to the enclosing environment&#x27;s project and location. If both this field and `nodeConfig.machineType` are specified, `nodeConfig.machineType` must belong to this `location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If only one field (`location` or `nodeConfig.machineType`) is specified, the location information from the specified field will be propagated to the unspecified field. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
+      &quot;machineType&quot;: &quot;A String&quot;, # Optional. The Compute Engine [machine type](/compute/docs/machine-types) used for cluster instances, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: &quot;projects/{projectId}/zones/{zoneId}/machineTypes/{machineTypeId}&quot;. The `machineType` must belong to the enclosing environment&#x27;s project and location. If both this field and `nodeConfig.location` are specified, this `machineType` must belong to the `nodeConfig.location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If exactly one of this field and `nodeConfig.location` is specified, the location information from the specified field will be propagated to the unspecified field. The `machineTypeId` must not be a [shared-core machine type](/compute/docs/machine-types#sharedcore). If this field is unspecified, the `machineTypeId` defaults to &quot;n1-standard-1&quot;. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
+      &quot;maxPodsPerNode&quot;: 42, # Optional. The maximum number of pods per node in the Cloud Composer GKE cluster. The value must be between 8 and 110 and it can be set only if the environment is VPC-native. The default value is 32. Values of this field will be propagated both to the `default-pool` node pool of the newly created GKE cluster, and to the default &quot;Maximum Pods per Node&quot; value which is used for newly created node pools if their value is not explicitly set during node pool creation. For more information, see [Optimizing IP address allocation] (https://cloud.google.com/kubernetes-engine/docs/how-to/flexible-pod-cidr). Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
       &quot;network&quot;: &quot;A String&quot;, # Optional. The Compute Engine network to be used for machine communications, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: &quot;projects/{projectId}/global/networks/{networkId}&quot;. If unspecified, the default network in the environment&#x27;s project is used. If a [Custom Subnet Network](/vpc/docs/vpc#vpc_networks_and_subnets) is provided, `nodeConfig.subnetwork` must also be provided. For [Shared VPC](/vpc/docs/shared-vpc) subnetwork requirements, see `nodeConfig.subnetwork`.
-      &quot;oauthScopes&quot;: [ # Optional. The set of Google API scopes to be made available on all node VMs. If `oauth_scopes` is empty, defaults to [&quot;https://www.googleapis.com/auth/cloud-platform&quot;]. Cannot be updated.
+      &quot;oauthScopes&quot;: [ # Optional. The set of Google API scopes to be made available on all node VMs. If `oauth_scopes` is empty, defaults to [&quot;https://www.googleapis.com/auth/cloud-platform&quot;]. Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
         &quot;A String&quot;,
       ],
       &quot;serviceAccount&quot;: &quot;A String&quot;, # Optional. The Google Cloud Platform Service Account to be used by the workloads. If a service account is not specified, the &quot;default&quot; Compute Engine service account is used. Cannot be updated.
       &quot;subnetwork&quot;: &quot;A String&quot;, # Optional. The Compute Engine subnetwork to be used for machine communications, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: &quot;projects/{projectId}/regions/{regionId}/subnetworks/{subnetworkId}&quot; If a subnetwork is provided, `nodeConfig.network` must also be provided, and the subnetwork must belong to the enclosing environment&#x27;s project and location.
-      &quot;tags&quot;: [ # Optional. The list of instance tags applied to all node VMs. Tags are used to identify valid sources or targets for network firewalls. Each tag within the list must comply with [RFC1035](https://www.ietf.org/rfc/rfc1035.txt). Cannot be updated.
+      &quot;tags&quot;: [ # Optional. The list of instance tags applied to all node VMs. Tags are used to identify valid sources or targets for network firewalls. Each tag within the list must comply with [RFC1035](https://www.ietf.org/rfc/rfc1035.txt). Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
         &quot;A String&quot;,
       ],
     },
-    &quot;nodeCount&quot;: 42, # The number of nodes in the Kubernetes Engine cluster that will be used to run this environment.
+    &quot;nodeCount&quot;: 42, # The number of nodes in the Kubernetes Engine cluster that will be used to run this environment. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
     &quot;privateEnvironmentConfig&quot;: { # The configuration information for configuring a Private IP Cloud Composer environment. # The configuration used for the Private IP Cloud Composer environment.
       &quot;cloudComposerNetworkIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The CIDR block from which IP range for Cloud Composer Network in tenant project will be reserved. Needs to be disjoint from private_cluster_config.master_ipv4_cidr_block and cloud_sql_ipv4_cidr_block. This field is supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer.
       &quot;cloudComposerNetworkIpv4ReservedRange&quot;: &quot;A String&quot;, # Output only. The IP range reserved for the tenant project&#x27;s Cloud Composer network. This field is supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer.
       &quot;cloudSqlIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The CIDR block from which IP range in tenant project will be reserved for Cloud SQL. Needs to be disjoint from web_server_ipv4_cidr_block
-      &quot;enablePrivateEnvironment&quot;: True or False, # Optional. If `true`, a Private IP Cloud Composer environment is created. If this field is set to true, `IPAllocationPolicy.use_ip_aliases` must be set to true .
+      &quot;enablePrivateEnvironment&quot;: True or False, # Optional. If `true`, a Private IP Cloud Composer environment is created. If this field is set to true, `IPAllocationPolicy.use_ip_aliases` must be set to true for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
       &quot;privateClusterConfig&quot;: { # Configuration options for the private GKE cluster in a Cloud Composer environment. # Optional. Configuration for the private GKE cluster for a Private IP Cloud Composer environment.
         &quot;enablePrivateEndpoint&quot;: True or False, # Optional. If `true`, access to the public endpoint of the GKE cluster is denied.
         &quot;masterIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The CIDR block from which IPv4 range for GKE master will be reserved. If left blank, the default value of &#x27;172.16.0.0/23&#x27; is used.
         &quot;masterIpv4ReservedRange&quot;: &quot;A String&quot;, # Output only. The IP range in CIDR notation to use for the hosted master network. This range is used for assigning internal IP addresses to the cluster master or set of masters and to the internal load balancer virtual IP. This range must not overlap with any other ranges in use within the cluster&#x27;s network.
       },
-      &quot;webServerIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The CIDR block from which IP range for web server will be reserved. Needs to be disjoint from private_cluster_config.master_ipv4_cidr_block and cloud_sql_ipv4_cidr_block.
-      &quot;webServerIpv4ReservedRange&quot;: &quot;A String&quot;, # Output only. The IP range reserved for the tenant project&#x27;s App Engine VMs.
+      &quot;webServerIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The CIDR block from which IP range for web server will be reserved. Needs to be disjoint from private_cluster_config.master_ipv4_cidr_block and cloud_sql_ipv4_cidr_block. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
+      &quot;webServerIpv4ReservedRange&quot;: &quot;A String&quot;, # Output only. The IP range reserved for the tenant project&#x27;s App Engine VMs. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
     },
     &quot;softwareConfig&quot;: { # Specifies the selection and configuration of software inside the environment. # The configuration settings for software inside the environment.
       &quot;airflowConfigOverrides&quot;: { # Optional. Apache Airflow configuration properties to override. Property keys contain the section and property names, separated by a hyphen, for example &quot;core-dags_are_paused_at_creation&quot;. Section names must not contain hyphens (&quot;-&quot;), opening square brackets (&quot;[&quot;), or closing square brackets (&quot;]&quot;). The property name must not be empty and must not contain an equals sign (&quot;=&quot;) or semicolon (&quot;;&quot;). Section and property names must not contain a period (&quot;.&quot;). Apache Airflow configuration property names must be written in [snake_case](https://en.wikipedia.org/wiki/Snake_case). Property values can contain any character, and can be written in any lower/upper case format. Certain Apache Airflow configuration property values are [blocked](/composer/docs/concepts/airflow-configurations), and cannot be overridden.
@@ -409,13 +409,13 @@
       &quot;pypiPackages&quot;: { # Optional. Custom Python Package Index (PyPI) packages to be installed in the environment. Keys refer to the lowercase package name such as &quot;numpy&quot; and values are the lowercase extras and version specifier such as &quot;==1.12.0&quot;, &quot;[devel,gcp_api]&quot;, or &quot;[devel]&gt;=1.8.2, &lt;1.9.2&quot;. To specify a package without pinning it to a version specifier, use the empty string as the value.
         &quot;a_key&quot;: &quot;A String&quot;,
       },
-      &quot;pythonVersion&quot;: &quot;A String&quot;, # Optional. The major version of Python used to run the Apache Airflow scheduler, worker, and webserver processes. Can be set to &#x27;2&#x27; or &#x27;3&#x27;. If not specified, the default is &#x27;3&#x27;. Cannot be updated.
-      &quot;schedulerCount&quot;: 42, # Optional. The number of schedulers for Airflow.
+      &quot;pythonVersion&quot;: &quot;A String&quot;, # Optional. The major version of Python used to run the Apache Airflow scheduler, worker, and webserver processes. Can be set to &#x27;2&#x27; or &#x27;3&#x27;. If not specified, the default is &#x27;3&#x27;. Cannot be updated. This field is only supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. Environments in newer versions always use Python major version 3.
+      &quot;schedulerCount&quot;: 42, # Optional. The number of schedulers for Airflow. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-2.*.*.
     },
-    &quot;webServerConfig&quot;: { # The configuration settings for the Airflow web server App Engine instance. # Optional. The configuration settings for the Airflow web server App Engine instance.
+    &quot;webServerConfig&quot;: { # The configuration settings for the Airflow web server App Engine instance. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. # Optional. The configuration settings for the Airflow web server App Engine instance. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
       &quot;machineType&quot;: &quot;A String&quot;, # Optional. Machine type on which Airflow web server is running. It has to be one of: composer-n1-webserver-2, composer-n1-webserver-4 or composer-n1-webserver-8. If not specified, composer-n1-webserver-2 will be used. Value custom is returned only in response, if Airflow web server parameters were manually changed to a non-standard values.
     },
-    &quot;webServerNetworkAccessControl&quot;: { # Network-level access control policy for the Airflow web server. # Optional. The network-level access control policy for the Airflow web server. If unspecified, no network-level access restrictions will be applied.
+    &quot;webServerNetworkAccessControl&quot;: { # Network-level access control policy for the Airflow web server. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. # Optional. The network-level access control policy for the Airflow web server. If unspecified, no network-level access restrictions will be applied. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
       &quot;allowedIpRanges&quot;: [ # A collection of allowed IP ranges with descriptions.
         { # Allowed IP range with user-provided description.
           &quot;description&quot;: &quot;A String&quot;, # Optional. User-provided description. It must contain at most 300 characters.
@@ -477,10 +477,10 @@
       &quot;config&quot;: { # Configuration information for an environment. # Configuration parameters for this environment.
         &quot;airflowUri&quot;: &quot;A String&quot;, # Output only. The URI of the Apache Airflow Web UI hosted within this environment (see [Airflow web interface](/composer/docs/how-to/accessing/airflow-web-interface)).
         &quot;dagGcsPrefix&quot;: &quot;A String&quot;, # Output only. The Cloud Storage prefix of the DAGs for this environment. Although Cloud Storage objects reside in a flat namespace, a hierarchical file tree can be simulated using &quot;/&quot;-delimited object name prefixes. DAG objects for this environment reside in a simulated directory with the given prefix.
-        &quot;databaseConfig&quot;: { # The configuration of Cloud SQL instance that is used by the Apache Airflow software. # Optional. The configuration settings for Cloud SQL instance used internally by Apache Airflow software.
+        &quot;databaseConfig&quot;: { # The configuration of Cloud SQL instance that is used by the Apache Airflow software. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. # Optional. The configuration settings for Cloud SQL instance used internally by Apache Airflow software. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
           &quot;machineType&quot;: &quot;A String&quot;, # Optional. Cloud SQL machine type used by Airflow database. It has to be one of: db-n1-standard-2, db-n1-standard-4, db-n1-standard-8 or db-n1-standard-16. If not specified, db-n1-standard-2 will be used.
         },
-        &quot;encryptionConfig&quot;: { # The encryption options for the Cloud Composer environment and its dependencies. # Optional. The encryption options for the Cloud Composer environment and its dependencies. Cannot be updated.
+        &quot;encryptionConfig&quot;: { # The encryption options for the Cloud Composer environment and its dependencies. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. # Optional. The encryption options for the Cloud Composer environment and its dependencies. Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
           &quot;kmsKeyName&quot;: &quot;A String&quot;, # Optional. Customer-managed Encryption Key available through Google&#x27;s Key Management Service. Cannot be updated. If not specified, Google-managed key will be used.
         },
         &quot;environmentSize&quot;: &quot;A String&quot;, # Optional. The size of the Cloud Composer environment. This field is supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer.
@@ -491,40 +491,40 @@
           &quot;startTime&quot;: &quot;A String&quot;, # Required. Start time of the first recurrence of the maintenance window.
         },
         &quot;nodeConfig&quot;: { # The configuration information for the Kubernetes Engine nodes running the Apache Airflow software. # The configuration used for the Kubernetes Engine cluster.
-          &quot;diskSizeGb&quot;: 42, # Optional. The disk size in GB used for node VMs. Minimum size is 20GB. If unspecified, defaults to 100GB. Cannot be updated.
+          &quot;diskSizeGb&quot;: 42, # Optional. The disk size in GB used for node VMs. Minimum size is 20GB. If unspecified, defaults to 100GB. Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
           &quot;ipAllocationPolicy&quot;: { # Configuration for controlling how IPs are allocated in the GKE cluster. # Optional. The IPAllocationPolicy fields for the GKE cluster.
-            &quot;clusterIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The IP address range used to allocate IP addresses to pods in the cluster. This field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use. Specify `cluster_secondary_range_name` or `cluster_ipv4_cidr_block` but not both.
-            &quot;clusterSecondaryRangeName&quot;: &quot;A String&quot;, # Optional. The name of the cluster&#x27;s secondary range used to allocate IP addresses to pods. Specify either `cluster_secondary_range_name` or `cluster_ipv4_cidr_block` but not both. This field is applicable only when `use_ip_aliases` is true.
-            &quot;servicesIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The IP address range of the services IP addresses in this cluster. This field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use. Specify `services_secondary_range_name` or `services_ipv4_cidr_block` but not both.
-            &quot;servicesSecondaryRangeName&quot;: &quot;A String&quot;, # Optional. The name of the services&#x27; secondary range used to allocate IP addresses to the cluster. Specify either `services_secondary_range_name` or `services_ipv4_cidr_block` but not both. This field is applicable only when `use_ip_aliases` is true.
-            &quot;useIpAliases&quot;: True or False, # Optional. Whether or not to enable Alias IPs in the GKE cluster. If `true`, a VPC-native cluster is created.
+            &quot;clusterIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The IP address range used to allocate IP addresses to pods in the cluster. This field is applicable only when `use_ip_aliases` is true. For Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*, this field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use. Specify `cluster_secondary_range_name` or `cluster_ipv4_cidr_block` but not both.
+            &quot;clusterSecondaryRangeName&quot;: &quot;A String&quot;, # Optional. The name of the cluster&#x27;s secondary range used to allocate IP addresses to pods. Specify either `cluster_secondary_range_name` or `cluster_ipv4_cidr_block` but not both. This field is applicable only when `use_ip_aliases` is true. For Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*, this field is applicable only when `use_ip_aliases` is true.
+            &quot;servicesIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The IP address range of the services IP addresses in this cluster. This field is applicable only when `use_ip_aliases` is true. For Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*, this field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use. Specify `services_secondary_range_name` or `services_ipv4_cidr_block` but not both.
+            &quot;servicesSecondaryRangeName&quot;: &quot;A String&quot;, # Optional. The name of the services&#x27; secondary range used to allocate IP addresses to the cluster. Specify either `services_secondary_range_name` or `services_ipv4_cidr_block` but not both. This field is applicable only when `use_ip_aliases` is true. For Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*, this field is applicable only when `use_ip_aliases` is true.
+            &quot;useIpAliases&quot;: True or False, # Optional. Whether or not to enable Alias IPs in the GKE cluster. If `true`, a VPC-native cluster is created. This field is only supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. Environments in newer versions always use VPC-native GKE clusters.
           },
-          &quot;location&quot;: &quot;A String&quot;, # Optional. The Compute Engine [zone](/compute/docs/regions-zones) in which to deploy the VMs used to run the Apache Airflow software, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: &quot;projects/{projectId}/zones/{zoneId}&quot;. This `location` must belong to the enclosing environment&#x27;s project and location. If both this field and `nodeConfig.machineType` are specified, `nodeConfig.machineType` must belong to this `location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If only one field (`location` or `nodeConfig.machineType`) is specified, the location information from the specified field will be propagated to the unspecified field.
-          &quot;machineType&quot;: &quot;A String&quot;, # Optional. The Compute Engine [machine type](/compute/docs/machine-types) used for cluster instances, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: &quot;projects/{projectId}/zones/{zoneId}/machineTypes/{machineTypeId}&quot;. The `machineType` must belong to the enclosing environment&#x27;s project and location. If both this field and `nodeConfig.location` are specified, this `machineType` must belong to the `nodeConfig.location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If exactly one of this field and `nodeConfig.location` is specified, the location information from the specified field will be propagated to the unspecified field. The `machineTypeId` must not be a [shared-core machine type](/compute/docs/machine-types#sharedcore). If this field is unspecified, the `machineTypeId` defaults to &quot;n1-standard-1&quot;.
-          &quot;maxPodsPerNode&quot;: 42, # Optional. The maximum number of pods per node in the Cloud Composer GKE cluster. The value must be between 8 and 110 and it can be set only if the environment is VPC-native. The default value is 32. Values of this field will be propagated both to the `default-pool` node pool of the newly created GKE cluster, and to the default &quot;Maximum Pods per Node&quot; value which is used for newly created node pools if their value is not explicitly set during node pool creation. For more information, see [Optimizing IP address allocation] (https://cloud.google.com/kubernetes-engine/docs/how-to/flexible-pod-cidr). Cannot be updated.
+          &quot;location&quot;: &quot;A String&quot;, # Optional. The Compute Engine [zone](/compute/docs/regions-zones) in which to deploy the VMs used to run the Apache Airflow software, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: &quot;projects/{projectId}/zones/{zoneId}&quot;. This `location` must belong to the enclosing environment&#x27;s project and location. If both this field and `nodeConfig.machineType` are specified, `nodeConfig.machineType` must belong to this `location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If only one field (`location` or `nodeConfig.machineType`) is specified, the location information from the specified field will be propagated to the unspecified field. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
+          &quot;machineType&quot;: &quot;A String&quot;, # Optional. The Compute Engine [machine type](/compute/docs/machine-types) used for cluster instances, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: &quot;projects/{projectId}/zones/{zoneId}/machineTypes/{machineTypeId}&quot;. The `machineType` must belong to the enclosing environment&#x27;s project and location. If both this field and `nodeConfig.location` are specified, this `machineType` must belong to the `nodeConfig.location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If exactly one of this field and `nodeConfig.location` is specified, the location information from the specified field will be propagated to the unspecified field. The `machineTypeId` must not be a [shared-core machine type](/compute/docs/machine-types#sharedcore). If this field is unspecified, the `machineTypeId` defaults to &quot;n1-standard-1&quot;. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
+          &quot;maxPodsPerNode&quot;: 42, # Optional. The maximum number of pods per node in the Cloud Composer GKE cluster. The value must be between 8 and 110 and it can be set only if the environment is VPC-native. The default value is 32. Values of this field will be propagated both to the `default-pool` node pool of the newly created GKE cluster, and to the default &quot;Maximum Pods per Node&quot; value which is used for newly created node pools if their value is not explicitly set during node pool creation. For more information, see [Optimizing IP address allocation] (https://cloud.google.com/kubernetes-engine/docs/how-to/flexible-pod-cidr). Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
           &quot;network&quot;: &quot;A String&quot;, # Optional. The Compute Engine network to be used for machine communications, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: &quot;projects/{projectId}/global/networks/{networkId}&quot;. If unspecified, the default network in the environment&#x27;s project is used. If a [Custom Subnet Network](/vpc/docs/vpc#vpc_networks_and_subnets) is provided, `nodeConfig.subnetwork` must also be provided. For [Shared VPC](/vpc/docs/shared-vpc) subnetwork requirements, see `nodeConfig.subnetwork`.
-          &quot;oauthScopes&quot;: [ # Optional. The set of Google API scopes to be made available on all node VMs. If `oauth_scopes` is empty, defaults to [&quot;https://www.googleapis.com/auth/cloud-platform&quot;]. Cannot be updated.
+          &quot;oauthScopes&quot;: [ # Optional. The set of Google API scopes to be made available on all node VMs. If `oauth_scopes` is empty, defaults to [&quot;https://www.googleapis.com/auth/cloud-platform&quot;]. Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
             &quot;A String&quot;,
           ],
           &quot;serviceAccount&quot;: &quot;A String&quot;, # Optional. The Google Cloud Platform Service Account to be used by the workloads. If a service account is not specified, the &quot;default&quot; Compute Engine service account is used. Cannot be updated.
           &quot;subnetwork&quot;: &quot;A String&quot;, # Optional. The Compute Engine subnetwork to be used for machine communications, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: &quot;projects/{projectId}/regions/{regionId}/subnetworks/{subnetworkId}&quot; If a subnetwork is provided, `nodeConfig.network` must also be provided, and the subnetwork must belong to the enclosing environment&#x27;s project and location.
-          &quot;tags&quot;: [ # Optional. The list of instance tags applied to all node VMs. Tags are used to identify valid sources or targets for network firewalls. Each tag within the list must comply with [RFC1035](https://www.ietf.org/rfc/rfc1035.txt). Cannot be updated.
+          &quot;tags&quot;: [ # Optional. The list of instance tags applied to all node VMs. Tags are used to identify valid sources or targets for network firewalls. Each tag within the list must comply with [RFC1035](https://www.ietf.org/rfc/rfc1035.txt). Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
             &quot;A String&quot;,
           ],
         },
-        &quot;nodeCount&quot;: 42, # The number of nodes in the Kubernetes Engine cluster that will be used to run this environment.
+        &quot;nodeCount&quot;: 42, # The number of nodes in the Kubernetes Engine cluster that will be used to run this environment. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
         &quot;privateEnvironmentConfig&quot;: { # The configuration information for configuring a Private IP Cloud Composer environment. # The configuration used for the Private IP Cloud Composer environment.
           &quot;cloudComposerNetworkIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The CIDR block from which IP range for Cloud Composer Network in tenant project will be reserved. Needs to be disjoint from private_cluster_config.master_ipv4_cidr_block and cloud_sql_ipv4_cidr_block. This field is supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer.
           &quot;cloudComposerNetworkIpv4ReservedRange&quot;: &quot;A String&quot;, # Output only. The IP range reserved for the tenant project&#x27;s Cloud Composer network. This field is supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer.
           &quot;cloudSqlIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The CIDR block from which IP range in tenant project will be reserved for Cloud SQL. Needs to be disjoint from web_server_ipv4_cidr_block
-          &quot;enablePrivateEnvironment&quot;: True or False, # Optional. If `true`, a Private IP Cloud Composer environment is created. If this field is set to true, `IPAllocationPolicy.use_ip_aliases` must be set to true .
+          &quot;enablePrivateEnvironment&quot;: True or False, # Optional. If `true`, a Private IP Cloud Composer environment is created. If this field is set to true, `IPAllocationPolicy.use_ip_aliases` must be set to true for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
           &quot;privateClusterConfig&quot;: { # Configuration options for the private GKE cluster in a Cloud Composer environment. # Optional. Configuration for the private GKE cluster for a Private IP Cloud Composer environment.
             &quot;enablePrivateEndpoint&quot;: True or False, # Optional. If `true`, access to the public endpoint of the GKE cluster is denied.
             &quot;masterIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The CIDR block from which IPv4 range for GKE master will be reserved. If left blank, the default value of &#x27;172.16.0.0/23&#x27; is used.
             &quot;masterIpv4ReservedRange&quot;: &quot;A String&quot;, # Output only. The IP range in CIDR notation to use for the hosted master network. This range is used for assigning internal IP addresses to the cluster master or set of masters and to the internal load balancer virtual IP. This range must not overlap with any other ranges in use within the cluster&#x27;s network.
           },
-          &quot;webServerIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The CIDR block from which IP range for web server will be reserved. Needs to be disjoint from private_cluster_config.master_ipv4_cidr_block and cloud_sql_ipv4_cidr_block.
-          &quot;webServerIpv4ReservedRange&quot;: &quot;A String&quot;, # Output only. The IP range reserved for the tenant project&#x27;s App Engine VMs.
+          &quot;webServerIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The CIDR block from which IP range for web server will be reserved. Needs to be disjoint from private_cluster_config.master_ipv4_cidr_block and cloud_sql_ipv4_cidr_block. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
+          &quot;webServerIpv4ReservedRange&quot;: &quot;A String&quot;, # Output only. The IP range reserved for the tenant project&#x27;s App Engine VMs. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
         },
         &quot;softwareConfig&quot;: { # Specifies the selection and configuration of software inside the environment. # The configuration settings for software inside the environment.
           &quot;airflowConfigOverrides&quot;: { # Optional. Apache Airflow configuration properties to override. Property keys contain the section and property names, separated by a hyphen, for example &quot;core-dags_are_paused_at_creation&quot;. Section names must not contain hyphens (&quot;-&quot;), opening square brackets (&quot;[&quot;), or closing square brackets (&quot;]&quot;). The property name must not be empty and must not contain an equals sign (&quot;=&quot;) or semicolon (&quot;;&quot;). Section and property names must not contain a period (&quot;.&quot;). Apache Airflow configuration property names must be written in [snake_case](https://en.wikipedia.org/wiki/Snake_case). Property values can contain any character, and can be written in any lower/upper case format. Certain Apache Airflow configuration property values are [blocked](/composer/docs/concepts/airflow-configurations), and cannot be overridden.
@@ -537,13 +537,13 @@
           &quot;pypiPackages&quot;: { # Optional. Custom Python Package Index (PyPI) packages to be installed in the environment. Keys refer to the lowercase package name such as &quot;numpy&quot; and values are the lowercase extras and version specifier such as &quot;==1.12.0&quot;, &quot;[devel,gcp_api]&quot;, or &quot;[devel]&gt;=1.8.2, &lt;1.9.2&quot;. To specify a package without pinning it to a version specifier, use the empty string as the value.
             &quot;a_key&quot;: &quot;A String&quot;,
           },
-          &quot;pythonVersion&quot;: &quot;A String&quot;, # Optional. The major version of Python used to run the Apache Airflow scheduler, worker, and webserver processes. Can be set to &#x27;2&#x27; or &#x27;3&#x27;. If not specified, the default is &#x27;3&#x27;. Cannot be updated.
-          &quot;schedulerCount&quot;: 42, # Optional. The number of schedulers for Airflow.
+          &quot;pythonVersion&quot;: &quot;A String&quot;, # Optional. The major version of Python used to run the Apache Airflow scheduler, worker, and webserver processes. Can be set to &#x27;2&#x27; or &#x27;3&#x27;. If not specified, the default is &#x27;3&#x27;. Cannot be updated. This field is only supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. Environments in newer versions always use Python major version 3.
+          &quot;schedulerCount&quot;: 42, # Optional. The number of schedulers for Airflow. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-2.*.*.
         },
-        &quot;webServerConfig&quot;: { # The configuration settings for the Airflow web server App Engine instance. # Optional. The configuration settings for the Airflow web server App Engine instance.
+        &quot;webServerConfig&quot;: { # The configuration settings for the Airflow web server App Engine instance. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. # Optional. The configuration settings for the Airflow web server App Engine instance. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
           &quot;machineType&quot;: &quot;A String&quot;, # Optional. Machine type on which Airflow web server is running. It has to be one of: composer-n1-webserver-2, composer-n1-webserver-4 or composer-n1-webserver-8. If not specified, composer-n1-webserver-2 will be used. Value custom is returned only in response, if Airflow web server parameters were manually changed to a non-standard values.
         },
-        &quot;webServerNetworkAccessControl&quot;: { # Network-level access control policy for the Airflow web server. # Optional. The network-level access control policy for the Airflow web server. If unspecified, no network-level access restrictions will be applied.
+        &quot;webServerNetworkAccessControl&quot;: { # Network-level access control policy for the Airflow web server. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. # Optional. The network-level access control policy for the Airflow web server. If unspecified, no network-level access restrictions will be applied. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
           &quot;allowedIpRanges&quot;: [ # A collection of allowed IP ranges with descriptions.
             { # Allowed IP range with user-provided description.
               &quot;description&quot;: &quot;A String&quot;, # Optional. User-provided description. It must contain at most 300 characters.
@@ -613,10 +613,10 @@
   &quot;config&quot;: { # Configuration information for an environment. # Configuration parameters for this environment.
     &quot;airflowUri&quot;: &quot;A String&quot;, # Output only. The URI of the Apache Airflow Web UI hosted within this environment (see [Airflow web interface](/composer/docs/how-to/accessing/airflow-web-interface)).
     &quot;dagGcsPrefix&quot;: &quot;A String&quot;, # Output only. The Cloud Storage prefix of the DAGs for this environment. Although Cloud Storage objects reside in a flat namespace, a hierarchical file tree can be simulated using &quot;/&quot;-delimited object name prefixes. DAG objects for this environment reside in a simulated directory with the given prefix.
-    &quot;databaseConfig&quot;: { # The configuration of Cloud SQL instance that is used by the Apache Airflow software. # Optional. The configuration settings for Cloud SQL instance used internally by Apache Airflow software.
+    &quot;databaseConfig&quot;: { # The configuration of Cloud SQL instance that is used by the Apache Airflow software. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. # Optional. The configuration settings for Cloud SQL instance used internally by Apache Airflow software. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
       &quot;machineType&quot;: &quot;A String&quot;, # Optional. Cloud SQL machine type used by Airflow database. It has to be one of: db-n1-standard-2, db-n1-standard-4, db-n1-standard-8 or db-n1-standard-16. If not specified, db-n1-standard-2 will be used.
     },
-    &quot;encryptionConfig&quot;: { # The encryption options for the Cloud Composer environment and its dependencies. # Optional. The encryption options for the Cloud Composer environment and its dependencies. Cannot be updated.
+    &quot;encryptionConfig&quot;: { # The encryption options for the Cloud Composer environment and its dependencies. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. # Optional. The encryption options for the Cloud Composer environment and its dependencies. Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
       &quot;kmsKeyName&quot;: &quot;A String&quot;, # Optional. Customer-managed Encryption Key available through Google&#x27;s Key Management Service. Cannot be updated. If not specified, Google-managed key will be used.
     },
     &quot;environmentSize&quot;: &quot;A String&quot;, # Optional. The size of the Cloud Composer environment. This field is supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer.
@@ -627,40 +627,40 @@
       &quot;startTime&quot;: &quot;A String&quot;, # Required. Start time of the first recurrence of the maintenance window.
     },
     &quot;nodeConfig&quot;: { # The configuration information for the Kubernetes Engine nodes running the Apache Airflow software. # The configuration used for the Kubernetes Engine cluster.
-      &quot;diskSizeGb&quot;: 42, # Optional. The disk size in GB used for node VMs. Minimum size is 20GB. If unspecified, defaults to 100GB. Cannot be updated.
+      &quot;diskSizeGb&quot;: 42, # Optional. The disk size in GB used for node VMs. Minimum size is 20GB. If unspecified, defaults to 100GB. Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
       &quot;ipAllocationPolicy&quot;: { # Configuration for controlling how IPs are allocated in the GKE cluster. # Optional. The IPAllocationPolicy fields for the GKE cluster.
-        &quot;clusterIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The IP address range used to allocate IP addresses to pods in the cluster. This field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use. Specify `cluster_secondary_range_name` or `cluster_ipv4_cidr_block` but not both.
-        &quot;clusterSecondaryRangeName&quot;: &quot;A String&quot;, # Optional. The name of the cluster&#x27;s secondary range used to allocate IP addresses to pods. Specify either `cluster_secondary_range_name` or `cluster_ipv4_cidr_block` but not both. This field is applicable only when `use_ip_aliases` is true.
-        &quot;servicesIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The IP address range of the services IP addresses in this cluster. This field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use. Specify `services_secondary_range_name` or `services_ipv4_cidr_block` but not both.
-        &quot;servicesSecondaryRangeName&quot;: &quot;A String&quot;, # Optional. The name of the services&#x27; secondary range used to allocate IP addresses to the cluster. Specify either `services_secondary_range_name` or `services_ipv4_cidr_block` but not both. This field is applicable only when `use_ip_aliases` is true.
-        &quot;useIpAliases&quot;: True or False, # Optional. Whether or not to enable Alias IPs in the GKE cluster. If `true`, a VPC-native cluster is created.
+        &quot;clusterIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The IP address range used to allocate IP addresses to pods in the cluster. This field is applicable only when `use_ip_aliases` is true. For Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*, this field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use. Specify `cluster_secondary_range_name` or `cluster_ipv4_cidr_block` but not both.
+        &quot;clusterSecondaryRangeName&quot;: &quot;A String&quot;, # Optional. The name of the cluster&#x27;s secondary range used to allocate IP addresses to pods. Specify either `cluster_secondary_range_name` or `cluster_ipv4_cidr_block` but not both. This field is applicable only when `use_ip_aliases` is true. For Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*, this field is applicable only when `use_ip_aliases` is true.
+        &quot;servicesIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The IP address range of the services IP addresses in this cluster. This field is applicable only when `use_ip_aliases` is true. For Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*, this field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use. Specify `services_secondary_range_name` or `services_ipv4_cidr_block` but not both.
+        &quot;servicesSecondaryRangeName&quot;: &quot;A String&quot;, # Optional. The name of the services&#x27; secondary range used to allocate IP addresses to the cluster. Specify either `services_secondary_range_name` or `services_ipv4_cidr_block` but not both. This field is applicable only when `use_ip_aliases` is true. For Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*, this field is applicable only when `use_ip_aliases` is true.
+        &quot;useIpAliases&quot;: True or False, # Optional. Whether or not to enable Alias IPs in the GKE cluster. If `true`, a VPC-native cluster is created. This field is only supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. Environments in newer versions always use VPC-native GKE clusters.
       },
-      &quot;location&quot;: &quot;A String&quot;, # Optional. The Compute Engine [zone](/compute/docs/regions-zones) in which to deploy the VMs used to run the Apache Airflow software, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: &quot;projects/{projectId}/zones/{zoneId}&quot;. This `location` must belong to the enclosing environment&#x27;s project and location. If both this field and `nodeConfig.machineType` are specified, `nodeConfig.machineType` must belong to this `location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If only one field (`location` or `nodeConfig.machineType`) is specified, the location information from the specified field will be propagated to the unspecified field.
-      &quot;machineType&quot;: &quot;A String&quot;, # Optional. The Compute Engine [machine type](/compute/docs/machine-types) used for cluster instances, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: &quot;projects/{projectId}/zones/{zoneId}/machineTypes/{machineTypeId}&quot;. The `machineType` must belong to the enclosing environment&#x27;s project and location. If both this field and `nodeConfig.location` are specified, this `machineType` must belong to the `nodeConfig.location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If exactly one of this field and `nodeConfig.location` is specified, the location information from the specified field will be propagated to the unspecified field. The `machineTypeId` must not be a [shared-core machine type](/compute/docs/machine-types#sharedcore). If this field is unspecified, the `machineTypeId` defaults to &quot;n1-standard-1&quot;.
-      &quot;maxPodsPerNode&quot;: 42, # Optional. The maximum number of pods per node in the Cloud Composer GKE cluster. The value must be between 8 and 110 and it can be set only if the environment is VPC-native. The default value is 32. Values of this field will be propagated both to the `default-pool` node pool of the newly created GKE cluster, and to the default &quot;Maximum Pods per Node&quot; value which is used for newly created node pools if their value is not explicitly set during node pool creation. For more information, see [Optimizing IP address allocation] (https://cloud.google.com/kubernetes-engine/docs/how-to/flexible-pod-cidr). Cannot be updated.
+      &quot;location&quot;: &quot;A String&quot;, # Optional. The Compute Engine [zone](/compute/docs/regions-zones) in which to deploy the VMs used to run the Apache Airflow software, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: &quot;projects/{projectId}/zones/{zoneId}&quot;. This `location` must belong to the enclosing environment&#x27;s project and location. If both this field and `nodeConfig.machineType` are specified, `nodeConfig.machineType` must belong to this `location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If only one field (`location` or `nodeConfig.machineType`) is specified, the location information from the specified field will be propagated to the unspecified field. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
+      &quot;machineType&quot;: &quot;A String&quot;, # Optional. The Compute Engine [machine type](/compute/docs/machine-types) used for cluster instances, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: &quot;projects/{projectId}/zones/{zoneId}/machineTypes/{machineTypeId}&quot;. The `machineType` must belong to the enclosing environment&#x27;s project and location. If both this field and `nodeConfig.location` are specified, this `machineType` must belong to the `nodeConfig.location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If exactly one of this field and `nodeConfig.location` is specified, the location information from the specified field will be propagated to the unspecified field. The `machineTypeId` must not be a [shared-core machine type](/compute/docs/machine-types#sharedcore). If this field is unspecified, the `machineTypeId` defaults to &quot;n1-standard-1&quot;. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
+      &quot;maxPodsPerNode&quot;: 42, # Optional. The maximum number of pods per node in the Cloud Composer GKE cluster. The value must be between 8 and 110 and it can be set only if the environment is VPC-native. The default value is 32. Values of this field will be propagated both to the `default-pool` node pool of the newly created GKE cluster, and to the default &quot;Maximum Pods per Node&quot; value which is used for newly created node pools if their value is not explicitly set during node pool creation. For more information, see [Optimizing IP address allocation] (https://cloud.google.com/kubernetes-engine/docs/how-to/flexible-pod-cidr). Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
       &quot;network&quot;: &quot;A String&quot;, # Optional. The Compute Engine network to be used for machine communications, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: &quot;projects/{projectId}/global/networks/{networkId}&quot;. If unspecified, the default network in the environment&#x27;s project is used. If a [Custom Subnet Network](/vpc/docs/vpc#vpc_networks_and_subnets) is provided, `nodeConfig.subnetwork` must also be provided. For [Shared VPC](/vpc/docs/shared-vpc) subnetwork requirements, see `nodeConfig.subnetwork`.
-      &quot;oauthScopes&quot;: [ # Optional. The set of Google API scopes to be made available on all node VMs. If `oauth_scopes` is empty, defaults to [&quot;https://www.googleapis.com/auth/cloud-platform&quot;]. Cannot be updated.
+      &quot;oauthScopes&quot;: [ # Optional. The set of Google API scopes to be made available on all node VMs. If `oauth_scopes` is empty, defaults to [&quot;https://www.googleapis.com/auth/cloud-platform&quot;]. Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
         &quot;A String&quot;,
       ],
       &quot;serviceAccount&quot;: &quot;A String&quot;, # Optional. The Google Cloud Platform Service Account to be used by the workloads. If a service account is not specified, the &quot;default&quot; Compute Engine service account is used. Cannot be updated.
       &quot;subnetwork&quot;: &quot;A String&quot;, # Optional. The Compute Engine subnetwork to be used for machine communications, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: &quot;projects/{projectId}/regions/{regionId}/subnetworks/{subnetworkId}&quot; If a subnetwork is provided, `nodeConfig.network` must also be provided, and the subnetwork must belong to the enclosing environment&#x27;s project and location.
-      &quot;tags&quot;: [ # Optional. The list of instance tags applied to all node VMs. Tags are used to identify valid sources or targets for network firewalls. Each tag within the list must comply with [RFC1035](https://www.ietf.org/rfc/rfc1035.txt). Cannot be updated.
+      &quot;tags&quot;: [ # Optional. The list of instance tags applied to all node VMs. Tags are used to identify valid sources or targets for network firewalls. Each tag within the list must comply with [RFC1035](https://www.ietf.org/rfc/rfc1035.txt). Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
         &quot;A String&quot;,
       ],
     },
-    &quot;nodeCount&quot;: 42, # The number of nodes in the Kubernetes Engine cluster that will be used to run this environment.
+    &quot;nodeCount&quot;: 42, # The number of nodes in the Kubernetes Engine cluster that will be used to run this environment. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
     &quot;privateEnvironmentConfig&quot;: { # The configuration information for configuring a Private IP Cloud Composer environment. # The configuration used for the Private IP Cloud Composer environment.
       &quot;cloudComposerNetworkIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The CIDR block from which IP range for Cloud Composer Network in tenant project will be reserved. Needs to be disjoint from private_cluster_config.master_ipv4_cidr_block and cloud_sql_ipv4_cidr_block. This field is supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer.
       &quot;cloudComposerNetworkIpv4ReservedRange&quot;: &quot;A String&quot;, # Output only. The IP range reserved for the tenant project&#x27;s Cloud Composer network. This field is supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer.
       &quot;cloudSqlIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The CIDR block from which IP range in tenant project will be reserved for Cloud SQL. Needs to be disjoint from web_server_ipv4_cidr_block
-      &quot;enablePrivateEnvironment&quot;: True or False, # Optional. If `true`, a Private IP Cloud Composer environment is created. If this field is set to true, `IPAllocationPolicy.use_ip_aliases` must be set to true .
+      &quot;enablePrivateEnvironment&quot;: True or False, # Optional. If `true`, a Private IP Cloud Composer environment is created. If this field is set to true, `IPAllocationPolicy.use_ip_aliases` must be set to true for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
       &quot;privateClusterConfig&quot;: { # Configuration options for the private GKE cluster in a Cloud Composer environment. # Optional. Configuration for the private GKE cluster for a Private IP Cloud Composer environment.
         &quot;enablePrivateEndpoint&quot;: True or False, # Optional. If `true`, access to the public endpoint of the GKE cluster is denied.
         &quot;masterIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The CIDR block from which IPv4 range for GKE master will be reserved. If left blank, the default value of &#x27;172.16.0.0/23&#x27; is used.
         &quot;masterIpv4ReservedRange&quot;: &quot;A String&quot;, # Output only. The IP range in CIDR notation to use for the hosted master network. This range is used for assigning internal IP addresses to the cluster master or set of masters and to the internal load balancer virtual IP. This range must not overlap with any other ranges in use within the cluster&#x27;s network.
       },
-      &quot;webServerIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The CIDR block from which IP range for web server will be reserved. Needs to be disjoint from private_cluster_config.master_ipv4_cidr_block and cloud_sql_ipv4_cidr_block.
-      &quot;webServerIpv4ReservedRange&quot;: &quot;A String&quot;, # Output only. The IP range reserved for the tenant project&#x27;s App Engine VMs.
+      &quot;webServerIpv4CidrBlock&quot;: &quot;A String&quot;, # Optional. The CIDR block from which IP range for web server will be reserved. Needs to be disjoint from private_cluster_config.master_ipv4_cidr_block and cloud_sql_ipv4_cidr_block. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
+      &quot;webServerIpv4ReservedRange&quot;: &quot;A String&quot;, # Output only. The IP range reserved for the tenant project&#x27;s App Engine VMs. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
     },
     &quot;softwareConfig&quot;: { # Specifies the selection and configuration of software inside the environment. # The configuration settings for software inside the environment.
       &quot;airflowConfigOverrides&quot;: { # Optional. Apache Airflow configuration properties to override. Property keys contain the section and property names, separated by a hyphen, for example &quot;core-dags_are_paused_at_creation&quot;. Section names must not contain hyphens (&quot;-&quot;), opening square brackets (&quot;[&quot;), or closing square brackets (&quot;]&quot;). The property name must not be empty and must not contain an equals sign (&quot;=&quot;) or semicolon (&quot;;&quot;). Section and property names must not contain a period (&quot;.&quot;). Apache Airflow configuration property names must be written in [snake_case](https://en.wikipedia.org/wiki/Snake_case). Property values can contain any character, and can be written in any lower/upper case format. Certain Apache Airflow configuration property values are [blocked](/composer/docs/concepts/airflow-configurations), and cannot be overridden.
@@ -673,13 +673,13 @@
       &quot;pypiPackages&quot;: { # Optional. Custom Python Package Index (PyPI) packages to be installed in the environment. Keys refer to the lowercase package name such as &quot;numpy&quot; and values are the lowercase extras and version specifier such as &quot;==1.12.0&quot;, &quot;[devel,gcp_api]&quot;, or &quot;[devel]&gt;=1.8.2, &lt;1.9.2&quot;. To specify a package without pinning it to a version specifier, use the empty string as the value.
         &quot;a_key&quot;: &quot;A String&quot;,
       },
-      &quot;pythonVersion&quot;: &quot;A String&quot;, # Optional. The major version of Python used to run the Apache Airflow scheduler, worker, and webserver processes. Can be set to &#x27;2&#x27; or &#x27;3&#x27;. If not specified, the default is &#x27;3&#x27;. Cannot be updated.
-      &quot;schedulerCount&quot;: 42, # Optional. The number of schedulers for Airflow.
+      &quot;pythonVersion&quot;: &quot;A String&quot;, # Optional. The major version of Python used to run the Apache Airflow scheduler, worker, and webserver processes. Can be set to &#x27;2&#x27; or &#x27;3&#x27;. If not specified, the default is &#x27;3&#x27;. Cannot be updated. This field is only supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. Environments in newer versions always use Python major version 3.
+      &quot;schedulerCount&quot;: 42, # Optional. The number of schedulers for Airflow. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-2.*.*.
     },
-    &quot;webServerConfig&quot;: { # The configuration settings for the Airflow web server App Engine instance. # Optional. The configuration settings for the Airflow web server App Engine instance.
+    &quot;webServerConfig&quot;: { # The configuration settings for the Airflow web server App Engine instance. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. # Optional. The configuration settings for the Airflow web server App Engine instance. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
       &quot;machineType&quot;: &quot;A String&quot;, # Optional. Machine type on which Airflow web server is running. It has to be one of: composer-n1-webserver-2, composer-n1-webserver-4 or composer-n1-webserver-8. If not specified, composer-n1-webserver-2 will be used. Value custom is returned only in response, if Airflow web server parameters were manually changed to a non-standard values.
     },
-    &quot;webServerNetworkAccessControl&quot;: { # Network-level access control policy for the Airflow web server. # Optional. The network-level access control policy for the Airflow web server. If unspecified, no network-level access restrictions will be applied.
+    &quot;webServerNetworkAccessControl&quot;: { # Network-level access control policy for the Airflow web server. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. # Optional. The network-level access control policy for the Airflow web server. If unspecified, no network-level access restrictions will be applied. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.
       &quot;allowedIpRanges&quot;: [ # A collection of allowed IP ranges with descriptions.
         { # Allowed IP range with user-provided description.
           &quot;description&quot;: &quot;A String&quot;, # Optional. User-provided description. It must contain at most 300 characters.
@@ -718,7 +718,7 @@
   &quot;uuid&quot;: &quot;A String&quot;, # Output only. The UUID (Universally Unique IDentifier) associated with this environment. This value is generated when the environment is created.
 }
 
-  updateMask: string, Required. A comma-separated list of paths, relative to `Environment`, of fields to update. For example, to set the version of scikit-learn to install in the environment to 0.19.0 and to remove an existing installation of argparse, the `updateMask` parameter would include the following two `paths` values: &quot;config.softwareConfig.pypiPackages.scikit-learn&quot; and &quot;config.softwareConfig.pypiPackages.argparse&quot;. The included patch environment would specify the scikit-learn version as follows: { &quot;config&quot;:{ &quot;softwareConfig&quot;:{ &quot;pypiPackages&quot;:{ &quot;scikit-learn&quot;:&quot;==0.19.0&quot; } } } } Note that in the above example, any existing PyPI packages other than scikit-learn and argparse will be unaffected. Only one update type may be included in a single request&#x27;s `updateMask`. For example, one cannot update both the PyPI packages and labels in the same request. However, it is possible to update multiple members of a map field simultaneously in the same request. For example, to set the labels &quot;label1&quot; and &quot;label2&quot; while clearing &quot;label3&quot; (assuming it already exists), one can provide the paths &quot;labels.label1&quot;, &quot;labels.label2&quot;, and &quot;labels.label3&quot; and populate the patch environment as follows: { &quot;labels&quot;:{ &quot;label1&quot;:&quot;new-label1-value&quot; &quot;label2&quot;:&quot;new-label2-value&quot; } } Note that in the above example, any existing labels that are not included in the `updateMask` will be unaffected. It is also possible to replace an entire map field by providing the map field&#x27;s path in the `updateMask`. The new value of the field will be that which is provided in the patch environment. For example, to delete all pre-existing user-specified PyPI packages and install botocore at version 1.7.14, the `updateMask` would contain the path &quot;config.softwareConfig.pypiPackages&quot;, and the patch environment would be the following: { &quot;config&quot;:{ &quot;softwareConfig&quot;:{ &quot;pypiPackages&quot;:{ &quot;botocore&quot;:&quot;==1.7.14&quot; } } } } **Note:** Only the following fields can be updated: * `config.softwareConfig.pypiPackages` * Replace all custom custom PyPI packages. If a replacement package map is not included in `environment`, all custom PyPI packages are cleared. It is an error to provide both this mask and a mask specifying an individual package. * `config.softwareConfig.pypiPackages.`packagename * Update the custom PyPI package *packagename*, preserving other packages. To delete the package, include it in `updateMask`, and omit the mapping for it in `environment.config.softwareConfig.pypiPackages`. It is an error to provide both a mask of this form and the `config.softwareConfig.pypiPackages` mask. * `labels` * Replace all environment labels. If a replacement labels map is not included in `environment`, all labels are cleared. It is an error to provide both this mask and a mask specifying one or more individual labels. * `labels.`labelName * Set the label named *labelName*, while preserving other labels. To delete the label, include it in `updateMask` and omit its mapping in `environment.labels`. It is an error to provide both a mask of this form and the `labels` mask. * `config.nodeCount` * Horizontally scale the number of nodes in the environment. An integer greater than or equal to 3 must be provided in the `config.nodeCount` field. * `config.webServerNetworkAccessControl` * Replace the environment&#x27;s current WebServerNetworkAccessControl. * `config.softwareConfig.airflowConfigOverrides` * Replace all Apache Airflow config overrides. If a replacement config overrides map is not included in `environment`, all config overrides are cleared. It is an error to provide both this mask and a mask specifying one or more individual config overrides. * `config.softwareConfig.airflowConfigOverrides.`section-name * Override the Apache Airflow config property *name* in the section named *section*, preserving other properties. To delete the property override, include it in `updateMask` and omit its mapping in `environment.config.softwareConfig.airflowConfigOverrides`. It is an error to provide both a mask of this form and the `config.softwareConfig.airflowConfigOverrides` mask. * `config.softwareConfig.envVariables` * Replace all environment variables. If a replacement environment variable map is not included in `environment`, all custom environment variables are cleared. It is an error to provide both this mask and a mask specifying one or more individual environment variables. * `config.softwareConfig.imageVersion` * Upgrade the version of the environment in-place. Refer to `SoftwareConfig.image_version` for information on how to format the new image version. Additionally, the new image version cannot effect a version downgrade and must match the current image version&#x27;s Composer major version and Airflow major and minor versions. Consult the [Cloud Composer Version List](https://cloud.google.com/composer/docs/concepts/versioning/composer-versions) for valid values. * `config.softwareConfig.schedulerCount` * Horizontally scale the number of schedulers in Airflow. A positive integer not greater than the number of nodes must be provided in the `config.softwareConfig.schedulerCount` field. * `config.databaseConfig.machineType` * Cloud SQL machine type used by Airflow database. It has to be one of: db-n1-standard-2, db-n1-standard-4, db-n1-standard-8 or db-n1-standard-16. * `config.webServerConfig.machineType` * Machine type on which Airflow web server is running. It has to be one of: composer-n1-webserver-2, composer-n1-webserver-4 or composer-n1-webserver-8. * `config.maintenanceWindow` * Maintenance window during which Cloud Composer components may be under maintenance.
+  updateMask: string, Required. A comma-separated list of paths, relative to `Environment`, of fields to update. For example, to set the version of scikit-learn to install in the environment to 0.19.0 and to remove an existing installation of argparse, the `updateMask` parameter would include the following two `paths` values: &quot;config.softwareConfig.pypiPackages.scikit-learn&quot; and &quot;config.softwareConfig.pypiPackages.argparse&quot;. The included patch environment would specify the scikit-learn version as follows: { &quot;config&quot;:{ &quot;softwareConfig&quot;:{ &quot;pypiPackages&quot;:{ &quot;scikit-learn&quot;:&quot;==0.19.0&quot; } } } } Note that in the above example, any existing PyPI packages other than scikit-learn and argparse will be unaffected. Only one update type may be included in a single request&#x27;s `updateMask`. For example, one cannot update both the PyPI packages and labels in the same request. However, it is possible to update multiple members of a map field simultaneously in the same request. For example, to set the labels &quot;label1&quot; and &quot;label2&quot; while clearing &quot;label3&quot; (assuming it already exists), one can provide the paths &quot;labels.label1&quot;, &quot;labels.label2&quot;, and &quot;labels.label3&quot; and populate the patch environment as follows: { &quot;labels&quot;:{ &quot;label1&quot;:&quot;new-label1-value&quot; &quot;label2&quot;:&quot;new-label2-value&quot; } } Note that in the above example, any existing labels that are not included in the `updateMask` will be unaffected. It is also possible to replace an entire map field by providing the map field&#x27;s path in the `updateMask`. The new value of the field will be that which is provided in the patch environment. For example, to delete all pre-existing user-specified PyPI packages and install botocore at version 1.7.14, the `updateMask` would contain the path &quot;config.softwareConfig.pypiPackages&quot;, and the patch environment would be the following: { &quot;config&quot;:{ &quot;softwareConfig&quot;:{ &quot;pypiPackages&quot;:{ &quot;botocore&quot;:&quot;==1.7.14&quot; } } } } **Note:** Only the following fields can be updated: * `config.softwareConfig.pypiPackages` * Replace all custom custom PyPI packages. If a replacement package map is not included in `environment`, all custom PyPI packages are cleared. It is an error to provide both this mask and a mask specifying an individual package. * `config.softwareConfig.pypiPackages.`packagename * Update the custom PyPI package *packagename*, preserving other packages. To delete the package, include it in `updateMask`, and omit the mapping for it in `environment.config.softwareConfig.pypiPackages`. It is an error to provide both a mask of this form and the `config.softwareConfig.pypiPackages` mask. * `labels` * Replace all environment labels. If a replacement labels map is not included in `environment`, all labels are cleared. It is an error to provide both this mask and a mask specifying one or more individual labels. * `labels.`labelName * Set the label named *labelName*, while preserving other labels. To delete the label, include it in `updateMask` and omit its mapping in `environment.labels`. It is an error to provide both a mask of this form and the `labels` mask. * `config.nodeCount` * Horizontally scale the number of nodes in the environment. An integer greater than or equal to 3 must be provided in the `config.nodeCount` field. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. * `config.webServerNetworkAccessControl` * Replace the environment&#x27;s current WebServerNetworkAccessControl. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. * `config.softwareConfig.airflowConfigOverrides` * Replace all Apache Airflow config overrides. If a replacement config overrides map is not included in `environment`, all config overrides are cleared. It is an error to provide both this mask and a mask specifying one or more individual config overrides. * `config.softwareConfig.airflowConfigOverrides.`section-name * Override the Apache Airflow config property *name* in the section named *section*, preserving other properties. To delete the property override, include it in `updateMask` and omit its mapping in `environment.config.softwareConfig.airflowConfigOverrides`. It is an error to provide both a mask of this form and the `config.softwareConfig.airflowConfigOverrides` mask. * `config.softwareConfig.envVariables` * Replace all environment variables. If a replacement environment variable map is not included in `environment`, all custom environment variables are cleared. It is an error to provide both this mask and a mask specifying one or more individual environment variables. * `config.softwareConfig.imageVersion` * Upgrade the version of the environment in-place. Refer to `SoftwareConfig.image_version` for information on how to format the new image version. Additionally, the new image version cannot effect a version downgrade and must match the current image version&#x27;s Composer major version and Airflow major and minor versions. Consult the [Cloud Composer Version List](https://cloud.google.com/composer/docs/concepts/versioning/composer-versions) for valid values. * `config.softwareConfig.schedulerCount` * Horizontally scale the number of schedulers in Airflow. A positive integer not greater than the number of nodes must be provided in the `config.softwareConfig.schedulerCount` field. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-2.*.*. * `config.databaseConfig.machineType` * Cloud SQL machine type used by Airflow database. It has to be one of: db-n1-standard-2, db-n1-standard-4, db-n1-standard-8 or db-n1-standard-16. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. * `config.webServerConfig.machineType` * Machine type on which Airflow web server is running. It has to be one of: composer-n1-webserver-2, composer-n1-webserver-4 or composer-n1-webserver-8. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. * `config.maintenanceWindow` * Maintenance window during which Cloud Composer components may be under maintenance. * `config.workloadsConfig` * The workloads configuration settings for the GKE cluster associated with the Cloud Composer environment. Supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer. * `config.environmentSize` * The size of the Cloud Composer environment. Supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer.
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
diff --git a/docs/dyn/containeranalysis_v1alpha1.projects.notes.html b/docs/dyn/containeranalysis_v1alpha1.projects.notes.html
index 01dfe5c..2ff086d 100644
--- a/docs/dyn/containeranalysis_v1alpha1.projects.notes.html
+++ b/docs/dyn/containeranalysis_v1alpha1.projects.notes.html
@@ -204,7 +204,47 @@
       &quot;url&quot;: &quot;A String&quot;, # Specific URL to associate with the note
     },
   ],
+  &quot;sbom&quot;: { # DocumentNote represents an SPDX Document Creation Infromation section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # A note describing a software bill of materials.
+    &quot;dataLicence&quot;: &quot;A String&quot;, # Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (&quot;SPDX-Metadata&quot;)
+    &quot;spdxVersion&quot;: &quot;A String&quot;, # Provide a reference number that can be used to understand how to parse and interpret the rest of the file
+  },
   &quot;shortDescription&quot;: &quot;A String&quot;, # A one sentence description of this `Note`.
+  &quot;spdxFile&quot;: { # FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # A note describing an SPDX File.
+    &quot;checksum&quot;: [ # Provide a unique identifier to match analysis information on each specific file in a package
+      &quot;A String&quot;,
+    ],
+    &quot;fileType&quot;: &quot;A String&quot;, # This field provides information about the type of file identified
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full path and filename that corresponds to the file information in this section
+  },
+  &quot;spdxPackage&quot;: { # PackageNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # A note describing an SPDX Package.
+    &quot;analyzed&quot;: True or False, # Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document
+    &quot;attribution&quot;: &quot;A String&quot;, # A place for the SPDX data creator to record, at the package level, acknowledgements that may be needed to be communicated in some contexts
+    &quot;checksum&quot;: &quot;A String&quot;, # Provide an independently reproducible mechanism that permits unique identification of a specific package that correlates to the data in this SPDX file
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holders of the package, as well as any dates present
+    &quot;detailedDescription&quot;: &quot;A String&quot;, # A more detailed description of the package
+    &quot;downloadLocation&quot;: &quot;A String&quot;, # This section identifies the download Universal Resource Locator (URL), or a specific location within a version control system (VCS) for the package at the time that the SPDX file was created
+    &quot;externalRefs&quot;: [ # ExternalRef
+      { # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;category&quot;: &quot;A String&quot;, # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;comment&quot;: &quot;A String&quot;, # Human-readable information about the purpose and target of the reference
+        &quot;locator&quot;: &quot;A String&quot;, # The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location
+        &quot;type&quot;: &quot;A String&quot;, # Type of category (e.g. &#x27;npm&#x27; for the PACKAGE_MANAGER category)
+      },
+    ],
+    &quot;filesLicenseInfo&quot;: [ # Contain the license the SPDX file creator has concluded as governing the This field is to contain a list of all licenses found in the package. The relationship between licenses (i.e., conjunctive, disjunctive) is not specified in this field – it is simply a listing of all licenses found
+      &quot;A String&quot;,
+    ],
+    &quot;homePage&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record a web site that serves as the package&#x27;s home page
+    &quot;licenseDeclared&quot;: &quot;A String&quot;, # List the licenses that have been declared by the authors of the package
+    &quot;originator&quot;: &quot;A String&quot;, # If the package identified in the SPDX file originated from a different person or organization than identified as Package Supplier, this field identifies from where or whom the package originally came
+    &quot;summaryDescription&quot;: &quot;A String&quot;, # A short description of the package
+    &quot;supplier&quot;: &quot;A String&quot;, # Identify the actual distribution source for the package/directory identified in the SPDX file
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full name of the package as given by the Package Originator
+    &quot;verificationCode&quot;: &quot;A String&quot;, # This field provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX file itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX file
+    &quot;version&quot;: &quot;A String&quot;, # Identify the version of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # A note describing a relationship between SPDX elements.
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this note was last updated. This field can be used as a filter in list requests.
   &quot;upgrade&quot;: { # An Upgrade Note represents a potential upgrade of a package to a given version. For each package version combination (i.e. bash 4.0, bash 4.1, bash 4.1.2), there will be a Upgrade Note. # A note describing an upgrade.
     &quot;distributions&quot;: [ # Metadata about the upgrade for each specific operating system.
@@ -359,7 +399,47 @@
       &quot;url&quot;: &quot;A String&quot;, # Specific URL to associate with the note
     },
   ],
+  &quot;sbom&quot;: { # DocumentNote represents an SPDX Document Creation Infromation section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # A note describing a software bill of materials.
+    &quot;dataLicence&quot;: &quot;A String&quot;, # Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (&quot;SPDX-Metadata&quot;)
+    &quot;spdxVersion&quot;: &quot;A String&quot;, # Provide a reference number that can be used to understand how to parse and interpret the rest of the file
+  },
   &quot;shortDescription&quot;: &quot;A String&quot;, # A one sentence description of this `Note`.
+  &quot;spdxFile&quot;: { # FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # A note describing an SPDX File.
+    &quot;checksum&quot;: [ # Provide a unique identifier to match analysis information on each specific file in a package
+      &quot;A String&quot;,
+    ],
+    &quot;fileType&quot;: &quot;A String&quot;, # This field provides information about the type of file identified
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full path and filename that corresponds to the file information in this section
+  },
+  &quot;spdxPackage&quot;: { # PackageNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # A note describing an SPDX Package.
+    &quot;analyzed&quot;: True or False, # Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document
+    &quot;attribution&quot;: &quot;A String&quot;, # A place for the SPDX data creator to record, at the package level, acknowledgements that may be needed to be communicated in some contexts
+    &quot;checksum&quot;: &quot;A String&quot;, # Provide an independently reproducible mechanism that permits unique identification of a specific package that correlates to the data in this SPDX file
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holders of the package, as well as any dates present
+    &quot;detailedDescription&quot;: &quot;A String&quot;, # A more detailed description of the package
+    &quot;downloadLocation&quot;: &quot;A String&quot;, # This section identifies the download Universal Resource Locator (URL), or a specific location within a version control system (VCS) for the package at the time that the SPDX file was created
+    &quot;externalRefs&quot;: [ # ExternalRef
+      { # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;category&quot;: &quot;A String&quot;, # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;comment&quot;: &quot;A String&quot;, # Human-readable information about the purpose and target of the reference
+        &quot;locator&quot;: &quot;A String&quot;, # The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location
+        &quot;type&quot;: &quot;A String&quot;, # Type of category (e.g. &#x27;npm&#x27; for the PACKAGE_MANAGER category)
+      },
+    ],
+    &quot;filesLicenseInfo&quot;: [ # Contain the license the SPDX file creator has concluded as governing the This field is to contain a list of all licenses found in the package. The relationship between licenses (i.e., conjunctive, disjunctive) is not specified in this field – it is simply a listing of all licenses found
+      &quot;A String&quot;,
+    ],
+    &quot;homePage&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record a web site that serves as the package&#x27;s home page
+    &quot;licenseDeclared&quot;: &quot;A String&quot;, # List the licenses that have been declared by the authors of the package
+    &quot;originator&quot;: &quot;A String&quot;, # If the package identified in the SPDX file originated from a different person or organization than identified as Package Supplier, this field identifies from where or whom the package originally came
+    &quot;summaryDescription&quot;: &quot;A String&quot;, # A short description of the package
+    &quot;supplier&quot;: &quot;A String&quot;, # Identify the actual distribution source for the package/directory identified in the SPDX file
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full name of the package as given by the Package Originator
+    &quot;verificationCode&quot;: &quot;A String&quot;, # This field provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX file itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX file
+    &quot;version&quot;: &quot;A String&quot;, # Identify the version of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # A note describing a relationship between SPDX elements.
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this note was last updated. This field can be used as a filter in list requests.
   &quot;upgrade&quot;: { # An Upgrade Note represents a potential upgrade of a package to a given version. For each package version combination (i.e. bash 4.0, bash 4.1, bash 4.1.2), there will be a Upgrade Note. # A note describing an upgrade.
     &quot;distributions&quot;: [ # Metadata about the upgrade for each specific operating system.
@@ -537,7 +617,47 @@
       &quot;url&quot;: &quot;A String&quot;, # Specific URL to associate with the note
     },
   ],
+  &quot;sbom&quot;: { # DocumentNote represents an SPDX Document Creation Infromation section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # A note describing a software bill of materials.
+    &quot;dataLicence&quot;: &quot;A String&quot;, # Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (&quot;SPDX-Metadata&quot;)
+    &quot;spdxVersion&quot;: &quot;A String&quot;, # Provide a reference number that can be used to understand how to parse and interpret the rest of the file
+  },
   &quot;shortDescription&quot;: &quot;A String&quot;, # A one sentence description of this `Note`.
+  &quot;spdxFile&quot;: { # FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # A note describing an SPDX File.
+    &quot;checksum&quot;: [ # Provide a unique identifier to match analysis information on each specific file in a package
+      &quot;A String&quot;,
+    ],
+    &quot;fileType&quot;: &quot;A String&quot;, # This field provides information about the type of file identified
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full path and filename that corresponds to the file information in this section
+  },
+  &quot;spdxPackage&quot;: { # PackageNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # A note describing an SPDX Package.
+    &quot;analyzed&quot;: True or False, # Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document
+    &quot;attribution&quot;: &quot;A String&quot;, # A place for the SPDX data creator to record, at the package level, acknowledgements that may be needed to be communicated in some contexts
+    &quot;checksum&quot;: &quot;A String&quot;, # Provide an independently reproducible mechanism that permits unique identification of a specific package that correlates to the data in this SPDX file
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holders of the package, as well as any dates present
+    &quot;detailedDescription&quot;: &quot;A String&quot;, # A more detailed description of the package
+    &quot;downloadLocation&quot;: &quot;A String&quot;, # This section identifies the download Universal Resource Locator (URL), or a specific location within a version control system (VCS) for the package at the time that the SPDX file was created
+    &quot;externalRefs&quot;: [ # ExternalRef
+      { # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;category&quot;: &quot;A String&quot;, # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;comment&quot;: &quot;A String&quot;, # Human-readable information about the purpose and target of the reference
+        &quot;locator&quot;: &quot;A String&quot;, # The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location
+        &quot;type&quot;: &quot;A String&quot;, # Type of category (e.g. &#x27;npm&#x27; for the PACKAGE_MANAGER category)
+      },
+    ],
+    &quot;filesLicenseInfo&quot;: [ # Contain the license the SPDX file creator has concluded as governing the This field is to contain a list of all licenses found in the package. The relationship between licenses (i.e., conjunctive, disjunctive) is not specified in this field – it is simply a listing of all licenses found
+      &quot;A String&quot;,
+    ],
+    &quot;homePage&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record a web site that serves as the package&#x27;s home page
+    &quot;licenseDeclared&quot;: &quot;A String&quot;, # List the licenses that have been declared by the authors of the package
+    &quot;originator&quot;: &quot;A String&quot;, # If the package identified in the SPDX file originated from a different person or organization than identified as Package Supplier, this field identifies from where or whom the package originally came
+    &quot;summaryDescription&quot;: &quot;A String&quot;, # A short description of the package
+    &quot;supplier&quot;: &quot;A String&quot;, # Identify the actual distribution source for the package/directory identified in the SPDX file
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full name of the package as given by the Package Originator
+    &quot;verificationCode&quot;: &quot;A String&quot;, # This field provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX file itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX file
+    &quot;version&quot;: &quot;A String&quot;, # Identify the version of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # A note describing a relationship between SPDX elements.
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this note was last updated. This field can be used as a filter in list requests.
   &quot;upgrade&quot;: { # An Upgrade Note represents a potential upgrade of a package to a given version. For each package version combination (i.e. bash 4.0, bash 4.1, bash 4.1.2), there will be a Upgrade Note. # A note describing an upgrade.
     &quot;distributions&quot;: [ # Metadata about the upgrade for each specific operating system.
@@ -747,7 +867,47 @@
           &quot;url&quot;: &quot;A String&quot;, # Specific URL to associate with the note
         },
       ],
+      &quot;sbom&quot;: { # DocumentNote represents an SPDX Document Creation Infromation section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # A note describing a software bill of materials.
+        &quot;dataLicence&quot;: &quot;A String&quot;, # Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (&quot;SPDX-Metadata&quot;)
+        &quot;spdxVersion&quot;: &quot;A String&quot;, # Provide a reference number that can be used to understand how to parse and interpret the rest of the file
+      },
       &quot;shortDescription&quot;: &quot;A String&quot;, # A one sentence description of this `Note`.
+      &quot;spdxFile&quot;: { # FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # A note describing an SPDX File.
+        &quot;checksum&quot;: [ # Provide a unique identifier to match analysis information on each specific file in a package
+          &quot;A String&quot;,
+        ],
+        &quot;fileType&quot;: &quot;A String&quot;, # This field provides information about the type of file identified
+        &quot;title&quot;: &quot;A String&quot;, # Identify the full path and filename that corresponds to the file information in this section
+      },
+      &quot;spdxPackage&quot;: { # PackageNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # A note describing an SPDX Package.
+        &quot;analyzed&quot;: True or False, # Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document
+        &quot;attribution&quot;: &quot;A String&quot;, # A place for the SPDX data creator to record, at the package level, acknowledgements that may be needed to be communicated in some contexts
+        &quot;checksum&quot;: &quot;A String&quot;, # Provide an independently reproducible mechanism that permits unique identification of a specific package that correlates to the data in this SPDX file
+        &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holders of the package, as well as any dates present
+        &quot;detailedDescription&quot;: &quot;A String&quot;, # A more detailed description of the package
+        &quot;downloadLocation&quot;: &quot;A String&quot;, # This section identifies the download Universal Resource Locator (URL), or a specific location within a version control system (VCS) for the package at the time that the SPDX file was created
+        &quot;externalRefs&quot;: [ # ExternalRef
+          { # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+            &quot;category&quot;: &quot;A String&quot;, # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+            &quot;comment&quot;: &quot;A String&quot;, # Human-readable information about the purpose and target of the reference
+            &quot;locator&quot;: &quot;A String&quot;, # The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location
+            &quot;type&quot;: &quot;A String&quot;, # Type of category (e.g. &#x27;npm&#x27; for the PACKAGE_MANAGER category)
+          },
+        ],
+        &quot;filesLicenseInfo&quot;: [ # Contain the license the SPDX file creator has concluded as governing the This field is to contain a list of all licenses found in the package. The relationship between licenses (i.e., conjunctive, disjunctive) is not specified in this field – it is simply a listing of all licenses found
+          &quot;A String&quot;,
+        ],
+        &quot;homePage&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record a web site that serves as the package&#x27;s home page
+        &quot;licenseDeclared&quot;: &quot;A String&quot;, # List the licenses that have been declared by the authors of the package
+        &quot;originator&quot;: &quot;A String&quot;, # If the package identified in the SPDX file originated from a different person or organization than identified as Package Supplier, this field identifies from where or whom the package originally came
+        &quot;summaryDescription&quot;: &quot;A String&quot;, # A short description of the package
+        &quot;supplier&quot;: &quot;A String&quot;, # Identify the actual distribution source for the package/directory identified in the SPDX file
+        &quot;title&quot;: &quot;A String&quot;, # Identify the full name of the package as given by the Package Originator
+        &quot;verificationCode&quot;: &quot;A String&quot;, # This field provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX file itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX file
+        &quot;version&quot;: &quot;A String&quot;, # Identify the version of the package
+      },
+      &quot;spdxRelationship&quot;: { # RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # A note describing a relationship between SPDX elements.
+      },
       &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this note was last updated. This field can be used as a filter in list requests.
       &quot;upgrade&quot;: { # An Upgrade Note represents a potential upgrade of a package to a given version. For each package version combination (i.e. bash 4.0, bash 4.1, bash 4.1.2), there will be a Upgrade Note. # A note describing an upgrade.
         &quot;distributions&quot;: [ # Metadata about the upgrade for each specific operating system.
@@ -918,7 +1078,47 @@
       &quot;url&quot;: &quot;A String&quot;, # Specific URL to associate with the note
     },
   ],
+  &quot;sbom&quot;: { # DocumentNote represents an SPDX Document Creation Infromation section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # A note describing a software bill of materials.
+    &quot;dataLicence&quot;: &quot;A String&quot;, # Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (&quot;SPDX-Metadata&quot;)
+    &quot;spdxVersion&quot;: &quot;A String&quot;, # Provide a reference number that can be used to understand how to parse and interpret the rest of the file
+  },
   &quot;shortDescription&quot;: &quot;A String&quot;, # A one sentence description of this `Note`.
+  &quot;spdxFile&quot;: { # FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # A note describing an SPDX File.
+    &quot;checksum&quot;: [ # Provide a unique identifier to match analysis information on each specific file in a package
+      &quot;A String&quot;,
+    ],
+    &quot;fileType&quot;: &quot;A String&quot;, # This field provides information about the type of file identified
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full path and filename that corresponds to the file information in this section
+  },
+  &quot;spdxPackage&quot;: { # PackageNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # A note describing an SPDX Package.
+    &quot;analyzed&quot;: True or False, # Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document
+    &quot;attribution&quot;: &quot;A String&quot;, # A place for the SPDX data creator to record, at the package level, acknowledgements that may be needed to be communicated in some contexts
+    &quot;checksum&quot;: &quot;A String&quot;, # Provide an independently reproducible mechanism that permits unique identification of a specific package that correlates to the data in this SPDX file
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holders of the package, as well as any dates present
+    &quot;detailedDescription&quot;: &quot;A String&quot;, # A more detailed description of the package
+    &quot;downloadLocation&quot;: &quot;A String&quot;, # This section identifies the download Universal Resource Locator (URL), or a specific location within a version control system (VCS) for the package at the time that the SPDX file was created
+    &quot;externalRefs&quot;: [ # ExternalRef
+      { # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;category&quot;: &quot;A String&quot;, # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;comment&quot;: &quot;A String&quot;, # Human-readable information about the purpose and target of the reference
+        &quot;locator&quot;: &quot;A String&quot;, # The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location
+        &quot;type&quot;: &quot;A String&quot;, # Type of category (e.g. &#x27;npm&#x27; for the PACKAGE_MANAGER category)
+      },
+    ],
+    &quot;filesLicenseInfo&quot;: [ # Contain the license the SPDX file creator has concluded as governing the This field is to contain a list of all licenses found in the package. The relationship between licenses (i.e., conjunctive, disjunctive) is not specified in this field – it is simply a listing of all licenses found
+      &quot;A String&quot;,
+    ],
+    &quot;homePage&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record a web site that serves as the package&#x27;s home page
+    &quot;licenseDeclared&quot;: &quot;A String&quot;, # List the licenses that have been declared by the authors of the package
+    &quot;originator&quot;: &quot;A String&quot;, # If the package identified in the SPDX file originated from a different person or organization than identified as Package Supplier, this field identifies from where or whom the package originally came
+    &quot;summaryDescription&quot;: &quot;A String&quot;, # A short description of the package
+    &quot;supplier&quot;: &quot;A String&quot;, # Identify the actual distribution source for the package/directory identified in the SPDX file
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full name of the package as given by the Package Originator
+    &quot;verificationCode&quot;: &quot;A String&quot;, # This field provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX file itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX file
+    &quot;version&quot;: &quot;A String&quot;, # Identify the version of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # A note describing a relationship between SPDX elements.
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this note was last updated. This field can be used as a filter in list requests.
   &quot;upgrade&quot;: { # An Upgrade Note represents a potential upgrade of a package to a given version. For each package version combination (i.e. bash 4.0, bash 4.1, bash 4.1.2), there will be a Upgrade Note. # A note describing an upgrade.
     &quot;distributions&quot;: [ # Metadata about the upgrade for each specific operating system.
@@ -1072,7 +1272,47 @@
       &quot;url&quot;: &quot;A String&quot;, # Specific URL to associate with the note
     },
   ],
+  &quot;sbom&quot;: { # DocumentNote represents an SPDX Document Creation Infromation section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # A note describing a software bill of materials.
+    &quot;dataLicence&quot;: &quot;A String&quot;, # Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (&quot;SPDX-Metadata&quot;)
+    &quot;spdxVersion&quot;: &quot;A String&quot;, # Provide a reference number that can be used to understand how to parse and interpret the rest of the file
+  },
   &quot;shortDescription&quot;: &quot;A String&quot;, # A one sentence description of this `Note`.
+  &quot;spdxFile&quot;: { # FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # A note describing an SPDX File.
+    &quot;checksum&quot;: [ # Provide a unique identifier to match analysis information on each specific file in a package
+      &quot;A String&quot;,
+    ],
+    &quot;fileType&quot;: &quot;A String&quot;, # This field provides information about the type of file identified
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full path and filename that corresponds to the file information in this section
+  },
+  &quot;spdxPackage&quot;: { # PackageNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # A note describing an SPDX Package.
+    &quot;analyzed&quot;: True or False, # Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document
+    &quot;attribution&quot;: &quot;A String&quot;, # A place for the SPDX data creator to record, at the package level, acknowledgements that may be needed to be communicated in some contexts
+    &quot;checksum&quot;: &quot;A String&quot;, # Provide an independently reproducible mechanism that permits unique identification of a specific package that correlates to the data in this SPDX file
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holders of the package, as well as any dates present
+    &quot;detailedDescription&quot;: &quot;A String&quot;, # A more detailed description of the package
+    &quot;downloadLocation&quot;: &quot;A String&quot;, # This section identifies the download Universal Resource Locator (URL), or a specific location within a version control system (VCS) for the package at the time that the SPDX file was created
+    &quot;externalRefs&quot;: [ # ExternalRef
+      { # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;category&quot;: &quot;A String&quot;, # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;comment&quot;: &quot;A String&quot;, # Human-readable information about the purpose and target of the reference
+        &quot;locator&quot;: &quot;A String&quot;, # The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location
+        &quot;type&quot;: &quot;A String&quot;, # Type of category (e.g. &#x27;npm&#x27; for the PACKAGE_MANAGER category)
+      },
+    ],
+    &quot;filesLicenseInfo&quot;: [ # Contain the license the SPDX file creator has concluded as governing the This field is to contain a list of all licenses found in the package. The relationship between licenses (i.e., conjunctive, disjunctive) is not specified in this field – it is simply a listing of all licenses found
+      &quot;A String&quot;,
+    ],
+    &quot;homePage&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record a web site that serves as the package&#x27;s home page
+    &quot;licenseDeclared&quot;: &quot;A String&quot;, # List the licenses that have been declared by the authors of the package
+    &quot;originator&quot;: &quot;A String&quot;, # If the package identified in the SPDX file originated from a different person or organization than identified as Package Supplier, this field identifies from where or whom the package originally came
+    &quot;summaryDescription&quot;: &quot;A String&quot;, # A short description of the package
+    &quot;supplier&quot;: &quot;A String&quot;, # Identify the actual distribution source for the package/directory identified in the SPDX file
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full name of the package as given by the Package Originator
+    &quot;verificationCode&quot;: &quot;A String&quot;, # This field provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX file itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX file
+    &quot;version&quot;: &quot;A String&quot;, # Identify the version of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # A note describing a relationship between SPDX elements.
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this note was last updated. This field can be used as a filter in list requests.
   &quot;upgrade&quot;: { # An Upgrade Note represents a potential upgrade of a package to a given version. For each package version combination (i.e. bash 4.0, bash 4.1, bash 4.1.2), there will be a Upgrade Note. # A note describing an upgrade.
     &quot;distributions&quot;: [ # Metadata about the upgrade for each specific operating system.
diff --git a/docs/dyn/containeranalysis_v1alpha1.projects.notes.occurrences.html b/docs/dyn/containeranalysis_v1alpha1.projects.notes.occurrences.html
index e172ba1..a4ddac1 100644
--- a/docs/dyn/containeranalysis_v1alpha1.projects.notes.occurrences.html
+++ b/docs/dyn/containeranalysis_v1alpha1.projects.notes.occurrences.html
@@ -356,6 +356,52 @@
         &quot;uri&quot;: &quot;A String&quot;, # The unique URI of the resource. E.g., &quot;https://gcr.io/project/image@sha256:foo&quot; for a Docker image.
       },
       &quot;resourceUrl&quot;: &quot;A String&quot;, # The unique URL of the image or the container for which the `Occurrence` applies. For example, https://gcr.io/project/image@sha256:foo This field can be used as a filter in list requests.
+      &quot;sbom&quot;: { # DocumentOccurrence represents an SPDX Document Creation Information section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # Describes a specific software bill of materials document.
+        &quot;createTime&quot;: &quot;A String&quot;, # Identify when the SPDX file was originally created. The date is to be specified according to combined date and time in UTC format as specified in ISO 8601 standard
+        &quot;creatorComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide general comments about the creation of the SPDX file or any other relevant comment not included in the other fields
+        &quot;creators&quot;: [ # Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an individual, indicate the person&#x27;s name
+          &quot;A String&quot;,
+        ],
+        &quot;documentComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file content to provide comments to the consumers of the SPDX document
+        &quot;externalDocumentRefs&quot;: [ # Identify any external SPDX documents referenced within this SPDX document
+          &quot;A String&quot;,
+        ],
+        &quot;id&quot;: &quot;A String&quot;, # Identify the current SPDX document which may be referenced in relationships by other files, packages internally and documents externally
+        &quot;licenseListVersion&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created
+        &quot;namespace&quot;: &quot;A String&quot;, # Provide an SPDX document specific namespace as a unique absolute Uniform Resource Identifier (URI) as specified in RFC-3986, with the exception of the ‘#’ delimiter
+        &quot;title&quot;: &quot;A String&quot;, # Identify name of this document as designated by creator
+      },
+      &quot;spdxFile&quot;: { # FileOccurrence represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # Describes a specific SPDX File.
+        &quot;attributions&quot;: [ # This field provides a place for the SPDX data creator to record, at the file level, acknowledgements that may be needed to be communicated in some contexts
+          &quot;A String&quot;,
+        ],
+        &quot;comment&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any general comments about the file
+        &quot;contributors&quot;: [ # This field provides a place for the SPDX file creator to record file contributors
+          &quot;A String&quot;,
+        ],
+        &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holder of the file, as well as any dates present
+        &quot;filesLicenseInfo&quot;: [ # This field contains the license information actually found in the file, if any
+          &quot;A String&quot;,
+        ],
+        &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+        &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background references or analysis that went in to arriving at the Concluded License for a file
+        &quot;licenseConcluded&quot;: &quot;A String&quot;, # This field contains the license the SPDX file creator has concluded as governing the file or alternative values if the governing license cannot be determined
+        &quot;notice&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record license notices or other such related notices found in the file
+      },
+      &quot;spdxPackage&quot;: { # PackageOccurrence represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # Describes a specific SPDX Package.
+        &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the package being described
+        &quot;filename&quot;: &quot;A String&quot;, # Provide the actual file name of the package, or path of the directory being treated as a package
+        &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+        &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background information or analysis that went in to arriving at the Concluded License for a package
+        &quot;licenseConcluded&quot;: &quot;A String&quot;, # package or alternative values, if the governing license cannot be determined
+        &quot;sourceInfo&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record any relevant background information or additional comments about the origin of the package
+      },
+      &quot;spdxRelationship&quot;: { # RelationshipOccurrence represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # Describes a specific relationship between SPDX elements.
+        &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the relationship
+        &quot;source&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-A The source SPDX element (file, package, etc)
+        &quot;target&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-B The target SPDC element (file, package, etc) In cases where there are &quot;known unknowns&quot;, the use of the keyword NOASSERTION can be used The keywords NONE can be used to indicate that an SPDX element (package/file/snippet) has no other elements connected by some relationship to it
+        &quot;type&quot;: &quot;A String&quot;, # The type of relationship between the source and target SPDX elements
+      },
       &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this `Occurrence` was last updated.
       &quot;upgrade&quot;: { # An Upgrade Occurrence represents that a specific resource_url could install a specific upgrade. This presence is supplied via local sources (i.e. it is present in the mirror and the running system has noticed its availability). # Describes an upgrade.
         &quot;distribution&quot;: { # The Upgrade Distribution represents metadata about the Upgrade for each operating system (CPE). Some distributions have additional metadata around updates, classifying them into various categories and severities. # Metadata about the upgrade for available for the specific operating system for the resource_url. This allows efficient filtering, as well as making it easier to use the occurrence.
diff --git a/docs/dyn/containeranalysis_v1alpha1.projects.occurrences.html b/docs/dyn/containeranalysis_v1alpha1.projects.occurrences.html
index 1cd4cf8..5dab89e 100644
--- a/docs/dyn/containeranalysis_v1alpha1.projects.occurrences.html
+++ b/docs/dyn/containeranalysis_v1alpha1.projects.occurrences.html
@@ -372,6 +372,52 @@
     &quot;uri&quot;: &quot;A String&quot;, # The unique URI of the resource. E.g., &quot;https://gcr.io/project/image@sha256:foo&quot; for a Docker image.
   },
   &quot;resourceUrl&quot;: &quot;A String&quot;, # The unique URL of the image or the container for which the `Occurrence` applies. For example, https://gcr.io/project/image@sha256:foo This field can be used as a filter in list requests.
+  &quot;sbom&quot;: { # DocumentOccurrence represents an SPDX Document Creation Information section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # Describes a specific software bill of materials document.
+    &quot;createTime&quot;: &quot;A String&quot;, # Identify when the SPDX file was originally created. The date is to be specified according to combined date and time in UTC format as specified in ISO 8601 standard
+    &quot;creatorComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide general comments about the creation of the SPDX file or any other relevant comment not included in the other fields
+    &quot;creators&quot;: [ # Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an individual, indicate the person&#x27;s name
+      &quot;A String&quot;,
+    ],
+    &quot;documentComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file content to provide comments to the consumers of the SPDX document
+    &quot;externalDocumentRefs&quot;: [ # Identify any external SPDX documents referenced within this SPDX document
+      &quot;A String&quot;,
+    ],
+    &quot;id&quot;: &quot;A String&quot;, # Identify the current SPDX document which may be referenced in relationships by other files, packages internally and documents externally
+    &quot;licenseListVersion&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created
+    &quot;namespace&quot;: &quot;A String&quot;, # Provide an SPDX document specific namespace as a unique absolute Uniform Resource Identifier (URI) as specified in RFC-3986, with the exception of the ‘#’ delimiter
+    &quot;title&quot;: &quot;A String&quot;, # Identify name of this document as designated by creator
+  },
+  &quot;spdxFile&quot;: { # FileOccurrence represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # Describes a specific SPDX File.
+    &quot;attributions&quot;: [ # This field provides a place for the SPDX data creator to record, at the file level, acknowledgements that may be needed to be communicated in some contexts
+      &quot;A String&quot;,
+    ],
+    &quot;comment&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any general comments about the file
+    &quot;contributors&quot;: [ # This field provides a place for the SPDX file creator to record file contributors
+      &quot;A String&quot;,
+    ],
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holder of the file, as well as any dates present
+    &quot;filesLicenseInfo&quot;: [ # This field contains the license information actually found in the file, if any
+      &quot;A String&quot;,
+    ],
+    &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+    &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background references or analysis that went in to arriving at the Concluded License for a file
+    &quot;licenseConcluded&quot;: &quot;A String&quot;, # This field contains the license the SPDX file creator has concluded as governing the file or alternative values if the governing license cannot be determined
+    &quot;notice&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record license notices or other such related notices found in the file
+  },
+  &quot;spdxPackage&quot;: { # PackageOccurrence represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # Describes a specific SPDX Package.
+    &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the package being described
+    &quot;filename&quot;: &quot;A String&quot;, # Provide the actual file name of the package, or path of the directory being treated as a package
+    &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+    &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background information or analysis that went in to arriving at the Concluded License for a package
+    &quot;licenseConcluded&quot;: &quot;A String&quot;, # package or alternative values, if the governing license cannot be determined
+    &quot;sourceInfo&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record any relevant background information or additional comments about the origin of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipOccurrence represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # Describes a specific relationship between SPDX elements.
+    &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the relationship
+    &quot;source&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-A The source SPDX element (file, package, etc)
+    &quot;target&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-B The target SPDC element (file, package, etc) In cases where there are &quot;known unknowns&quot;, the use of the keyword NOASSERTION can be used The keywords NONE can be used to indicate that an SPDX element (package/file/snippet) has no other elements connected by some relationship to it
+    &quot;type&quot;: &quot;A String&quot;, # The type of relationship between the source and target SPDX elements
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this `Occurrence` was last updated.
   &quot;upgrade&quot;: { # An Upgrade Occurrence represents that a specific resource_url could install a specific upgrade. This presence is supplied via local sources (i.e. it is present in the mirror and the running system has noticed its availability). # Describes an upgrade.
     &quot;distribution&quot;: { # The Upgrade Distribution represents metadata about the Upgrade for each operating system (CPE). Some distributions have additional metadata around updates, classifying them into various categories and severities. # Metadata about the upgrade for available for the specific operating system for the resource_url. This allows efficient filtering, as well as making it easier to use the occurrence.
@@ -682,6 +728,52 @@
     &quot;uri&quot;: &quot;A String&quot;, # The unique URI of the resource. E.g., &quot;https://gcr.io/project/image@sha256:foo&quot; for a Docker image.
   },
   &quot;resourceUrl&quot;: &quot;A String&quot;, # The unique URL of the image or the container for which the `Occurrence` applies. For example, https://gcr.io/project/image@sha256:foo This field can be used as a filter in list requests.
+  &quot;sbom&quot;: { # DocumentOccurrence represents an SPDX Document Creation Information section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # Describes a specific software bill of materials document.
+    &quot;createTime&quot;: &quot;A String&quot;, # Identify when the SPDX file was originally created. The date is to be specified according to combined date and time in UTC format as specified in ISO 8601 standard
+    &quot;creatorComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide general comments about the creation of the SPDX file or any other relevant comment not included in the other fields
+    &quot;creators&quot;: [ # Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an individual, indicate the person&#x27;s name
+      &quot;A String&quot;,
+    ],
+    &quot;documentComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file content to provide comments to the consumers of the SPDX document
+    &quot;externalDocumentRefs&quot;: [ # Identify any external SPDX documents referenced within this SPDX document
+      &quot;A String&quot;,
+    ],
+    &quot;id&quot;: &quot;A String&quot;, # Identify the current SPDX document which may be referenced in relationships by other files, packages internally and documents externally
+    &quot;licenseListVersion&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created
+    &quot;namespace&quot;: &quot;A String&quot;, # Provide an SPDX document specific namespace as a unique absolute Uniform Resource Identifier (URI) as specified in RFC-3986, with the exception of the ‘#’ delimiter
+    &quot;title&quot;: &quot;A String&quot;, # Identify name of this document as designated by creator
+  },
+  &quot;spdxFile&quot;: { # FileOccurrence represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # Describes a specific SPDX File.
+    &quot;attributions&quot;: [ # This field provides a place for the SPDX data creator to record, at the file level, acknowledgements that may be needed to be communicated in some contexts
+      &quot;A String&quot;,
+    ],
+    &quot;comment&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any general comments about the file
+    &quot;contributors&quot;: [ # This field provides a place for the SPDX file creator to record file contributors
+      &quot;A String&quot;,
+    ],
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holder of the file, as well as any dates present
+    &quot;filesLicenseInfo&quot;: [ # This field contains the license information actually found in the file, if any
+      &quot;A String&quot;,
+    ],
+    &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+    &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background references or analysis that went in to arriving at the Concluded License for a file
+    &quot;licenseConcluded&quot;: &quot;A String&quot;, # This field contains the license the SPDX file creator has concluded as governing the file or alternative values if the governing license cannot be determined
+    &quot;notice&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record license notices or other such related notices found in the file
+  },
+  &quot;spdxPackage&quot;: { # PackageOccurrence represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # Describes a specific SPDX Package.
+    &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the package being described
+    &quot;filename&quot;: &quot;A String&quot;, # Provide the actual file name of the package, or path of the directory being treated as a package
+    &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+    &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background information or analysis that went in to arriving at the Concluded License for a package
+    &quot;licenseConcluded&quot;: &quot;A String&quot;, # package or alternative values, if the governing license cannot be determined
+    &quot;sourceInfo&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record any relevant background information or additional comments about the origin of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipOccurrence represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # Describes a specific relationship between SPDX elements.
+    &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the relationship
+    &quot;source&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-A The source SPDX element (file, package, etc)
+    &quot;target&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-B The target SPDC element (file, package, etc) In cases where there are &quot;known unknowns&quot;, the use of the keyword NOASSERTION can be used The keywords NONE can be used to indicate that an SPDX element (package/file/snippet) has no other elements connected by some relationship to it
+    &quot;type&quot;: &quot;A String&quot;, # The type of relationship between the source and target SPDX elements
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this `Occurrence` was last updated.
   &quot;upgrade&quot;: { # An Upgrade Occurrence represents that a specific resource_url could install a specific upgrade. This presence is supplied via local sources (i.e. it is present in the mirror and the running system has noticed its availability). # Describes an upgrade.
     &quot;distribution&quot;: { # The Upgrade Distribution represents metadata about the Upgrade for each operating system (CPE). Some distributions have additional metadata around updates, classifying them into various categories and severities. # Metadata about the upgrade for available for the specific operating system for the resource_url. This allows efficient filtering, as well as making it easier to use the occurrence.
@@ -1016,6 +1108,52 @@
     &quot;uri&quot;: &quot;A String&quot;, # The unique URI of the resource. E.g., &quot;https://gcr.io/project/image@sha256:foo&quot; for a Docker image.
   },
   &quot;resourceUrl&quot;: &quot;A String&quot;, # The unique URL of the image or the container for which the `Occurrence` applies. For example, https://gcr.io/project/image@sha256:foo This field can be used as a filter in list requests.
+  &quot;sbom&quot;: { # DocumentOccurrence represents an SPDX Document Creation Information section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # Describes a specific software bill of materials document.
+    &quot;createTime&quot;: &quot;A String&quot;, # Identify when the SPDX file was originally created. The date is to be specified according to combined date and time in UTC format as specified in ISO 8601 standard
+    &quot;creatorComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide general comments about the creation of the SPDX file or any other relevant comment not included in the other fields
+    &quot;creators&quot;: [ # Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an individual, indicate the person&#x27;s name
+      &quot;A String&quot;,
+    ],
+    &quot;documentComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file content to provide comments to the consumers of the SPDX document
+    &quot;externalDocumentRefs&quot;: [ # Identify any external SPDX documents referenced within this SPDX document
+      &quot;A String&quot;,
+    ],
+    &quot;id&quot;: &quot;A String&quot;, # Identify the current SPDX document which may be referenced in relationships by other files, packages internally and documents externally
+    &quot;licenseListVersion&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created
+    &quot;namespace&quot;: &quot;A String&quot;, # Provide an SPDX document specific namespace as a unique absolute Uniform Resource Identifier (URI) as specified in RFC-3986, with the exception of the ‘#’ delimiter
+    &quot;title&quot;: &quot;A String&quot;, # Identify name of this document as designated by creator
+  },
+  &quot;spdxFile&quot;: { # FileOccurrence represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # Describes a specific SPDX File.
+    &quot;attributions&quot;: [ # This field provides a place for the SPDX data creator to record, at the file level, acknowledgements that may be needed to be communicated in some contexts
+      &quot;A String&quot;,
+    ],
+    &quot;comment&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any general comments about the file
+    &quot;contributors&quot;: [ # This field provides a place for the SPDX file creator to record file contributors
+      &quot;A String&quot;,
+    ],
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holder of the file, as well as any dates present
+    &quot;filesLicenseInfo&quot;: [ # This field contains the license information actually found in the file, if any
+      &quot;A String&quot;,
+    ],
+    &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+    &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background references or analysis that went in to arriving at the Concluded License for a file
+    &quot;licenseConcluded&quot;: &quot;A String&quot;, # This field contains the license the SPDX file creator has concluded as governing the file or alternative values if the governing license cannot be determined
+    &quot;notice&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record license notices or other such related notices found in the file
+  },
+  &quot;spdxPackage&quot;: { # PackageOccurrence represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # Describes a specific SPDX Package.
+    &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the package being described
+    &quot;filename&quot;: &quot;A String&quot;, # Provide the actual file name of the package, or path of the directory being treated as a package
+    &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+    &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background information or analysis that went in to arriving at the Concluded License for a package
+    &quot;licenseConcluded&quot;: &quot;A String&quot;, # package or alternative values, if the governing license cannot be determined
+    &quot;sourceInfo&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record any relevant background information or additional comments about the origin of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipOccurrence represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # Describes a specific relationship between SPDX elements.
+    &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the relationship
+    &quot;source&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-A The source SPDX element (file, package, etc)
+    &quot;target&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-B The target SPDC element (file, package, etc) In cases where there are &quot;known unknowns&quot;, the use of the keyword NOASSERTION can be used The keywords NONE can be used to indicate that an SPDX element (package/file/snippet) has no other elements connected by some relationship to it
+    &quot;type&quot;: &quot;A String&quot;, # The type of relationship between the source and target SPDX elements
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this `Occurrence` was last updated.
   &quot;upgrade&quot;: { # An Upgrade Occurrence represents that a specific resource_url could install a specific upgrade. This presence is supplied via local sources (i.e. it is present in the mirror and the running system has noticed its availability). # Describes an upgrade.
     &quot;distribution&quot;: { # The Upgrade Distribution represents metadata about the Upgrade for each operating system (CPE). Some distributions have additional metadata around updates, classifying them into various categories and severities. # Metadata about the upgrade for available for the specific operating system for the resource_url. This allows efficient filtering, as well as making it easier to use the occurrence.
@@ -1208,7 +1346,47 @@
       &quot;url&quot;: &quot;A String&quot;, # Specific URL to associate with the note
     },
   ],
+  &quot;sbom&quot;: { # DocumentNote represents an SPDX Document Creation Infromation section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # A note describing a software bill of materials.
+    &quot;dataLicence&quot;: &quot;A String&quot;, # Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (&quot;SPDX-Metadata&quot;)
+    &quot;spdxVersion&quot;: &quot;A String&quot;, # Provide a reference number that can be used to understand how to parse and interpret the rest of the file
+  },
   &quot;shortDescription&quot;: &quot;A String&quot;, # A one sentence description of this `Note`.
+  &quot;spdxFile&quot;: { # FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # A note describing an SPDX File.
+    &quot;checksum&quot;: [ # Provide a unique identifier to match analysis information on each specific file in a package
+      &quot;A String&quot;,
+    ],
+    &quot;fileType&quot;: &quot;A String&quot;, # This field provides information about the type of file identified
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full path and filename that corresponds to the file information in this section
+  },
+  &quot;spdxPackage&quot;: { # PackageNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # A note describing an SPDX Package.
+    &quot;analyzed&quot;: True or False, # Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document
+    &quot;attribution&quot;: &quot;A String&quot;, # A place for the SPDX data creator to record, at the package level, acknowledgements that may be needed to be communicated in some contexts
+    &quot;checksum&quot;: &quot;A String&quot;, # Provide an independently reproducible mechanism that permits unique identification of a specific package that correlates to the data in this SPDX file
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holders of the package, as well as any dates present
+    &quot;detailedDescription&quot;: &quot;A String&quot;, # A more detailed description of the package
+    &quot;downloadLocation&quot;: &quot;A String&quot;, # This section identifies the download Universal Resource Locator (URL), or a specific location within a version control system (VCS) for the package at the time that the SPDX file was created
+    &quot;externalRefs&quot;: [ # ExternalRef
+      { # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;category&quot;: &quot;A String&quot;, # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;comment&quot;: &quot;A String&quot;, # Human-readable information about the purpose and target of the reference
+        &quot;locator&quot;: &quot;A String&quot;, # The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location
+        &quot;type&quot;: &quot;A String&quot;, # Type of category (e.g. &#x27;npm&#x27; for the PACKAGE_MANAGER category)
+      },
+    ],
+    &quot;filesLicenseInfo&quot;: [ # Contain the license the SPDX file creator has concluded as governing the This field is to contain a list of all licenses found in the package. The relationship between licenses (i.e., conjunctive, disjunctive) is not specified in this field – it is simply a listing of all licenses found
+      &quot;A String&quot;,
+    ],
+    &quot;homePage&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record a web site that serves as the package&#x27;s home page
+    &quot;licenseDeclared&quot;: &quot;A String&quot;, # List the licenses that have been declared by the authors of the package
+    &quot;originator&quot;: &quot;A String&quot;, # If the package identified in the SPDX file originated from a different person or organization than identified as Package Supplier, this field identifies from where or whom the package originally came
+    &quot;summaryDescription&quot;: &quot;A String&quot;, # A short description of the package
+    &quot;supplier&quot;: &quot;A String&quot;, # Identify the actual distribution source for the package/directory identified in the SPDX file
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full name of the package as given by the Package Originator
+    &quot;verificationCode&quot;: &quot;A String&quot;, # This field provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX file itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX file
+    &quot;version&quot;: &quot;A String&quot;, # Identify the version of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # A note describing a relationship between SPDX elements.
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this note was last updated. This field can be used as a filter in list requests.
   &quot;upgrade&quot;: { # An Upgrade Note represents a potential upgrade of a package to a given version. For each package version combination (i.e. bash 4.0, bash 4.1, bash 4.1.2), there will be a Upgrade Note. # A note describing an upgrade.
     &quot;distributions&quot;: [ # Metadata about the upgrade for each specific operating system.
@@ -1318,6 +1496,10 @@
       ATTESTATION_AUTHORITY - This represents a logical &quot;role&quot; that can attest to artifacts.
       UPGRADE - This represents an available software upgrade.
       COMPLIANCE - This represents a compliance check that can be applied to a resource.
+      SBOM - This represents a software bill of materials.
+      SPDX_PACKAGE - This represents an SPDX Package.
+      SPDX_FILE - This represents an SPDX File.
+      SPDX_RELATIONSHIP - This represents an SPDX Relationship.
   name: string, The name field contains the project Id. For example: &quot;projects/{project_id} @Deprecated
   pageSize: integer, Number of occurrences to return in the list.
   pageToken: string, Token to provide to skip to a particular spot in the list.
@@ -1579,6 +1761,52 @@
         &quot;uri&quot;: &quot;A String&quot;, # The unique URI of the resource. E.g., &quot;https://gcr.io/project/image@sha256:foo&quot; for a Docker image.
       },
       &quot;resourceUrl&quot;: &quot;A String&quot;, # The unique URL of the image or the container for which the `Occurrence` applies. For example, https://gcr.io/project/image@sha256:foo This field can be used as a filter in list requests.
+      &quot;sbom&quot;: { # DocumentOccurrence represents an SPDX Document Creation Information section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # Describes a specific software bill of materials document.
+        &quot;createTime&quot;: &quot;A String&quot;, # Identify when the SPDX file was originally created. The date is to be specified according to combined date and time in UTC format as specified in ISO 8601 standard
+        &quot;creatorComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide general comments about the creation of the SPDX file or any other relevant comment not included in the other fields
+        &quot;creators&quot;: [ # Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an individual, indicate the person&#x27;s name
+          &quot;A String&quot;,
+        ],
+        &quot;documentComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file content to provide comments to the consumers of the SPDX document
+        &quot;externalDocumentRefs&quot;: [ # Identify any external SPDX documents referenced within this SPDX document
+          &quot;A String&quot;,
+        ],
+        &quot;id&quot;: &quot;A String&quot;, # Identify the current SPDX document which may be referenced in relationships by other files, packages internally and documents externally
+        &quot;licenseListVersion&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created
+        &quot;namespace&quot;: &quot;A String&quot;, # Provide an SPDX document specific namespace as a unique absolute Uniform Resource Identifier (URI) as specified in RFC-3986, with the exception of the ‘#’ delimiter
+        &quot;title&quot;: &quot;A String&quot;, # Identify name of this document as designated by creator
+      },
+      &quot;spdxFile&quot;: { # FileOccurrence represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # Describes a specific SPDX File.
+        &quot;attributions&quot;: [ # This field provides a place for the SPDX data creator to record, at the file level, acknowledgements that may be needed to be communicated in some contexts
+          &quot;A String&quot;,
+        ],
+        &quot;comment&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any general comments about the file
+        &quot;contributors&quot;: [ # This field provides a place for the SPDX file creator to record file contributors
+          &quot;A String&quot;,
+        ],
+        &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holder of the file, as well as any dates present
+        &quot;filesLicenseInfo&quot;: [ # This field contains the license information actually found in the file, if any
+          &quot;A String&quot;,
+        ],
+        &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+        &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background references or analysis that went in to arriving at the Concluded License for a file
+        &quot;licenseConcluded&quot;: &quot;A String&quot;, # This field contains the license the SPDX file creator has concluded as governing the file or alternative values if the governing license cannot be determined
+        &quot;notice&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record license notices or other such related notices found in the file
+      },
+      &quot;spdxPackage&quot;: { # PackageOccurrence represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # Describes a specific SPDX Package.
+        &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the package being described
+        &quot;filename&quot;: &quot;A String&quot;, # Provide the actual file name of the package, or path of the directory being treated as a package
+        &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+        &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background information or analysis that went in to arriving at the Concluded License for a package
+        &quot;licenseConcluded&quot;: &quot;A String&quot;, # package or alternative values, if the governing license cannot be determined
+        &quot;sourceInfo&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record any relevant background information or additional comments about the origin of the package
+      },
+      &quot;spdxRelationship&quot;: { # RelationshipOccurrence represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # Describes a specific relationship between SPDX elements.
+        &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the relationship
+        &quot;source&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-A The source SPDX element (file, package, etc)
+        &quot;target&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-B The target SPDC element (file, package, etc) In cases where there are &quot;known unknowns&quot;, the use of the keyword NOASSERTION can be used The keywords NONE can be used to indicate that an SPDX element (package/file/snippet) has no other elements connected by some relationship to it
+        &quot;type&quot;: &quot;A String&quot;, # The type of relationship between the source and target SPDX elements
+      },
       &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this `Occurrence` was last updated.
       &quot;upgrade&quot;: { # An Upgrade Occurrence represents that a specific resource_url could install a specific upgrade. This presence is supplied via local sources (i.e. it is present in the mirror and the running system has noticed its availability). # Describes an upgrade.
         &quot;distribution&quot;: { # The Upgrade Distribution represents metadata about the Upgrade for each operating system (CPE). Some distributions have additional metadata around updates, classifying them into various categories and severities. # Metadata about the upgrade for available for the specific operating system for the resource_url. This allows efficient filtering, as well as making it easier to use the occurrence.
@@ -1906,6 +2134,52 @@
     &quot;uri&quot;: &quot;A String&quot;, # The unique URI of the resource. E.g., &quot;https://gcr.io/project/image@sha256:foo&quot; for a Docker image.
   },
   &quot;resourceUrl&quot;: &quot;A String&quot;, # The unique URL of the image or the container for which the `Occurrence` applies. For example, https://gcr.io/project/image@sha256:foo This field can be used as a filter in list requests.
+  &quot;sbom&quot;: { # DocumentOccurrence represents an SPDX Document Creation Information section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # Describes a specific software bill of materials document.
+    &quot;createTime&quot;: &quot;A String&quot;, # Identify when the SPDX file was originally created. The date is to be specified according to combined date and time in UTC format as specified in ISO 8601 standard
+    &quot;creatorComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide general comments about the creation of the SPDX file or any other relevant comment not included in the other fields
+    &quot;creators&quot;: [ # Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an individual, indicate the person&#x27;s name
+      &quot;A String&quot;,
+    ],
+    &quot;documentComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file content to provide comments to the consumers of the SPDX document
+    &quot;externalDocumentRefs&quot;: [ # Identify any external SPDX documents referenced within this SPDX document
+      &quot;A String&quot;,
+    ],
+    &quot;id&quot;: &quot;A String&quot;, # Identify the current SPDX document which may be referenced in relationships by other files, packages internally and documents externally
+    &quot;licenseListVersion&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created
+    &quot;namespace&quot;: &quot;A String&quot;, # Provide an SPDX document specific namespace as a unique absolute Uniform Resource Identifier (URI) as specified in RFC-3986, with the exception of the ‘#’ delimiter
+    &quot;title&quot;: &quot;A String&quot;, # Identify name of this document as designated by creator
+  },
+  &quot;spdxFile&quot;: { # FileOccurrence represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # Describes a specific SPDX File.
+    &quot;attributions&quot;: [ # This field provides a place for the SPDX data creator to record, at the file level, acknowledgements that may be needed to be communicated in some contexts
+      &quot;A String&quot;,
+    ],
+    &quot;comment&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any general comments about the file
+    &quot;contributors&quot;: [ # This field provides a place for the SPDX file creator to record file contributors
+      &quot;A String&quot;,
+    ],
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holder of the file, as well as any dates present
+    &quot;filesLicenseInfo&quot;: [ # This field contains the license information actually found in the file, if any
+      &quot;A String&quot;,
+    ],
+    &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+    &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background references or analysis that went in to arriving at the Concluded License for a file
+    &quot;licenseConcluded&quot;: &quot;A String&quot;, # This field contains the license the SPDX file creator has concluded as governing the file or alternative values if the governing license cannot be determined
+    &quot;notice&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record license notices or other such related notices found in the file
+  },
+  &quot;spdxPackage&quot;: { # PackageOccurrence represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # Describes a specific SPDX Package.
+    &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the package being described
+    &quot;filename&quot;: &quot;A String&quot;, # Provide the actual file name of the package, or path of the directory being treated as a package
+    &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+    &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background information or analysis that went in to arriving at the Concluded License for a package
+    &quot;licenseConcluded&quot;: &quot;A String&quot;, # package or alternative values, if the governing license cannot be determined
+    &quot;sourceInfo&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record any relevant background information or additional comments about the origin of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipOccurrence represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # Describes a specific relationship between SPDX elements.
+    &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the relationship
+    &quot;source&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-A The source SPDX element (file, package, etc)
+    &quot;target&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-B The target SPDC element (file, package, etc) In cases where there are &quot;known unknowns&quot;, the use of the keyword NOASSERTION can be used The keywords NONE can be used to indicate that an SPDX element (package/file/snippet) has no other elements connected by some relationship to it
+    &quot;type&quot;: &quot;A String&quot;, # The type of relationship between the source and target SPDX elements
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this `Occurrence` was last updated.
   &quot;upgrade&quot;: { # An Upgrade Occurrence represents that a specific resource_url could install a specific upgrade. This presence is supplied via local sources (i.e. it is present in the mirror and the running system has noticed its availability). # Describes an upgrade.
     &quot;distribution&quot;: { # The Upgrade Distribution represents metadata about the Upgrade for each operating system (CPE). Some distributions have additional metadata around updates, classifying them into various categories and severities. # Metadata about the upgrade for available for the specific operating system for the resource_url. This allows efficient filtering, as well as making it easier to use the occurrence.
@@ -2216,6 +2490,52 @@
     &quot;uri&quot;: &quot;A String&quot;, # The unique URI of the resource. E.g., &quot;https://gcr.io/project/image@sha256:foo&quot; for a Docker image.
   },
   &quot;resourceUrl&quot;: &quot;A String&quot;, # The unique URL of the image or the container for which the `Occurrence` applies. For example, https://gcr.io/project/image@sha256:foo This field can be used as a filter in list requests.
+  &quot;sbom&quot;: { # DocumentOccurrence represents an SPDX Document Creation Information section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # Describes a specific software bill of materials document.
+    &quot;createTime&quot;: &quot;A String&quot;, # Identify when the SPDX file was originally created. The date is to be specified according to combined date and time in UTC format as specified in ISO 8601 standard
+    &quot;creatorComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide general comments about the creation of the SPDX file or any other relevant comment not included in the other fields
+    &quot;creators&quot;: [ # Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an individual, indicate the person&#x27;s name
+      &quot;A String&quot;,
+    ],
+    &quot;documentComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file content to provide comments to the consumers of the SPDX document
+    &quot;externalDocumentRefs&quot;: [ # Identify any external SPDX documents referenced within this SPDX document
+      &quot;A String&quot;,
+    ],
+    &quot;id&quot;: &quot;A String&quot;, # Identify the current SPDX document which may be referenced in relationships by other files, packages internally and documents externally
+    &quot;licenseListVersion&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created
+    &quot;namespace&quot;: &quot;A String&quot;, # Provide an SPDX document specific namespace as a unique absolute Uniform Resource Identifier (URI) as specified in RFC-3986, with the exception of the ‘#’ delimiter
+    &quot;title&quot;: &quot;A String&quot;, # Identify name of this document as designated by creator
+  },
+  &quot;spdxFile&quot;: { # FileOccurrence represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # Describes a specific SPDX File.
+    &quot;attributions&quot;: [ # This field provides a place for the SPDX data creator to record, at the file level, acknowledgements that may be needed to be communicated in some contexts
+      &quot;A String&quot;,
+    ],
+    &quot;comment&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any general comments about the file
+    &quot;contributors&quot;: [ # This field provides a place for the SPDX file creator to record file contributors
+      &quot;A String&quot;,
+    ],
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holder of the file, as well as any dates present
+    &quot;filesLicenseInfo&quot;: [ # This field contains the license information actually found in the file, if any
+      &quot;A String&quot;,
+    ],
+    &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+    &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background references or analysis that went in to arriving at the Concluded License for a file
+    &quot;licenseConcluded&quot;: &quot;A String&quot;, # This field contains the license the SPDX file creator has concluded as governing the file or alternative values if the governing license cannot be determined
+    &quot;notice&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record license notices or other such related notices found in the file
+  },
+  &quot;spdxPackage&quot;: { # PackageOccurrence represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # Describes a specific SPDX Package.
+    &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the package being described
+    &quot;filename&quot;: &quot;A String&quot;, # Provide the actual file name of the package, or path of the directory being treated as a package
+    &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+    &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background information or analysis that went in to arriving at the Concluded License for a package
+    &quot;licenseConcluded&quot;: &quot;A String&quot;, # package or alternative values, if the governing license cannot be determined
+    &quot;sourceInfo&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record any relevant background information or additional comments about the origin of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipOccurrence represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # Describes a specific relationship between SPDX elements.
+    &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the relationship
+    &quot;source&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-A The source SPDX element (file, package, etc)
+    &quot;target&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-B The target SPDC element (file, package, etc) In cases where there are &quot;known unknowns&quot;, the use of the keyword NOASSERTION can be used The keywords NONE can be used to indicate that an SPDX element (package/file/snippet) has no other elements connected by some relationship to it
+    &quot;type&quot;: &quot;A String&quot;, # The type of relationship between the source and target SPDX elements
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this `Occurrence` was last updated.
   &quot;upgrade&quot;: { # An Upgrade Occurrence represents that a specific resource_url could install a specific upgrade. This presence is supplied via local sources (i.e. it is present in the mirror and the running system has noticed its availability). # Describes an upgrade.
     &quot;distribution&quot;: { # The Upgrade Distribution represents metadata about the Upgrade for each operating system (CPE). Some distributions have additional metadata around updates, classifying them into various categories and severities. # Metadata about the upgrade for available for the specific operating system for the resource_url. This allows efficient filtering, as well as making it easier to use the occurrence.
diff --git a/docs/dyn/containeranalysis_v1alpha1.providers.notes.html b/docs/dyn/containeranalysis_v1alpha1.providers.notes.html
index 6392800..b7b77ef 100644
--- a/docs/dyn/containeranalysis_v1alpha1.providers.notes.html
+++ b/docs/dyn/containeranalysis_v1alpha1.providers.notes.html
@@ -204,7 +204,47 @@
       &quot;url&quot;: &quot;A String&quot;, # Specific URL to associate with the note
     },
   ],
+  &quot;sbom&quot;: { # DocumentNote represents an SPDX Document Creation Infromation section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # A note describing a software bill of materials.
+    &quot;dataLicence&quot;: &quot;A String&quot;, # Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (&quot;SPDX-Metadata&quot;)
+    &quot;spdxVersion&quot;: &quot;A String&quot;, # Provide a reference number that can be used to understand how to parse and interpret the rest of the file
+  },
   &quot;shortDescription&quot;: &quot;A String&quot;, # A one sentence description of this `Note`.
+  &quot;spdxFile&quot;: { # FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # A note describing an SPDX File.
+    &quot;checksum&quot;: [ # Provide a unique identifier to match analysis information on each specific file in a package
+      &quot;A String&quot;,
+    ],
+    &quot;fileType&quot;: &quot;A String&quot;, # This field provides information about the type of file identified
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full path and filename that corresponds to the file information in this section
+  },
+  &quot;spdxPackage&quot;: { # PackageNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # A note describing an SPDX Package.
+    &quot;analyzed&quot;: True or False, # Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document
+    &quot;attribution&quot;: &quot;A String&quot;, # A place for the SPDX data creator to record, at the package level, acknowledgements that may be needed to be communicated in some contexts
+    &quot;checksum&quot;: &quot;A String&quot;, # Provide an independently reproducible mechanism that permits unique identification of a specific package that correlates to the data in this SPDX file
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holders of the package, as well as any dates present
+    &quot;detailedDescription&quot;: &quot;A String&quot;, # A more detailed description of the package
+    &quot;downloadLocation&quot;: &quot;A String&quot;, # This section identifies the download Universal Resource Locator (URL), or a specific location within a version control system (VCS) for the package at the time that the SPDX file was created
+    &quot;externalRefs&quot;: [ # ExternalRef
+      { # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;category&quot;: &quot;A String&quot;, # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;comment&quot;: &quot;A String&quot;, # Human-readable information about the purpose and target of the reference
+        &quot;locator&quot;: &quot;A String&quot;, # The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location
+        &quot;type&quot;: &quot;A String&quot;, # Type of category (e.g. &#x27;npm&#x27; for the PACKAGE_MANAGER category)
+      },
+    ],
+    &quot;filesLicenseInfo&quot;: [ # Contain the license the SPDX file creator has concluded as governing the This field is to contain a list of all licenses found in the package. The relationship between licenses (i.e., conjunctive, disjunctive) is not specified in this field – it is simply a listing of all licenses found
+      &quot;A String&quot;,
+    ],
+    &quot;homePage&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record a web site that serves as the package&#x27;s home page
+    &quot;licenseDeclared&quot;: &quot;A String&quot;, # List the licenses that have been declared by the authors of the package
+    &quot;originator&quot;: &quot;A String&quot;, # If the package identified in the SPDX file originated from a different person or organization than identified as Package Supplier, this field identifies from where or whom the package originally came
+    &quot;summaryDescription&quot;: &quot;A String&quot;, # A short description of the package
+    &quot;supplier&quot;: &quot;A String&quot;, # Identify the actual distribution source for the package/directory identified in the SPDX file
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full name of the package as given by the Package Originator
+    &quot;verificationCode&quot;: &quot;A String&quot;, # This field provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX file itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX file
+    &quot;version&quot;: &quot;A String&quot;, # Identify the version of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # A note describing a relationship between SPDX elements.
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this note was last updated. This field can be used as a filter in list requests.
   &quot;upgrade&quot;: { # An Upgrade Note represents a potential upgrade of a package to a given version. For each package version combination (i.e. bash 4.0, bash 4.1, bash 4.1.2), there will be a Upgrade Note. # A note describing an upgrade.
     &quot;distributions&quot;: [ # Metadata about the upgrade for each specific operating system.
@@ -359,7 +399,47 @@
       &quot;url&quot;: &quot;A String&quot;, # Specific URL to associate with the note
     },
   ],
+  &quot;sbom&quot;: { # DocumentNote represents an SPDX Document Creation Infromation section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # A note describing a software bill of materials.
+    &quot;dataLicence&quot;: &quot;A String&quot;, # Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (&quot;SPDX-Metadata&quot;)
+    &quot;spdxVersion&quot;: &quot;A String&quot;, # Provide a reference number that can be used to understand how to parse and interpret the rest of the file
+  },
   &quot;shortDescription&quot;: &quot;A String&quot;, # A one sentence description of this `Note`.
+  &quot;spdxFile&quot;: { # FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # A note describing an SPDX File.
+    &quot;checksum&quot;: [ # Provide a unique identifier to match analysis information on each specific file in a package
+      &quot;A String&quot;,
+    ],
+    &quot;fileType&quot;: &quot;A String&quot;, # This field provides information about the type of file identified
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full path and filename that corresponds to the file information in this section
+  },
+  &quot;spdxPackage&quot;: { # PackageNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # A note describing an SPDX Package.
+    &quot;analyzed&quot;: True or False, # Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document
+    &quot;attribution&quot;: &quot;A String&quot;, # A place for the SPDX data creator to record, at the package level, acknowledgements that may be needed to be communicated in some contexts
+    &quot;checksum&quot;: &quot;A String&quot;, # Provide an independently reproducible mechanism that permits unique identification of a specific package that correlates to the data in this SPDX file
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holders of the package, as well as any dates present
+    &quot;detailedDescription&quot;: &quot;A String&quot;, # A more detailed description of the package
+    &quot;downloadLocation&quot;: &quot;A String&quot;, # This section identifies the download Universal Resource Locator (URL), or a specific location within a version control system (VCS) for the package at the time that the SPDX file was created
+    &quot;externalRefs&quot;: [ # ExternalRef
+      { # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;category&quot;: &quot;A String&quot;, # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;comment&quot;: &quot;A String&quot;, # Human-readable information about the purpose and target of the reference
+        &quot;locator&quot;: &quot;A String&quot;, # The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location
+        &quot;type&quot;: &quot;A String&quot;, # Type of category (e.g. &#x27;npm&#x27; for the PACKAGE_MANAGER category)
+      },
+    ],
+    &quot;filesLicenseInfo&quot;: [ # Contain the license the SPDX file creator has concluded as governing the This field is to contain a list of all licenses found in the package. The relationship between licenses (i.e., conjunctive, disjunctive) is not specified in this field – it is simply a listing of all licenses found
+      &quot;A String&quot;,
+    ],
+    &quot;homePage&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record a web site that serves as the package&#x27;s home page
+    &quot;licenseDeclared&quot;: &quot;A String&quot;, # List the licenses that have been declared by the authors of the package
+    &quot;originator&quot;: &quot;A String&quot;, # If the package identified in the SPDX file originated from a different person or organization than identified as Package Supplier, this field identifies from where or whom the package originally came
+    &quot;summaryDescription&quot;: &quot;A String&quot;, # A short description of the package
+    &quot;supplier&quot;: &quot;A String&quot;, # Identify the actual distribution source for the package/directory identified in the SPDX file
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full name of the package as given by the Package Originator
+    &quot;verificationCode&quot;: &quot;A String&quot;, # This field provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX file itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX file
+    &quot;version&quot;: &quot;A String&quot;, # Identify the version of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # A note describing a relationship between SPDX elements.
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this note was last updated. This field can be used as a filter in list requests.
   &quot;upgrade&quot;: { # An Upgrade Note represents a potential upgrade of a package to a given version. For each package version combination (i.e. bash 4.0, bash 4.1, bash 4.1.2), there will be a Upgrade Note. # A note describing an upgrade.
     &quot;distributions&quot;: [ # Metadata about the upgrade for each specific operating system.
@@ -537,7 +617,47 @@
       &quot;url&quot;: &quot;A String&quot;, # Specific URL to associate with the note
     },
   ],
+  &quot;sbom&quot;: { # DocumentNote represents an SPDX Document Creation Infromation section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # A note describing a software bill of materials.
+    &quot;dataLicence&quot;: &quot;A String&quot;, # Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (&quot;SPDX-Metadata&quot;)
+    &quot;spdxVersion&quot;: &quot;A String&quot;, # Provide a reference number that can be used to understand how to parse and interpret the rest of the file
+  },
   &quot;shortDescription&quot;: &quot;A String&quot;, # A one sentence description of this `Note`.
+  &quot;spdxFile&quot;: { # FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # A note describing an SPDX File.
+    &quot;checksum&quot;: [ # Provide a unique identifier to match analysis information on each specific file in a package
+      &quot;A String&quot;,
+    ],
+    &quot;fileType&quot;: &quot;A String&quot;, # This field provides information about the type of file identified
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full path and filename that corresponds to the file information in this section
+  },
+  &quot;spdxPackage&quot;: { # PackageNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # A note describing an SPDX Package.
+    &quot;analyzed&quot;: True or False, # Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document
+    &quot;attribution&quot;: &quot;A String&quot;, # A place for the SPDX data creator to record, at the package level, acknowledgements that may be needed to be communicated in some contexts
+    &quot;checksum&quot;: &quot;A String&quot;, # Provide an independently reproducible mechanism that permits unique identification of a specific package that correlates to the data in this SPDX file
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holders of the package, as well as any dates present
+    &quot;detailedDescription&quot;: &quot;A String&quot;, # A more detailed description of the package
+    &quot;downloadLocation&quot;: &quot;A String&quot;, # This section identifies the download Universal Resource Locator (URL), or a specific location within a version control system (VCS) for the package at the time that the SPDX file was created
+    &quot;externalRefs&quot;: [ # ExternalRef
+      { # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;category&quot;: &quot;A String&quot;, # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;comment&quot;: &quot;A String&quot;, # Human-readable information about the purpose and target of the reference
+        &quot;locator&quot;: &quot;A String&quot;, # The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location
+        &quot;type&quot;: &quot;A String&quot;, # Type of category (e.g. &#x27;npm&#x27; for the PACKAGE_MANAGER category)
+      },
+    ],
+    &quot;filesLicenseInfo&quot;: [ # Contain the license the SPDX file creator has concluded as governing the This field is to contain a list of all licenses found in the package. The relationship between licenses (i.e., conjunctive, disjunctive) is not specified in this field – it is simply a listing of all licenses found
+      &quot;A String&quot;,
+    ],
+    &quot;homePage&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record a web site that serves as the package&#x27;s home page
+    &quot;licenseDeclared&quot;: &quot;A String&quot;, # List the licenses that have been declared by the authors of the package
+    &quot;originator&quot;: &quot;A String&quot;, # If the package identified in the SPDX file originated from a different person or organization than identified as Package Supplier, this field identifies from where or whom the package originally came
+    &quot;summaryDescription&quot;: &quot;A String&quot;, # A short description of the package
+    &quot;supplier&quot;: &quot;A String&quot;, # Identify the actual distribution source for the package/directory identified in the SPDX file
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full name of the package as given by the Package Originator
+    &quot;verificationCode&quot;: &quot;A String&quot;, # This field provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX file itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX file
+    &quot;version&quot;: &quot;A String&quot;, # Identify the version of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # A note describing a relationship between SPDX elements.
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this note was last updated. This field can be used as a filter in list requests.
   &quot;upgrade&quot;: { # An Upgrade Note represents a potential upgrade of a package to a given version. For each package version combination (i.e. bash 4.0, bash 4.1, bash 4.1.2), there will be a Upgrade Note. # A note describing an upgrade.
     &quot;distributions&quot;: [ # Metadata about the upgrade for each specific operating system.
@@ -747,7 +867,47 @@
           &quot;url&quot;: &quot;A String&quot;, # Specific URL to associate with the note
         },
       ],
+      &quot;sbom&quot;: { # DocumentNote represents an SPDX Document Creation Infromation section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # A note describing a software bill of materials.
+        &quot;dataLicence&quot;: &quot;A String&quot;, # Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (&quot;SPDX-Metadata&quot;)
+        &quot;spdxVersion&quot;: &quot;A String&quot;, # Provide a reference number that can be used to understand how to parse and interpret the rest of the file
+      },
       &quot;shortDescription&quot;: &quot;A String&quot;, # A one sentence description of this `Note`.
+      &quot;spdxFile&quot;: { # FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # A note describing an SPDX File.
+        &quot;checksum&quot;: [ # Provide a unique identifier to match analysis information on each specific file in a package
+          &quot;A String&quot;,
+        ],
+        &quot;fileType&quot;: &quot;A String&quot;, # This field provides information about the type of file identified
+        &quot;title&quot;: &quot;A String&quot;, # Identify the full path and filename that corresponds to the file information in this section
+      },
+      &quot;spdxPackage&quot;: { # PackageNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # A note describing an SPDX Package.
+        &quot;analyzed&quot;: True or False, # Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document
+        &quot;attribution&quot;: &quot;A String&quot;, # A place for the SPDX data creator to record, at the package level, acknowledgements that may be needed to be communicated in some contexts
+        &quot;checksum&quot;: &quot;A String&quot;, # Provide an independently reproducible mechanism that permits unique identification of a specific package that correlates to the data in this SPDX file
+        &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holders of the package, as well as any dates present
+        &quot;detailedDescription&quot;: &quot;A String&quot;, # A more detailed description of the package
+        &quot;downloadLocation&quot;: &quot;A String&quot;, # This section identifies the download Universal Resource Locator (URL), or a specific location within a version control system (VCS) for the package at the time that the SPDX file was created
+        &quot;externalRefs&quot;: [ # ExternalRef
+          { # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+            &quot;category&quot;: &quot;A String&quot;, # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+            &quot;comment&quot;: &quot;A String&quot;, # Human-readable information about the purpose and target of the reference
+            &quot;locator&quot;: &quot;A String&quot;, # The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location
+            &quot;type&quot;: &quot;A String&quot;, # Type of category (e.g. &#x27;npm&#x27; for the PACKAGE_MANAGER category)
+          },
+        ],
+        &quot;filesLicenseInfo&quot;: [ # Contain the license the SPDX file creator has concluded as governing the This field is to contain a list of all licenses found in the package. The relationship between licenses (i.e., conjunctive, disjunctive) is not specified in this field – it is simply a listing of all licenses found
+          &quot;A String&quot;,
+        ],
+        &quot;homePage&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record a web site that serves as the package&#x27;s home page
+        &quot;licenseDeclared&quot;: &quot;A String&quot;, # List the licenses that have been declared by the authors of the package
+        &quot;originator&quot;: &quot;A String&quot;, # If the package identified in the SPDX file originated from a different person or organization than identified as Package Supplier, this field identifies from where or whom the package originally came
+        &quot;summaryDescription&quot;: &quot;A String&quot;, # A short description of the package
+        &quot;supplier&quot;: &quot;A String&quot;, # Identify the actual distribution source for the package/directory identified in the SPDX file
+        &quot;title&quot;: &quot;A String&quot;, # Identify the full name of the package as given by the Package Originator
+        &quot;verificationCode&quot;: &quot;A String&quot;, # This field provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX file itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX file
+        &quot;version&quot;: &quot;A String&quot;, # Identify the version of the package
+      },
+      &quot;spdxRelationship&quot;: { # RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # A note describing a relationship between SPDX elements.
+      },
       &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this note was last updated. This field can be used as a filter in list requests.
       &quot;upgrade&quot;: { # An Upgrade Note represents a potential upgrade of a package to a given version. For each package version combination (i.e. bash 4.0, bash 4.1, bash 4.1.2), there will be a Upgrade Note. # A note describing an upgrade.
         &quot;distributions&quot;: [ # Metadata about the upgrade for each specific operating system.
@@ -918,7 +1078,47 @@
       &quot;url&quot;: &quot;A String&quot;, # Specific URL to associate with the note
     },
   ],
+  &quot;sbom&quot;: { # DocumentNote represents an SPDX Document Creation Infromation section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # A note describing a software bill of materials.
+    &quot;dataLicence&quot;: &quot;A String&quot;, # Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (&quot;SPDX-Metadata&quot;)
+    &quot;spdxVersion&quot;: &quot;A String&quot;, # Provide a reference number that can be used to understand how to parse and interpret the rest of the file
+  },
   &quot;shortDescription&quot;: &quot;A String&quot;, # A one sentence description of this `Note`.
+  &quot;spdxFile&quot;: { # FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # A note describing an SPDX File.
+    &quot;checksum&quot;: [ # Provide a unique identifier to match analysis information on each specific file in a package
+      &quot;A String&quot;,
+    ],
+    &quot;fileType&quot;: &quot;A String&quot;, # This field provides information about the type of file identified
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full path and filename that corresponds to the file information in this section
+  },
+  &quot;spdxPackage&quot;: { # PackageNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # A note describing an SPDX Package.
+    &quot;analyzed&quot;: True or False, # Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document
+    &quot;attribution&quot;: &quot;A String&quot;, # A place for the SPDX data creator to record, at the package level, acknowledgements that may be needed to be communicated in some contexts
+    &quot;checksum&quot;: &quot;A String&quot;, # Provide an independently reproducible mechanism that permits unique identification of a specific package that correlates to the data in this SPDX file
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holders of the package, as well as any dates present
+    &quot;detailedDescription&quot;: &quot;A String&quot;, # A more detailed description of the package
+    &quot;downloadLocation&quot;: &quot;A String&quot;, # This section identifies the download Universal Resource Locator (URL), or a specific location within a version control system (VCS) for the package at the time that the SPDX file was created
+    &quot;externalRefs&quot;: [ # ExternalRef
+      { # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;category&quot;: &quot;A String&quot;, # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;comment&quot;: &quot;A String&quot;, # Human-readable information about the purpose and target of the reference
+        &quot;locator&quot;: &quot;A String&quot;, # The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location
+        &quot;type&quot;: &quot;A String&quot;, # Type of category (e.g. &#x27;npm&#x27; for the PACKAGE_MANAGER category)
+      },
+    ],
+    &quot;filesLicenseInfo&quot;: [ # Contain the license the SPDX file creator has concluded as governing the This field is to contain a list of all licenses found in the package. The relationship between licenses (i.e., conjunctive, disjunctive) is not specified in this field – it is simply a listing of all licenses found
+      &quot;A String&quot;,
+    ],
+    &quot;homePage&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record a web site that serves as the package&#x27;s home page
+    &quot;licenseDeclared&quot;: &quot;A String&quot;, # List the licenses that have been declared by the authors of the package
+    &quot;originator&quot;: &quot;A String&quot;, # If the package identified in the SPDX file originated from a different person or organization than identified as Package Supplier, this field identifies from where or whom the package originally came
+    &quot;summaryDescription&quot;: &quot;A String&quot;, # A short description of the package
+    &quot;supplier&quot;: &quot;A String&quot;, # Identify the actual distribution source for the package/directory identified in the SPDX file
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full name of the package as given by the Package Originator
+    &quot;verificationCode&quot;: &quot;A String&quot;, # This field provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX file itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX file
+    &quot;version&quot;: &quot;A String&quot;, # Identify the version of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # A note describing a relationship between SPDX elements.
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this note was last updated. This field can be used as a filter in list requests.
   &quot;upgrade&quot;: { # An Upgrade Note represents a potential upgrade of a package to a given version. For each package version combination (i.e. bash 4.0, bash 4.1, bash 4.1.2), there will be a Upgrade Note. # A note describing an upgrade.
     &quot;distributions&quot;: [ # Metadata about the upgrade for each specific operating system.
@@ -1072,7 +1272,47 @@
       &quot;url&quot;: &quot;A String&quot;, # Specific URL to associate with the note
     },
   ],
+  &quot;sbom&quot;: { # DocumentNote represents an SPDX Document Creation Infromation section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # A note describing a software bill of materials.
+    &quot;dataLicence&quot;: &quot;A String&quot;, # Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (&quot;SPDX-Metadata&quot;)
+    &quot;spdxVersion&quot;: &quot;A String&quot;, # Provide a reference number that can be used to understand how to parse and interpret the rest of the file
+  },
   &quot;shortDescription&quot;: &quot;A String&quot;, # A one sentence description of this `Note`.
+  &quot;spdxFile&quot;: { # FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # A note describing an SPDX File.
+    &quot;checksum&quot;: [ # Provide a unique identifier to match analysis information on each specific file in a package
+      &quot;A String&quot;,
+    ],
+    &quot;fileType&quot;: &quot;A String&quot;, # This field provides information about the type of file identified
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full path and filename that corresponds to the file information in this section
+  },
+  &quot;spdxPackage&quot;: { # PackageNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # A note describing an SPDX Package.
+    &quot;analyzed&quot;: True or False, # Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document
+    &quot;attribution&quot;: &quot;A String&quot;, # A place for the SPDX data creator to record, at the package level, acknowledgements that may be needed to be communicated in some contexts
+    &quot;checksum&quot;: &quot;A String&quot;, # Provide an independently reproducible mechanism that permits unique identification of a specific package that correlates to the data in this SPDX file
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holders of the package, as well as any dates present
+    &quot;detailedDescription&quot;: &quot;A String&quot;, # A more detailed description of the package
+    &quot;downloadLocation&quot;: &quot;A String&quot;, # This section identifies the download Universal Resource Locator (URL), or a specific location within a version control system (VCS) for the package at the time that the SPDX file was created
+    &quot;externalRefs&quot;: [ # ExternalRef
+      { # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;category&quot;: &quot;A String&quot;, # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;comment&quot;: &quot;A String&quot;, # Human-readable information about the purpose and target of the reference
+        &quot;locator&quot;: &quot;A String&quot;, # The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location
+        &quot;type&quot;: &quot;A String&quot;, # Type of category (e.g. &#x27;npm&#x27; for the PACKAGE_MANAGER category)
+      },
+    ],
+    &quot;filesLicenseInfo&quot;: [ # Contain the license the SPDX file creator has concluded as governing the This field is to contain a list of all licenses found in the package. The relationship between licenses (i.e., conjunctive, disjunctive) is not specified in this field – it is simply a listing of all licenses found
+      &quot;A String&quot;,
+    ],
+    &quot;homePage&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record a web site that serves as the package&#x27;s home page
+    &quot;licenseDeclared&quot;: &quot;A String&quot;, # List the licenses that have been declared by the authors of the package
+    &quot;originator&quot;: &quot;A String&quot;, # If the package identified in the SPDX file originated from a different person or organization than identified as Package Supplier, this field identifies from where or whom the package originally came
+    &quot;summaryDescription&quot;: &quot;A String&quot;, # A short description of the package
+    &quot;supplier&quot;: &quot;A String&quot;, # Identify the actual distribution source for the package/directory identified in the SPDX file
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full name of the package as given by the Package Originator
+    &quot;verificationCode&quot;: &quot;A String&quot;, # This field provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX file itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX file
+    &quot;version&quot;: &quot;A String&quot;, # Identify the version of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # A note describing a relationship between SPDX elements.
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this note was last updated. This field can be used as a filter in list requests.
   &quot;upgrade&quot;: { # An Upgrade Note represents a potential upgrade of a package to a given version. For each package version combination (i.e. bash 4.0, bash 4.1, bash 4.1.2), there will be a Upgrade Note. # A note describing an upgrade.
     &quot;distributions&quot;: [ # Metadata about the upgrade for each specific operating system.
diff --git a/docs/dyn/containeranalysis_v1alpha1.providers.notes.occurrences.html b/docs/dyn/containeranalysis_v1alpha1.providers.notes.occurrences.html
index f59bd12..0fb9949 100644
--- a/docs/dyn/containeranalysis_v1alpha1.providers.notes.occurrences.html
+++ b/docs/dyn/containeranalysis_v1alpha1.providers.notes.occurrences.html
@@ -356,6 +356,52 @@
         &quot;uri&quot;: &quot;A String&quot;, # The unique URI of the resource. E.g., &quot;https://gcr.io/project/image@sha256:foo&quot; for a Docker image.
       },
       &quot;resourceUrl&quot;: &quot;A String&quot;, # The unique URL of the image or the container for which the `Occurrence` applies. For example, https://gcr.io/project/image@sha256:foo This field can be used as a filter in list requests.
+      &quot;sbom&quot;: { # DocumentOccurrence represents an SPDX Document Creation Information section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # Describes a specific software bill of materials document.
+        &quot;createTime&quot;: &quot;A String&quot;, # Identify when the SPDX file was originally created. The date is to be specified according to combined date and time in UTC format as specified in ISO 8601 standard
+        &quot;creatorComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide general comments about the creation of the SPDX file or any other relevant comment not included in the other fields
+        &quot;creators&quot;: [ # Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an individual, indicate the person&#x27;s name
+          &quot;A String&quot;,
+        ],
+        &quot;documentComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file content to provide comments to the consumers of the SPDX document
+        &quot;externalDocumentRefs&quot;: [ # Identify any external SPDX documents referenced within this SPDX document
+          &quot;A String&quot;,
+        ],
+        &quot;id&quot;: &quot;A String&quot;, # Identify the current SPDX document which may be referenced in relationships by other files, packages internally and documents externally
+        &quot;licenseListVersion&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created
+        &quot;namespace&quot;: &quot;A String&quot;, # Provide an SPDX document specific namespace as a unique absolute Uniform Resource Identifier (URI) as specified in RFC-3986, with the exception of the ‘#’ delimiter
+        &quot;title&quot;: &quot;A String&quot;, # Identify name of this document as designated by creator
+      },
+      &quot;spdxFile&quot;: { # FileOccurrence represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # Describes a specific SPDX File.
+        &quot;attributions&quot;: [ # This field provides a place for the SPDX data creator to record, at the file level, acknowledgements that may be needed to be communicated in some contexts
+          &quot;A String&quot;,
+        ],
+        &quot;comment&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any general comments about the file
+        &quot;contributors&quot;: [ # This field provides a place for the SPDX file creator to record file contributors
+          &quot;A String&quot;,
+        ],
+        &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holder of the file, as well as any dates present
+        &quot;filesLicenseInfo&quot;: [ # This field contains the license information actually found in the file, if any
+          &quot;A String&quot;,
+        ],
+        &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+        &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background references or analysis that went in to arriving at the Concluded License for a file
+        &quot;licenseConcluded&quot;: &quot;A String&quot;, # This field contains the license the SPDX file creator has concluded as governing the file or alternative values if the governing license cannot be determined
+        &quot;notice&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record license notices or other such related notices found in the file
+      },
+      &quot;spdxPackage&quot;: { # PackageOccurrence represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # Describes a specific SPDX Package.
+        &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the package being described
+        &quot;filename&quot;: &quot;A String&quot;, # Provide the actual file name of the package, or path of the directory being treated as a package
+        &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+        &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background information or analysis that went in to arriving at the Concluded License for a package
+        &quot;licenseConcluded&quot;: &quot;A String&quot;, # package or alternative values, if the governing license cannot be determined
+        &quot;sourceInfo&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record any relevant background information or additional comments about the origin of the package
+      },
+      &quot;spdxRelationship&quot;: { # RelationshipOccurrence represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # Describes a specific relationship between SPDX elements.
+        &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the relationship
+        &quot;source&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-A The source SPDX element (file, package, etc)
+        &quot;target&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-B The target SPDC element (file, package, etc) In cases where there are &quot;known unknowns&quot;, the use of the keyword NOASSERTION can be used The keywords NONE can be used to indicate that an SPDX element (package/file/snippet) has no other elements connected by some relationship to it
+        &quot;type&quot;: &quot;A String&quot;, # The type of relationship between the source and target SPDX elements
+      },
       &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this `Occurrence` was last updated.
       &quot;upgrade&quot;: { # An Upgrade Occurrence represents that a specific resource_url could install a specific upgrade. This presence is supplied via local sources (i.e. it is present in the mirror and the running system has noticed its availability). # Describes an upgrade.
         &quot;distribution&quot;: { # The Upgrade Distribution represents metadata about the Upgrade for each operating system (CPE). Some distributions have additional metadata around updates, classifying them into various categories and severities. # Metadata about the upgrade for available for the specific operating system for the resource_url. This allows efficient filtering, as well as making it easier to use the occurrence.
diff --git a/docs/dyn/containeranalysis_v1beta1.projects.notes.html b/docs/dyn/containeranalysis_v1beta1.projects.notes.html
index 7ae8d50..531a510 100644
--- a/docs/dyn/containeranalysis_v1beta1.projects.notes.html
+++ b/docs/dyn/containeranalysis_v1beta1.projects.notes.html
@@ -219,7 +219,47 @@
           &quot;url&quot;: &quot;A String&quot;, # Specific URL associated with the resource.
         },
       ],
+      &quot;sbom&quot;: { # DocumentNote represents an SPDX Document Creation Infromation section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # A note describing SPDX Document which represents SBOM.
+        &quot;dataLicence&quot;: &quot;A String&quot;, # Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (&quot;SPDX-Metadata&quot;)
+        &quot;spdxVersion&quot;: &quot;A String&quot;, # Provide a reference number that can be used to understand how to parse and interpret the rest of the file
+      },
       &quot;shortDescription&quot;: &quot;A String&quot;, # A one sentence description of this note.
+      &quot;spdxFile&quot;: { # FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # A note describing SPDX File.
+        &quot;checksum&quot;: [ # Provide a unique identifier to match analysis information on each specific file in a package
+          &quot;A String&quot;,
+        ],
+        &quot;fileType&quot;: &quot;A String&quot;, # This field provides information about the type of file identified
+        &quot;title&quot;: &quot;A String&quot;, # Identify the full path and filename that corresponds to the file information in this section
+      },
+      &quot;spdxPackage&quot;: { # PackageNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # A note describing SPDX Package.
+        &quot;analyzed&quot;: True or False, # Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document
+        &quot;attribution&quot;: &quot;A String&quot;, # A place for the SPDX data creator to record, at the package level, acknowledgements that may be needed to be communicated in some contexts
+        &quot;checksum&quot;: &quot;A String&quot;, # Provide an independently reproducible mechanism that permits unique identification of a specific package that correlates to the data in this SPDX file
+        &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holders of the package, as well as any dates present
+        &quot;detailedDescription&quot;: &quot;A String&quot;, # A more detailed description of the package
+        &quot;downloadLocation&quot;: &quot;A String&quot;, # This section identifies the download Universal Resource Locator (URL), or a specific location within a version control system (VCS) for the package at the time that the SPDX file was created
+        &quot;externalRefs&quot;: [ # ExternalRef
+          { # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+            &quot;category&quot;: &quot;A String&quot;, # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+            &quot;comment&quot;: &quot;A String&quot;, # Human-readable information about the purpose and target of the reference
+            &quot;locator&quot;: &quot;A String&quot;, # The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location
+            &quot;type&quot;: &quot;A String&quot;, # Type of category (e.g. &#x27;npm&#x27; for the PACKAGE_MANAGER category)
+          },
+        ],
+        &quot;filesLicenseInfo&quot;: [ # Contain the license the SPDX file creator has concluded as governing the This field is to contain a list of all licenses found in the package. The relationship between licenses (i.e., conjunctive, disjunctive) is not specified in this field – it is simply a listing of all licenses found
+          &quot;A String&quot;,
+        ],
+        &quot;homePage&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record a web site that serves as the package&#x27;s home page
+        &quot;licenseDeclared&quot;: &quot;A String&quot;, # List the licenses that have been declared by the authors of the package
+        &quot;originator&quot;: &quot;A String&quot;, # If the package identified in the SPDX file originated from a different person or organization than identified as Package Supplier, this field identifies from where or whom the package originally came
+        &quot;summaryDescription&quot;: &quot;A String&quot;, # A short description of the package
+        &quot;supplier&quot;: &quot;A String&quot;, # Identify the actual distribution source for the package/directory identified in the SPDX file
+        &quot;title&quot;: &quot;A String&quot;, # Identify the full name of the package as given by the Package Originator
+        &quot;verificationCode&quot;: &quot;A String&quot;, # This field provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX file itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX file
+        &quot;version&quot;: &quot;A String&quot;, # Identify the version of the package
+      },
+      &quot;spdxRelationship&quot;: { # RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # A note describing SPDX Relationship.
+      },
       &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this note was last updated. This field can be used as a filter in list requests.
       &quot;vulnerability&quot;: { # Vulnerability provides metadata about a security vulnerability in a Note. # A note describing a package vulnerability.
         &quot;cvssScore&quot;: 3.14, # The CVSS score for this vulnerability.
@@ -399,7 +439,47 @@
           &quot;url&quot;: &quot;A String&quot;, # Specific URL associated with the resource.
         },
       ],
+      &quot;sbom&quot;: { # DocumentNote represents an SPDX Document Creation Infromation section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # A note describing SPDX Document which represents SBOM.
+        &quot;dataLicence&quot;: &quot;A String&quot;, # Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (&quot;SPDX-Metadata&quot;)
+        &quot;spdxVersion&quot;: &quot;A String&quot;, # Provide a reference number that can be used to understand how to parse and interpret the rest of the file
+      },
       &quot;shortDescription&quot;: &quot;A String&quot;, # A one sentence description of this note.
+      &quot;spdxFile&quot;: { # FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # A note describing SPDX File.
+        &quot;checksum&quot;: [ # Provide a unique identifier to match analysis information on each specific file in a package
+          &quot;A String&quot;,
+        ],
+        &quot;fileType&quot;: &quot;A String&quot;, # This field provides information about the type of file identified
+        &quot;title&quot;: &quot;A String&quot;, # Identify the full path and filename that corresponds to the file information in this section
+      },
+      &quot;spdxPackage&quot;: { # PackageNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # A note describing SPDX Package.
+        &quot;analyzed&quot;: True or False, # Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document
+        &quot;attribution&quot;: &quot;A String&quot;, # A place for the SPDX data creator to record, at the package level, acknowledgements that may be needed to be communicated in some contexts
+        &quot;checksum&quot;: &quot;A String&quot;, # Provide an independently reproducible mechanism that permits unique identification of a specific package that correlates to the data in this SPDX file
+        &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holders of the package, as well as any dates present
+        &quot;detailedDescription&quot;: &quot;A String&quot;, # A more detailed description of the package
+        &quot;downloadLocation&quot;: &quot;A String&quot;, # This section identifies the download Universal Resource Locator (URL), or a specific location within a version control system (VCS) for the package at the time that the SPDX file was created
+        &quot;externalRefs&quot;: [ # ExternalRef
+          { # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+            &quot;category&quot;: &quot;A String&quot;, # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+            &quot;comment&quot;: &quot;A String&quot;, # Human-readable information about the purpose and target of the reference
+            &quot;locator&quot;: &quot;A String&quot;, # The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location
+            &quot;type&quot;: &quot;A String&quot;, # Type of category (e.g. &#x27;npm&#x27; for the PACKAGE_MANAGER category)
+          },
+        ],
+        &quot;filesLicenseInfo&quot;: [ # Contain the license the SPDX file creator has concluded as governing the This field is to contain a list of all licenses found in the package. The relationship between licenses (i.e., conjunctive, disjunctive) is not specified in this field – it is simply a listing of all licenses found
+          &quot;A String&quot;,
+        ],
+        &quot;homePage&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record a web site that serves as the package&#x27;s home page
+        &quot;licenseDeclared&quot;: &quot;A String&quot;, # List the licenses that have been declared by the authors of the package
+        &quot;originator&quot;: &quot;A String&quot;, # If the package identified in the SPDX file originated from a different person or organization than identified as Package Supplier, this field identifies from where or whom the package originally came
+        &quot;summaryDescription&quot;: &quot;A String&quot;, # A short description of the package
+        &quot;supplier&quot;: &quot;A String&quot;, # Identify the actual distribution source for the package/directory identified in the SPDX file
+        &quot;title&quot;: &quot;A String&quot;, # Identify the full name of the package as given by the Package Originator
+        &quot;verificationCode&quot;: &quot;A String&quot;, # This field provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX file itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX file
+        &quot;version&quot;: &quot;A String&quot;, # Identify the version of the package
+      },
+      &quot;spdxRelationship&quot;: { # RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # A note describing SPDX Relationship.
+      },
       &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this note was last updated. This field can be used as a filter in list requests.
       &quot;vulnerability&quot;: { # Vulnerability provides metadata about a security vulnerability in a Note. # A note describing a package vulnerability.
         &quot;cvssScore&quot;: 3.14, # The CVSS score for this vulnerability.
@@ -584,7 +664,47 @@
       &quot;url&quot;: &quot;A String&quot;, # Specific URL associated with the resource.
     },
   ],
+  &quot;sbom&quot;: { # DocumentNote represents an SPDX Document Creation Infromation section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # A note describing SPDX Document which represents SBOM.
+    &quot;dataLicence&quot;: &quot;A String&quot;, # Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (&quot;SPDX-Metadata&quot;)
+    &quot;spdxVersion&quot;: &quot;A String&quot;, # Provide a reference number that can be used to understand how to parse and interpret the rest of the file
+  },
   &quot;shortDescription&quot;: &quot;A String&quot;, # A one sentence description of this note.
+  &quot;spdxFile&quot;: { # FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # A note describing SPDX File.
+    &quot;checksum&quot;: [ # Provide a unique identifier to match analysis information on each specific file in a package
+      &quot;A String&quot;,
+    ],
+    &quot;fileType&quot;: &quot;A String&quot;, # This field provides information about the type of file identified
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full path and filename that corresponds to the file information in this section
+  },
+  &quot;spdxPackage&quot;: { # PackageNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # A note describing SPDX Package.
+    &quot;analyzed&quot;: True or False, # Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document
+    &quot;attribution&quot;: &quot;A String&quot;, # A place for the SPDX data creator to record, at the package level, acknowledgements that may be needed to be communicated in some contexts
+    &quot;checksum&quot;: &quot;A String&quot;, # Provide an independently reproducible mechanism that permits unique identification of a specific package that correlates to the data in this SPDX file
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holders of the package, as well as any dates present
+    &quot;detailedDescription&quot;: &quot;A String&quot;, # A more detailed description of the package
+    &quot;downloadLocation&quot;: &quot;A String&quot;, # This section identifies the download Universal Resource Locator (URL), or a specific location within a version control system (VCS) for the package at the time that the SPDX file was created
+    &quot;externalRefs&quot;: [ # ExternalRef
+      { # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;category&quot;: &quot;A String&quot;, # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;comment&quot;: &quot;A String&quot;, # Human-readable information about the purpose and target of the reference
+        &quot;locator&quot;: &quot;A String&quot;, # The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location
+        &quot;type&quot;: &quot;A String&quot;, # Type of category (e.g. &#x27;npm&#x27; for the PACKAGE_MANAGER category)
+      },
+    ],
+    &quot;filesLicenseInfo&quot;: [ # Contain the license the SPDX file creator has concluded as governing the This field is to contain a list of all licenses found in the package. The relationship between licenses (i.e., conjunctive, disjunctive) is not specified in this field – it is simply a listing of all licenses found
+      &quot;A String&quot;,
+    ],
+    &quot;homePage&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record a web site that serves as the package&#x27;s home page
+    &quot;licenseDeclared&quot;: &quot;A String&quot;, # List the licenses that have been declared by the authors of the package
+    &quot;originator&quot;: &quot;A String&quot;, # If the package identified in the SPDX file originated from a different person or organization than identified as Package Supplier, this field identifies from where or whom the package originally came
+    &quot;summaryDescription&quot;: &quot;A String&quot;, # A short description of the package
+    &quot;supplier&quot;: &quot;A String&quot;, # Identify the actual distribution source for the package/directory identified in the SPDX file
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full name of the package as given by the Package Originator
+    &quot;verificationCode&quot;: &quot;A String&quot;, # This field provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX file itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX file
+    &quot;version&quot;: &quot;A String&quot;, # Identify the version of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # A note describing SPDX Relationship.
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this note was last updated. This field can be used as a filter in list requests.
   &quot;vulnerability&quot;: { # Vulnerability provides metadata about a security vulnerability in a Note. # A note describing a package vulnerability.
     &quot;cvssScore&quot;: 3.14, # The CVSS score for this vulnerability.
@@ -761,7 +881,47 @@
       &quot;url&quot;: &quot;A String&quot;, # Specific URL associated with the resource.
     },
   ],
+  &quot;sbom&quot;: { # DocumentNote represents an SPDX Document Creation Infromation section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # A note describing SPDX Document which represents SBOM.
+    &quot;dataLicence&quot;: &quot;A String&quot;, # Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (&quot;SPDX-Metadata&quot;)
+    &quot;spdxVersion&quot;: &quot;A String&quot;, # Provide a reference number that can be used to understand how to parse and interpret the rest of the file
+  },
   &quot;shortDescription&quot;: &quot;A String&quot;, # A one sentence description of this note.
+  &quot;spdxFile&quot;: { # FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # A note describing SPDX File.
+    &quot;checksum&quot;: [ # Provide a unique identifier to match analysis information on each specific file in a package
+      &quot;A String&quot;,
+    ],
+    &quot;fileType&quot;: &quot;A String&quot;, # This field provides information about the type of file identified
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full path and filename that corresponds to the file information in this section
+  },
+  &quot;spdxPackage&quot;: { # PackageNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # A note describing SPDX Package.
+    &quot;analyzed&quot;: True or False, # Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document
+    &quot;attribution&quot;: &quot;A String&quot;, # A place for the SPDX data creator to record, at the package level, acknowledgements that may be needed to be communicated in some contexts
+    &quot;checksum&quot;: &quot;A String&quot;, # Provide an independently reproducible mechanism that permits unique identification of a specific package that correlates to the data in this SPDX file
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holders of the package, as well as any dates present
+    &quot;detailedDescription&quot;: &quot;A String&quot;, # A more detailed description of the package
+    &quot;downloadLocation&quot;: &quot;A String&quot;, # This section identifies the download Universal Resource Locator (URL), or a specific location within a version control system (VCS) for the package at the time that the SPDX file was created
+    &quot;externalRefs&quot;: [ # ExternalRef
+      { # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;category&quot;: &quot;A String&quot;, # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;comment&quot;: &quot;A String&quot;, # Human-readable information about the purpose and target of the reference
+        &quot;locator&quot;: &quot;A String&quot;, # The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location
+        &quot;type&quot;: &quot;A String&quot;, # Type of category (e.g. &#x27;npm&#x27; for the PACKAGE_MANAGER category)
+      },
+    ],
+    &quot;filesLicenseInfo&quot;: [ # Contain the license the SPDX file creator has concluded as governing the This field is to contain a list of all licenses found in the package. The relationship between licenses (i.e., conjunctive, disjunctive) is not specified in this field – it is simply a listing of all licenses found
+      &quot;A String&quot;,
+    ],
+    &quot;homePage&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record a web site that serves as the package&#x27;s home page
+    &quot;licenseDeclared&quot;: &quot;A String&quot;, # List the licenses that have been declared by the authors of the package
+    &quot;originator&quot;: &quot;A String&quot;, # If the package identified in the SPDX file originated from a different person or organization than identified as Package Supplier, this field identifies from where or whom the package originally came
+    &quot;summaryDescription&quot;: &quot;A String&quot;, # A short description of the package
+    &quot;supplier&quot;: &quot;A String&quot;, # Identify the actual distribution source for the package/directory identified in the SPDX file
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full name of the package as given by the Package Originator
+    &quot;verificationCode&quot;: &quot;A String&quot;, # This field provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX file itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX file
+    &quot;version&quot;: &quot;A String&quot;, # Identify the version of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # A note describing SPDX Relationship.
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this note was last updated. This field can be used as a filter in list requests.
   &quot;vulnerability&quot;: { # Vulnerability provides metadata about a security vulnerability in a Note. # A note describing a package vulnerability.
     &quot;cvssScore&quot;: 3.14, # The CVSS score for this vulnerability.
@@ -962,7 +1122,47 @@
       &quot;url&quot;: &quot;A String&quot;, # Specific URL associated with the resource.
     },
   ],
+  &quot;sbom&quot;: { # DocumentNote represents an SPDX Document Creation Infromation section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # A note describing SPDX Document which represents SBOM.
+    &quot;dataLicence&quot;: &quot;A String&quot;, # Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (&quot;SPDX-Metadata&quot;)
+    &quot;spdxVersion&quot;: &quot;A String&quot;, # Provide a reference number that can be used to understand how to parse and interpret the rest of the file
+  },
   &quot;shortDescription&quot;: &quot;A String&quot;, # A one sentence description of this note.
+  &quot;spdxFile&quot;: { # FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # A note describing SPDX File.
+    &quot;checksum&quot;: [ # Provide a unique identifier to match analysis information on each specific file in a package
+      &quot;A String&quot;,
+    ],
+    &quot;fileType&quot;: &quot;A String&quot;, # This field provides information about the type of file identified
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full path and filename that corresponds to the file information in this section
+  },
+  &quot;spdxPackage&quot;: { # PackageNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # A note describing SPDX Package.
+    &quot;analyzed&quot;: True or False, # Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document
+    &quot;attribution&quot;: &quot;A String&quot;, # A place for the SPDX data creator to record, at the package level, acknowledgements that may be needed to be communicated in some contexts
+    &quot;checksum&quot;: &quot;A String&quot;, # Provide an independently reproducible mechanism that permits unique identification of a specific package that correlates to the data in this SPDX file
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holders of the package, as well as any dates present
+    &quot;detailedDescription&quot;: &quot;A String&quot;, # A more detailed description of the package
+    &quot;downloadLocation&quot;: &quot;A String&quot;, # This section identifies the download Universal Resource Locator (URL), or a specific location within a version control system (VCS) for the package at the time that the SPDX file was created
+    &quot;externalRefs&quot;: [ # ExternalRef
+      { # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;category&quot;: &quot;A String&quot;, # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;comment&quot;: &quot;A String&quot;, # Human-readable information about the purpose and target of the reference
+        &quot;locator&quot;: &quot;A String&quot;, # The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location
+        &quot;type&quot;: &quot;A String&quot;, # Type of category (e.g. &#x27;npm&#x27; for the PACKAGE_MANAGER category)
+      },
+    ],
+    &quot;filesLicenseInfo&quot;: [ # Contain the license the SPDX file creator has concluded as governing the This field is to contain a list of all licenses found in the package. The relationship between licenses (i.e., conjunctive, disjunctive) is not specified in this field – it is simply a listing of all licenses found
+      &quot;A String&quot;,
+    ],
+    &quot;homePage&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record a web site that serves as the package&#x27;s home page
+    &quot;licenseDeclared&quot;: &quot;A String&quot;, # List the licenses that have been declared by the authors of the package
+    &quot;originator&quot;: &quot;A String&quot;, # If the package identified in the SPDX file originated from a different person or organization than identified as Package Supplier, this field identifies from where or whom the package originally came
+    &quot;summaryDescription&quot;: &quot;A String&quot;, # A short description of the package
+    &quot;supplier&quot;: &quot;A String&quot;, # Identify the actual distribution source for the package/directory identified in the SPDX file
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full name of the package as given by the Package Originator
+    &quot;verificationCode&quot;: &quot;A String&quot;, # This field provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX file itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX file
+    &quot;version&quot;: &quot;A String&quot;, # Identify the version of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # A note describing SPDX Relationship.
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this note was last updated. This field can be used as a filter in list requests.
   &quot;vulnerability&quot;: { # Vulnerability provides metadata about a security vulnerability in a Note. # A note describing a package vulnerability.
     &quot;cvssScore&quot;: 3.14, # The CVSS score for this vulnerability.
@@ -1194,7 +1394,47 @@
           &quot;url&quot;: &quot;A String&quot;, # Specific URL associated with the resource.
         },
       ],
+      &quot;sbom&quot;: { # DocumentNote represents an SPDX Document Creation Infromation section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # A note describing SPDX Document which represents SBOM.
+        &quot;dataLicence&quot;: &quot;A String&quot;, # Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (&quot;SPDX-Metadata&quot;)
+        &quot;spdxVersion&quot;: &quot;A String&quot;, # Provide a reference number that can be used to understand how to parse and interpret the rest of the file
+      },
       &quot;shortDescription&quot;: &quot;A String&quot;, # A one sentence description of this note.
+      &quot;spdxFile&quot;: { # FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # A note describing SPDX File.
+        &quot;checksum&quot;: [ # Provide a unique identifier to match analysis information on each specific file in a package
+          &quot;A String&quot;,
+        ],
+        &quot;fileType&quot;: &quot;A String&quot;, # This field provides information about the type of file identified
+        &quot;title&quot;: &quot;A String&quot;, # Identify the full path and filename that corresponds to the file information in this section
+      },
+      &quot;spdxPackage&quot;: { # PackageNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # A note describing SPDX Package.
+        &quot;analyzed&quot;: True or False, # Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document
+        &quot;attribution&quot;: &quot;A String&quot;, # A place for the SPDX data creator to record, at the package level, acknowledgements that may be needed to be communicated in some contexts
+        &quot;checksum&quot;: &quot;A String&quot;, # Provide an independently reproducible mechanism that permits unique identification of a specific package that correlates to the data in this SPDX file
+        &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holders of the package, as well as any dates present
+        &quot;detailedDescription&quot;: &quot;A String&quot;, # A more detailed description of the package
+        &quot;downloadLocation&quot;: &quot;A String&quot;, # This section identifies the download Universal Resource Locator (URL), or a specific location within a version control system (VCS) for the package at the time that the SPDX file was created
+        &quot;externalRefs&quot;: [ # ExternalRef
+          { # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+            &quot;category&quot;: &quot;A String&quot;, # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+            &quot;comment&quot;: &quot;A String&quot;, # Human-readable information about the purpose and target of the reference
+            &quot;locator&quot;: &quot;A String&quot;, # The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location
+            &quot;type&quot;: &quot;A String&quot;, # Type of category (e.g. &#x27;npm&#x27; for the PACKAGE_MANAGER category)
+          },
+        ],
+        &quot;filesLicenseInfo&quot;: [ # Contain the license the SPDX file creator has concluded as governing the This field is to contain a list of all licenses found in the package. The relationship between licenses (i.e., conjunctive, disjunctive) is not specified in this field – it is simply a listing of all licenses found
+          &quot;A String&quot;,
+        ],
+        &quot;homePage&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record a web site that serves as the package&#x27;s home page
+        &quot;licenseDeclared&quot;: &quot;A String&quot;, # List the licenses that have been declared by the authors of the package
+        &quot;originator&quot;: &quot;A String&quot;, # If the package identified in the SPDX file originated from a different person or organization than identified as Package Supplier, this field identifies from where or whom the package originally came
+        &quot;summaryDescription&quot;: &quot;A String&quot;, # A short description of the package
+        &quot;supplier&quot;: &quot;A String&quot;, # Identify the actual distribution source for the package/directory identified in the SPDX file
+        &quot;title&quot;: &quot;A String&quot;, # Identify the full name of the package as given by the Package Originator
+        &quot;verificationCode&quot;: &quot;A String&quot;, # This field provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX file itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX file
+        &quot;version&quot;: &quot;A String&quot;, # Identify the version of the package
+      },
+      &quot;spdxRelationship&quot;: { # RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # A note describing SPDX Relationship.
+      },
       &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this note was last updated. This field can be used as a filter in list requests.
       &quot;vulnerability&quot;: { # Vulnerability provides metadata about a security vulnerability in a Note. # A note describing a package vulnerability.
         &quot;cvssScore&quot;: 3.14, # The CVSS score for this vulnerability.
@@ -1388,7 +1628,47 @@
       &quot;url&quot;: &quot;A String&quot;, # Specific URL associated with the resource.
     },
   ],
+  &quot;sbom&quot;: { # DocumentNote represents an SPDX Document Creation Infromation section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # A note describing SPDX Document which represents SBOM.
+    &quot;dataLicence&quot;: &quot;A String&quot;, # Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (&quot;SPDX-Metadata&quot;)
+    &quot;spdxVersion&quot;: &quot;A String&quot;, # Provide a reference number that can be used to understand how to parse and interpret the rest of the file
+  },
   &quot;shortDescription&quot;: &quot;A String&quot;, # A one sentence description of this note.
+  &quot;spdxFile&quot;: { # FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # A note describing SPDX File.
+    &quot;checksum&quot;: [ # Provide a unique identifier to match analysis information on each specific file in a package
+      &quot;A String&quot;,
+    ],
+    &quot;fileType&quot;: &quot;A String&quot;, # This field provides information about the type of file identified
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full path and filename that corresponds to the file information in this section
+  },
+  &quot;spdxPackage&quot;: { # PackageNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # A note describing SPDX Package.
+    &quot;analyzed&quot;: True or False, # Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document
+    &quot;attribution&quot;: &quot;A String&quot;, # A place for the SPDX data creator to record, at the package level, acknowledgements that may be needed to be communicated in some contexts
+    &quot;checksum&quot;: &quot;A String&quot;, # Provide an independently reproducible mechanism that permits unique identification of a specific package that correlates to the data in this SPDX file
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holders of the package, as well as any dates present
+    &quot;detailedDescription&quot;: &quot;A String&quot;, # A more detailed description of the package
+    &quot;downloadLocation&quot;: &quot;A String&quot;, # This section identifies the download Universal Resource Locator (URL), or a specific location within a version control system (VCS) for the package at the time that the SPDX file was created
+    &quot;externalRefs&quot;: [ # ExternalRef
+      { # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;category&quot;: &quot;A String&quot;, # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;comment&quot;: &quot;A String&quot;, # Human-readable information about the purpose and target of the reference
+        &quot;locator&quot;: &quot;A String&quot;, # The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location
+        &quot;type&quot;: &quot;A String&quot;, # Type of category (e.g. &#x27;npm&#x27; for the PACKAGE_MANAGER category)
+      },
+    ],
+    &quot;filesLicenseInfo&quot;: [ # Contain the license the SPDX file creator has concluded as governing the This field is to contain a list of all licenses found in the package. The relationship between licenses (i.e., conjunctive, disjunctive) is not specified in this field – it is simply a listing of all licenses found
+      &quot;A String&quot;,
+    ],
+    &quot;homePage&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record a web site that serves as the package&#x27;s home page
+    &quot;licenseDeclared&quot;: &quot;A String&quot;, # List the licenses that have been declared by the authors of the package
+    &quot;originator&quot;: &quot;A String&quot;, # If the package identified in the SPDX file originated from a different person or organization than identified as Package Supplier, this field identifies from where or whom the package originally came
+    &quot;summaryDescription&quot;: &quot;A String&quot;, # A short description of the package
+    &quot;supplier&quot;: &quot;A String&quot;, # Identify the actual distribution source for the package/directory identified in the SPDX file
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full name of the package as given by the Package Originator
+    &quot;verificationCode&quot;: &quot;A String&quot;, # This field provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX file itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX file
+    &quot;version&quot;: &quot;A String&quot;, # Identify the version of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # A note describing SPDX Relationship.
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this note was last updated. This field can be used as a filter in list requests.
   &quot;vulnerability&quot;: { # Vulnerability provides metadata about a security vulnerability in a Note. # A note describing a package vulnerability.
     &quot;cvssScore&quot;: 3.14, # The CVSS score for this vulnerability.
@@ -1565,7 +1845,47 @@
       &quot;url&quot;: &quot;A String&quot;, # Specific URL associated with the resource.
     },
   ],
+  &quot;sbom&quot;: { # DocumentNote represents an SPDX Document Creation Infromation section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # A note describing SPDX Document which represents SBOM.
+    &quot;dataLicence&quot;: &quot;A String&quot;, # Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (&quot;SPDX-Metadata&quot;)
+    &quot;spdxVersion&quot;: &quot;A String&quot;, # Provide a reference number that can be used to understand how to parse and interpret the rest of the file
+  },
   &quot;shortDescription&quot;: &quot;A String&quot;, # A one sentence description of this note.
+  &quot;spdxFile&quot;: { # FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # A note describing SPDX File.
+    &quot;checksum&quot;: [ # Provide a unique identifier to match analysis information on each specific file in a package
+      &quot;A String&quot;,
+    ],
+    &quot;fileType&quot;: &quot;A String&quot;, # This field provides information about the type of file identified
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full path and filename that corresponds to the file information in this section
+  },
+  &quot;spdxPackage&quot;: { # PackageNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # A note describing SPDX Package.
+    &quot;analyzed&quot;: True or False, # Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document
+    &quot;attribution&quot;: &quot;A String&quot;, # A place for the SPDX data creator to record, at the package level, acknowledgements that may be needed to be communicated in some contexts
+    &quot;checksum&quot;: &quot;A String&quot;, # Provide an independently reproducible mechanism that permits unique identification of a specific package that correlates to the data in this SPDX file
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holders of the package, as well as any dates present
+    &quot;detailedDescription&quot;: &quot;A String&quot;, # A more detailed description of the package
+    &quot;downloadLocation&quot;: &quot;A String&quot;, # This section identifies the download Universal Resource Locator (URL), or a specific location within a version control system (VCS) for the package at the time that the SPDX file was created
+    &quot;externalRefs&quot;: [ # ExternalRef
+      { # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;category&quot;: &quot;A String&quot;, # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;comment&quot;: &quot;A String&quot;, # Human-readable information about the purpose and target of the reference
+        &quot;locator&quot;: &quot;A String&quot;, # The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location
+        &quot;type&quot;: &quot;A String&quot;, # Type of category (e.g. &#x27;npm&#x27; for the PACKAGE_MANAGER category)
+      },
+    ],
+    &quot;filesLicenseInfo&quot;: [ # Contain the license the SPDX file creator has concluded as governing the This field is to contain a list of all licenses found in the package. The relationship between licenses (i.e., conjunctive, disjunctive) is not specified in this field – it is simply a listing of all licenses found
+      &quot;A String&quot;,
+    ],
+    &quot;homePage&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record a web site that serves as the package&#x27;s home page
+    &quot;licenseDeclared&quot;: &quot;A String&quot;, # List the licenses that have been declared by the authors of the package
+    &quot;originator&quot;: &quot;A String&quot;, # If the package identified in the SPDX file originated from a different person or organization than identified as Package Supplier, this field identifies from where or whom the package originally came
+    &quot;summaryDescription&quot;: &quot;A String&quot;, # A short description of the package
+    &quot;supplier&quot;: &quot;A String&quot;, # Identify the actual distribution source for the package/directory identified in the SPDX file
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full name of the package as given by the Package Originator
+    &quot;verificationCode&quot;: &quot;A String&quot;, # This field provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX file itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX file
+    &quot;version&quot;: &quot;A String&quot;, # Identify the version of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # A note describing SPDX Relationship.
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this note was last updated. This field can be used as a filter in list requests.
   &quot;vulnerability&quot;: { # Vulnerability provides metadata about a security vulnerability in a Note. # A note describing a package vulnerability.
     &quot;cvssScore&quot;: 3.14, # The CVSS score for this vulnerability.
diff --git a/docs/dyn/containeranalysis_v1beta1.projects.notes.occurrences.html b/docs/dyn/containeranalysis_v1beta1.projects.notes.occurrences.html
index 5d18f6d..78aae52 100644
--- a/docs/dyn/containeranalysis_v1beta1.projects.notes.occurrences.html
+++ b/docs/dyn/containeranalysis_v1beta1.projects.notes.occurrences.html
@@ -368,6 +368,52 @@
         &quot;name&quot;: &quot;A String&quot;, # Deprecated, do not use. Use uri instead. The name of the resource. For example, the name of a Docker image - &quot;Debian&quot;.
         &quot;uri&quot;: &quot;A String&quot;, # Required. The unique URI of the resource. For example, `https://gcr.io/project/image@sha256:foo` for a Docker image.
       },
+      &quot;sbom&quot;: { # DocumentOccurrence represents an SPDX Document Creation Information section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # Describes a specific SPDX Document.
+        &quot;createTime&quot;: &quot;A String&quot;, # Identify when the SPDX file was originally created. The date is to be specified according to combined date and time in UTC format as specified in ISO 8601 standard
+        &quot;creatorComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide general comments about the creation of the SPDX file or any other relevant comment not included in the other fields
+        &quot;creators&quot;: [ # Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an individual, indicate the person&#x27;s name
+          &quot;A String&quot;,
+        ],
+        &quot;documentComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file content to provide comments to the consumers of the SPDX document
+        &quot;externalDocumentRefs&quot;: [ # Identify any external SPDX documents referenced within this SPDX document
+          &quot;A String&quot;,
+        ],
+        &quot;id&quot;: &quot;A String&quot;, # Identify the current SPDX document which may be referenced in relationships by other files, packages internally and documents externally
+        &quot;licenseListVersion&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created
+        &quot;namespace&quot;: &quot;A String&quot;, # Provide an SPDX document specific namespace as a unique absolute Uniform Resource Identifier (URI) as specified in RFC-3986, with the exception of the ‘#’ delimiter
+        &quot;title&quot;: &quot;A String&quot;, # Identify name of this document as designated by creator
+      },
+      &quot;spdxFile&quot;: { # FileOccurrence represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # Describes a specific SPDX File.
+        &quot;attributions&quot;: [ # This field provides a place for the SPDX data creator to record, at the file level, acknowledgements that may be needed to be communicated in some contexts
+          &quot;A String&quot;,
+        ],
+        &quot;comment&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any general comments about the file
+        &quot;contributors&quot;: [ # This field provides a place for the SPDX file creator to record file contributors
+          &quot;A String&quot;,
+        ],
+        &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holder of the file, as well as any dates present
+        &quot;filesLicenseInfo&quot;: [ # This field contains the license information actually found in the file, if any
+          &quot;A String&quot;,
+        ],
+        &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+        &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background references or analysis that went in to arriving at the Concluded License for a file
+        &quot;licenseConcluded&quot;: &quot;A String&quot;, # This field contains the license the SPDX file creator has concluded as governing the file or alternative values if the governing license cannot be determined
+        &quot;notice&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record license notices or other such related notices found in the file
+      },
+      &quot;spdxPackage&quot;: { # PackageOccurrence represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # Describes a specific SPDX Package.
+        &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the package being described
+        &quot;filename&quot;: &quot;A String&quot;, # Provide the actual file name of the package, or path of the directory being treated as a package
+        &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+        &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background information or analysis that went in to arriving at the Concluded License for a package
+        &quot;licenseConcluded&quot;: &quot;A String&quot;, # package or alternative values, if the governing license cannot be determined
+        &quot;sourceInfo&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record any relevant background information or additional comments about the origin of the package
+      },
+      &quot;spdxRelationship&quot;: { # RelationshipOccurrence represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # Describes a specific SPDX Relationship.
+        &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the relationship
+        &quot;source&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-A The source SPDX element (file, package, etc)
+        &quot;target&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-B The target SPDC element (file, package, etc) In cases where there are &quot;known unknowns&quot;, the use of the keyword NOASSERTION can be used The keywords NONE can be used to indicate that an SPDX element (package/file/snippet) has no other elements connected by some relationship to it
+        &quot;type&quot;: &quot;A String&quot;, # The type of relationship between the source and target SPDX elements
+      },
       &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was last updated.
       &quot;vulnerability&quot;: { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
         &quot;cvssScore&quot;: 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a scale of 0-10 where 0 indicates low severity and 10 indicates high severity.
diff --git a/docs/dyn/containeranalysis_v1beta1.projects.occurrences.html b/docs/dyn/containeranalysis_v1beta1.projects.occurrences.html
index f42be63..82f6fe0 100644
--- a/docs/dyn/containeranalysis_v1beta1.projects.occurrences.html
+++ b/docs/dyn/containeranalysis_v1beta1.projects.occurrences.html
@@ -384,6 +384,52 @@
         &quot;name&quot;: &quot;A String&quot;, # Deprecated, do not use. Use uri instead. The name of the resource. For example, the name of a Docker image - &quot;Debian&quot;.
         &quot;uri&quot;: &quot;A String&quot;, # Required. The unique URI of the resource. For example, `https://gcr.io/project/image@sha256:foo` for a Docker image.
       },
+      &quot;sbom&quot;: { # DocumentOccurrence represents an SPDX Document Creation Information section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # Describes a specific SPDX Document.
+        &quot;createTime&quot;: &quot;A String&quot;, # Identify when the SPDX file was originally created. The date is to be specified according to combined date and time in UTC format as specified in ISO 8601 standard
+        &quot;creatorComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide general comments about the creation of the SPDX file or any other relevant comment not included in the other fields
+        &quot;creators&quot;: [ # Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an individual, indicate the person&#x27;s name
+          &quot;A String&quot;,
+        ],
+        &quot;documentComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file content to provide comments to the consumers of the SPDX document
+        &quot;externalDocumentRefs&quot;: [ # Identify any external SPDX documents referenced within this SPDX document
+          &quot;A String&quot;,
+        ],
+        &quot;id&quot;: &quot;A String&quot;, # Identify the current SPDX document which may be referenced in relationships by other files, packages internally and documents externally
+        &quot;licenseListVersion&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created
+        &quot;namespace&quot;: &quot;A String&quot;, # Provide an SPDX document specific namespace as a unique absolute Uniform Resource Identifier (URI) as specified in RFC-3986, with the exception of the ‘#’ delimiter
+        &quot;title&quot;: &quot;A String&quot;, # Identify name of this document as designated by creator
+      },
+      &quot;spdxFile&quot;: { # FileOccurrence represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # Describes a specific SPDX File.
+        &quot;attributions&quot;: [ # This field provides a place for the SPDX data creator to record, at the file level, acknowledgements that may be needed to be communicated in some contexts
+          &quot;A String&quot;,
+        ],
+        &quot;comment&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any general comments about the file
+        &quot;contributors&quot;: [ # This field provides a place for the SPDX file creator to record file contributors
+          &quot;A String&quot;,
+        ],
+        &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holder of the file, as well as any dates present
+        &quot;filesLicenseInfo&quot;: [ # This field contains the license information actually found in the file, if any
+          &quot;A String&quot;,
+        ],
+        &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+        &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background references or analysis that went in to arriving at the Concluded License for a file
+        &quot;licenseConcluded&quot;: &quot;A String&quot;, # This field contains the license the SPDX file creator has concluded as governing the file or alternative values if the governing license cannot be determined
+        &quot;notice&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record license notices or other such related notices found in the file
+      },
+      &quot;spdxPackage&quot;: { # PackageOccurrence represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # Describes a specific SPDX Package.
+        &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the package being described
+        &quot;filename&quot;: &quot;A String&quot;, # Provide the actual file name of the package, or path of the directory being treated as a package
+        &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+        &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background information or analysis that went in to arriving at the Concluded License for a package
+        &quot;licenseConcluded&quot;: &quot;A String&quot;, # package or alternative values, if the governing license cannot be determined
+        &quot;sourceInfo&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record any relevant background information or additional comments about the origin of the package
+      },
+      &quot;spdxRelationship&quot;: { # RelationshipOccurrence represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # Describes a specific SPDX Relationship.
+        &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the relationship
+        &quot;source&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-A The source SPDX element (file, package, etc)
+        &quot;target&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-B The target SPDC element (file, package, etc) In cases where there are &quot;known unknowns&quot;, the use of the keyword NOASSERTION can be used The keywords NONE can be used to indicate that an SPDX element (package/file/snippet) has no other elements connected by some relationship to it
+        &quot;type&quot;: &quot;A String&quot;, # The type of relationship between the source and target SPDX elements
+      },
       &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was last updated.
       &quot;vulnerability&quot;: { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
         &quot;cvssScore&quot;: 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a scale of 0-10 where 0 indicates low severity and 10 indicates high severity.
@@ -699,6 +745,52 @@
         &quot;name&quot;: &quot;A String&quot;, # Deprecated, do not use. Use uri instead. The name of the resource. For example, the name of a Docker image - &quot;Debian&quot;.
         &quot;uri&quot;: &quot;A String&quot;, # Required. The unique URI of the resource. For example, `https://gcr.io/project/image@sha256:foo` for a Docker image.
       },
+      &quot;sbom&quot;: { # DocumentOccurrence represents an SPDX Document Creation Information section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # Describes a specific SPDX Document.
+        &quot;createTime&quot;: &quot;A String&quot;, # Identify when the SPDX file was originally created. The date is to be specified according to combined date and time in UTC format as specified in ISO 8601 standard
+        &quot;creatorComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide general comments about the creation of the SPDX file or any other relevant comment not included in the other fields
+        &quot;creators&quot;: [ # Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an individual, indicate the person&#x27;s name
+          &quot;A String&quot;,
+        ],
+        &quot;documentComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file content to provide comments to the consumers of the SPDX document
+        &quot;externalDocumentRefs&quot;: [ # Identify any external SPDX documents referenced within this SPDX document
+          &quot;A String&quot;,
+        ],
+        &quot;id&quot;: &quot;A String&quot;, # Identify the current SPDX document which may be referenced in relationships by other files, packages internally and documents externally
+        &quot;licenseListVersion&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created
+        &quot;namespace&quot;: &quot;A String&quot;, # Provide an SPDX document specific namespace as a unique absolute Uniform Resource Identifier (URI) as specified in RFC-3986, with the exception of the ‘#’ delimiter
+        &quot;title&quot;: &quot;A String&quot;, # Identify name of this document as designated by creator
+      },
+      &quot;spdxFile&quot;: { # FileOccurrence represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # Describes a specific SPDX File.
+        &quot;attributions&quot;: [ # This field provides a place for the SPDX data creator to record, at the file level, acknowledgements that may be needed to be communicated in some contexts
+          &quot;A String&quot;,
+        ],
+        &quot;comment&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any general comments about the file
+        &quot;contributors&quot;: [ # This field provides a place for the SPDX file creator to record file contributors
+          &quot;A String&quot;,
+        ],
+        &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holder of the file, as well as any dates present
+        &quot;filesLicenseInfo&quot;: [ # This field contains the license information actually found in the file, if any
+          &quot;A String&quot;,
+        ],
+        &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+        &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background references or analysis that went in to arriving at the Concluded License for a file
+        &quot;licenseConcluded&quot;: &quot;A String&quot;, # This field contains the license the SPDX file creator has concluded as governing the file or alternative values if the governing license cannot be determined
+        &quot;notice&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record license notices or other such related notices found in the file
+      },
+      &quot;spdxPackage&quot;: { # PackageOccurrence represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # Describes a specific SPDX Package.
+        &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the package being described
+        &quot;filename&quot;: &quot;A String&quot;, # Provide the actual file name of the package, or path of the directory being treated as a package
+        &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+        &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background information or analysis that went in to arriving at the Concluded License for a package
+        &quot;licenseConcluded&quot;: &quot;A String&quot;, # package or alternative values, if the governing license cannot be determined
+        &quot;sourceInfo&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record any relevant background information or additional comments about the origin of the package
+      },
+      &quot;spdxRelationship&quot;: { # RelationshipOccurrence represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # Describes a specific SPDX Relationship.
+        &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the relationship
+        &quot;source&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-A The source SPDX element (file, package, etc)
+        &quot;target&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-B The target SPDC element (file, package, etc) In cases where there are &quot;known unknowns&quot;, the use of the keyword NOASSERTION can be used The keywords NONE can be used to indicate that an SPDX element (package/file/snippet) has no other elements connected by some relationship to it
+        &quot;type&quot;: &quot;A String&quot;, # The type of relationship between the source and target SPDX elements
+      },
       &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was last updated.
       &quot;vulnerability&quot;: { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
         &quot;cvssScore&quot;: 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a scale of 0-10 where 0 indicates low severity and 10 indicates high severity.
@@ -1019,6 +1111,52 @@
     &quot;name&quot;: &quot;A String&quot;, # Deprecated, do not use. Use uri instead. The name of the resource. For example, the name of a Docker image - &quot;Debian&quot;.
     &quot;uri&quot;: &quot;A String&quot;, # Required. The unique URI of the resource. For example, `https://gcr.io/project/image@sha256:foo` for a Docker image.
   },
+  &quot;sbom&quot;: { # DocumentOccurrence represents an SPDX Document Creation Information section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # Describes a specific SPDX Document.
+    &quot;createTime&quot;: &quot;A String&quot;, # Identify when the SPDX file was originally created. The date is to be specified according to combined date and time in UTC format as specified in ISO 8601 standard
+    &quot;creatorComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide general comments about the creation of the SPDX file or any other relevant comment not included in the other fields
+    &quot;creators&quot;: [ # Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an individual, indicate the person&#x27;s name
+      &quot;A String&quot;,
+    ],
+    &quot;documentComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file content to provide comments to the consumers of the SPDX document
+    &quot;externalDocumentRefs&quot;: [ # Identify any external SPDX documents referenced within this SPDX document
+      &quot;A String&quot;,
+    ],
+    &quot;id&quot;: &quot;A String&quot;, # Identify the current SPDX document which may be referenced in relationships by other files, packages internally and documents externally
+    &quot;licenseListVersion&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created
+    &quot;namespace&quot;: &quot;A String&quot;, # Provide an SPDX document specific namespace as a unique absolute Uniform Resource Identifier (URI) as specified in RFC-3986, with the exception of the ‘#’ delimiter
+    &quot;title&quot;: &quot;A String&quot;, # Identify name of this document as designated by creator
+  },
+  &quot;spdxFile&quot;: { # FileOccurrence represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # Describes a specific SPDX File.
+    &quot;attributions&quot;: [ # This field provides a place for the SPDX data creator to record, at the file level, acknowledgements that may be needed to be communicated in some contexts
+      &quot;A String&quot;,
+    ],
+    &quot;comment&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any general comments about the file
+    &quot;contributors&quot;: [ # This field provides a place for the SPDX file creator to record file contributors
+      &quot;A String&quot;,
+    ],
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holder of the file, as well as any dates present
+    &quot;filesLicenseInfo&quot;: [ # This field contains the license information actually found in the file, if any
+      &quot;A String&quot;,
+    ],
+    &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+    &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background references or analysis that went in to arriving at the Concluded License for a file
+    &quot;licenseConcluded&quot;: &quot;A String&quot;, # This field contains the license the SPDX file creator has concluded as governing the file or alternative values if the governing license cannot be determined
+    &quot;notice&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record license notices or other such related notices found in the file
+  },
+  &quot;spdxPackage&quot;: { # PackageOccurrence represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # Describes a specific SPDX Package.
+    &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the package being described
+    &quot;filename&quot;: &quot;A String&quot;, # Provide the actual file name of the package, or path of the directory being treated as a package
+    &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+    &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background information or analysis that went in to arriving at the Concluded License for a package
+    &quot;licenseConcluded&quot;: &quot;A String&quot;, # package or alternative values, if the governing license cannot be determined
+    &quot;sourceInfo&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record any relevant background information or additional comments about the origin of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipOccurrence represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # Describes a specific SPDX Relationship.
+    &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the relationship
+    &quot;source&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-A The source SPDX element (file, package, etc)
+    &quot;target&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-B The target SPDC element (file, package, etc) In cases where there are &quot;known unknowns&quot;, the use of the keyword NOASSERTION can be used The keywords NONE can be used to indicate that an SPDX element (package/file/snippet) has no other elements connected by some relationship to it
+    &quot;type&quot;: &quot;A String&quot;, # The type of relationship between the source and target SPDX elements
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was last updated.
   &quot;vulnerability&quot;: { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
     &quot;cvssScore&quot;: 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a scale of 0-10 where 0 indicates low severity and 10 indicates high severity.
@@ -1330,6 +1468,52 @@
     &quot;name&quot;: &quot;A String&quot;, # Deprecated, do not use. Use uri instead. The name of the resource. For example, the name of a Docker image - &quot;Debian&quot;.
     &quot;uri&quot;: &quot;A String&quot;, # Required. The unique URI of the resource. For example, `https://gcr.io/project/image@sha256:foo` for a Docker image.
   },
+  &quot;sbom&quot;: { # DocumentOccurrence represents an SPDX Document Creation Information section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # Describes a specific SPDX Document.
+    &quot;createTime&quot;: &quot;A String&quot;, # Identify when the SPDX file was originally created. The date is to be specified according to combined date and time in UTC format as specified in ISO 8601 standard
+    &quot;creatorComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide general comments about the creation of the SPDX file or any other relevant comment not included in the other fields
+    &quot;creators&quot;: [ # Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an individual, indicate the person&#x27;s name
+      &quot;A String&quot;,
+    ],
+    &quot;documentComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file content to provide comments to the consumers of the SPDX document
+    &quot;externalDocumentRefs&quot;: [ # Identify any external SPDX documents referenced within this SPDX document
+      &quot;A String&quot;,
+    ],
+    &quot;id&quot;: &quot;A String&quot;, # Identify the current SPDX document which may be referenced in relationships by other files, packages internally and documents externally
+    &quot;licenseListVersion&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created
+    &quot;namespace&quot;: &quot;A String&quot;, # Provide an SPDX document specific namespace as a unique absolute Uniform Resource Identifier (URI) as specified in RFC-3986, with the exception of the ‘#’ delimiter
+    &quot;title&quot;: &quot;A String&quot;, # Identify name of this document as designated by creator
+  },
+  &quot;spdxFile&quot;: { # FileOccurrence represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # Describes a specific SPDX File.
+    &quot;attributions&quot;: [ # This field provides a place for the SPDX data creator to record, at the file level, acknowledgements that may be needed to be communicated in some contexts
+      &quot;A String&quot;,
+    ],
+    &quot;comment&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any general comments about the file
+    &quot;contributors&quot;: [ # This field provides a place for the SPDX file creator to record file contributors
+      &quot;A String&quot;,
+    ],
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holder of the file, as well as any dates present
+    &quot;filesLicenseInfo&quot;: [ # This field contains the license information actually found in the file, if any
+      &quot;A String&quot;,
+    ],
+    &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+    &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background references or analysis that went in to arriving at the Concluded License for a file
+    &quot;licenseConcluded&quot;: &quot;A String&quot;, # This field contains the license the SPDX file creator has concluded as governing the file or alternative values if the governing license cannot be determined
+    &quot;notice&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record license notices or other such related notices found in the file
+  },
+  &quot;spdxPackage&quot;: { # PackageOccurrence represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # Describes a specific SPDX Package.
+    &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the package being described
+    &quot;filename&quot;: &quot;A String&quot;, # Provide the actual file name of the package, or path of the directory being treated as a package
+    &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+    &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background information or analysis that went in to arriving at the Concluded License for a package
+    &quot;licenseConcluded&quot;: &quot;A String&quot;, # package or alternative values, if the governing license cannot be determined
+    &quot;sourceInfo&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record any relevant background information or additional comments about the origin of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipOccurrence represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # Describes a specific SPDX Relationship.
+    &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the relationship
+    &quot;source&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-A The source SPDX element (file, package, etc)
+    &quot;target&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-B The target SPDC element (file, package, etc) In cases where there are &quot;known unknowns&quot;, the use of the keyword NOASSERTION can be used The keywords NONE can be used to indicate that an SPDX element (package/file/snippet) has no other elements connected by some relationship to it
+    &quot;type&quot;: &quot;A String&quot;, # The type of relationship between the source and target SPDX elements
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was last updated.
   &quot;vulnerability&quot;: { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
     &quot;cvssScore&quot;: 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a scale of 0-10 where 0 indicates low severity and 10 indicates high severity.
@@ -1666,6 +1850,52 @@
     &quot;name&quot;: &quot;A String&quot;, # Deprecated, do not use. Use uri instead. The name of the resource. For example, the name of a Docker image - &quot;Debian&quot;.
     &quot;uri&quot;: &quot;A String&quot;, # Required. The unique URI of the resource. For example, `https://gcr.io/project/image@sha256:foo` for a Docker image.
   },
+  &quot;sbom&quot;: { # DocumentOccurrence represents an SPDX Document Creation Information section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # Describes a specific SPDX Document.
+    &quot;createTime&quot;: &quot;A String&quot;, # Identify when the SPDX file was originally created. The date is to be specified according to combined date and time in UTC format as specified in ISO 8601 standard
+    &quot;creatorComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide general comments about the creation of the SPDX file or any other relevant comment not included in the other fields
+    &quot;creators&quot;: [ # Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an individual, indicate the person&#x27;s name
+      &quot;A String&quot;,
+    ],
+    &quot;documentComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file content to provide comments to the consumers of the SPDX document
+    &quot;externalDocumentRefs&quot;: [ # Identify any external SPDX documents referenced within this SPDX document
+      &quot;A String&quot;,
+    ],
+    &quot;id&quot;: &quot;A String&quot;, # Identify the current SPDX document which may be referenced in relationships by other files, packages internally and documents externally
+    &quot;licenseListVersion&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created
+    &quot;namespace&quot;: &quot;A String&quot;, # Provide an SPDX document specific namespace as a unique absolute Uniform Resource Identifier (URI) as specified in RFC-3986, with the exception of the ‘#’ delimiter
+    &quot;title&quot;: &quot;A String&quot;, # Identify name of this document as designated by creator
+  },
+  &quot;spdxFile&quot;: { # FileOccurrence represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # Describes a specific SPDX File.
+    &quot;attributions&quot;: [ # This field provides a place for the SPDX data creator to record, at the file level, acknowledgements that may be needed to be communicated in some contexts
+      &quot;A String&quot;,
+    ],
+    &quot;comment&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any general comments about the file
+    &quot;contributors&quot;: [ # This field provides a place for the SPDX file creator to record file contributors
+      &quot;A String&quot;,
+    ],
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holder of the file, as well as any dates present
+    &quot;filesLicenseInfo&quot;: [ # This field contains the license information actually found in the file, if any
+      &quot;A String&quot;,
+    ],
+    &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+    &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background references or analysis that went in to arriving at the Concluded License for a file
+    &quot;licenseConcluded&quot;: &quot;A String&quot;, # This field contains the license the SPDX file creator has concluded as governing the file or alternative values if the governing license cannot be determined
+    &quot;notice&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record license notices or other such related notices found in the file
+  },
+  &quot;spdxPackage&quot;: { # PackageOccurrence represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # Describes a specific SPDX Package.
+    &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the package being described
+    &quot;filename&quot;: &quot;A String&quot;, # Provide the actual file name of the package, or path of the directory being treated as a package
+    &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+    &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background information or analysis that went in to arriving at the Concluded License for a package
+    &quot;licenseConcluded&quot;: &quot;A String&quot;, # package or alternative values, if the governing license cannot be determined
+    &quot;sourceInfo&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record any relevant background information or additional comments about the origin of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipOccurrence represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # Describes a specific SPDX Relationship.
+    &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the relationship
+    &quot;source&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-A The source SPDX element (file, package, etc)
+    &quot;target&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-B The target SPDC element (file, package, etc) In cases where there are &quot;known unknowns&quot;, the use of the keyword NOASSERTION can be used The keywords NONE can be used to indicate that an SPDX element (package/file/snippet) has no other elements connected by some relationship to it
+    &quot;type&quot;: &quot;A String&quot;, # The type of relationship between the source and target SPDX elements
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was last updated.
   &quot;vulnerability&quot;: { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
     &quot;cvssScore&quot;: 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a scale of 0-10 where 0 indicates low severity and 10 indicates high severity.
@@ -1863,7 +2093,47 @@
       &quot;url&quot;: &quot;A String&quot;, # Specific URL associated with the resource.
     },
   ],
+  &quot;sbom&quot;: { # DocumentNote represents an SPDX Document Creation Infromation section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # A note describing SPDX Document which represents SBOM.
+    &quot;dataLicence&quot;: &quot;A String&quot;, # Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (&quot;SPDX-Metadata&quot;)
+    &quot;spdxVersion&quot;: &quot;A String&quot;, # Provide a reference number that can be used to understand how to parse and interpret the rest of the file
+  },
   &quot;shortDescription&quot;: &quot;A String&quot;, # A one sentence description of this note.
+  &quot;spdxFile&quot;: { # FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # A note describing SPDX File.
+    &quot;checksum&quot;: [ # Provide a unique identifier to match analysis information on each specific file in a package
+      &quot;A String&quot;,
+    ],
+    &quot;fileType&quot;: &quot;A String&quot;, # This field provides information about the type of file identified
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full path and filename that corresponds to the file information in this section
+  },
+  &quot;spdxPackage&quot;: { # PackageNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # A note describing SPDX Package.
+    &quot;analyzed&quot;: True or False, # Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document
+    &quot;attribution&quot;: &quot;A String&quot;, # A place for the SPDX data creator to record, at the package level, acknowledgements that may be needed to be communicated in some contexts
+    &quot;checksum&quot;: &quot;A String&quot;, # Provide an independently reproducible mechanism that permits unique identification of a specific package that correlates to the data in this SPDX file
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holders of the package, as well as any dates present
+    &quot;detailedDescription&quot;: &quot;A String&quot;, # A more detailed description of the package
+    &quot;downloadLocation&quot;: &quot;A String&quot;, # This section identifies the download Universal Resource Locator (URL), or a specific location within a version control system (VCS) for the package at the time that the SPDX file was created
+    &quot;externalRefs&quot;: [ # ExternalRef
+      { # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;category&quot;: &quot;A String&quot;, # An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package
+        &quot;comment&quot;: &quot;A String&quot;, # Human-readable information about the purpose and target of the reference
+        &quot;locator&quot;: &quot;A String&quot;, # The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location
+        &quot;type&quot;: &quot;A String&quot;, # Type of category (e.g. &#x27;npm&#x27; for the PACKAGE_MANAGER category)
+      },
+    ],
+    &quot;filesLicenseInfo&quot;: [ # Contain the license the SPDX file creator has concluded as governing the This field is to contain a list of all licenses found in the package. The relationship between licenses (i.e., conjunctive, disjunctive) is not specified in this field – it is simply a listing of all licenses found
+      &quot;A String&quot;,
+    ],
+    &quot;homePage&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record a web site that serves as the package&#x27;s home page
+    &quot;licenseDeclared&quot;: &quot;A String&quot;, # List the licenses that have been declared by the authors of the package
+    &quot;originator&quot;: &quot;A String&quot;, # If the package identified in the SPDX file originated from a different person or organization than identified as Package Supplier, this field identifies from where or whom the package originally came
+    &quot;summaryDescription&quot;: &quot;A String&quot;, # A short description of the package
+    &quot;supplier&quot;: &quot;A String&quot;, # Identify the actual distribution source for the package/directory identified in the SPDX file
+    &quot;title&quot;: &quot;A String&quot;, # Identify the full name of the package as given by the Package Originator
+    &quot;verificationCode&quot;: &quot;A String&quot;, # This field provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX file itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX file
+    &quot;version&quot;: &quot;A String&quot;, # Identify the version of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # A note describing SPDX Relationship.
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this note was last updated. This field can be used as a filter in list requests.
   &quot;vulnerability&quot;: { # Vulnerability provides metadata about a security vulnerability in a Note. # A note describing a package vulnerability.
     &quot;cvssScore&quot;: 3.14, # The CVSS score for this vulnerability.
@@ -2250,6 +2520,52 @@
         &quot;name&quot;: &quot;A String&quot;, # Deprecated, do not use. Use uri instead. The name of the resource. For example, the name of a Docker image - &quot;Debian&quot;.
         &quot;uri&quot;: &quot;A String&quot;, # Required. The unique URI of the resource. For example, `https://gcr.io/project/image@sha256:foo` for a Docker image.
       },
+      &quot;sbom&quot;: { # DocumentOccurrence represents an SPDX Document Creation Information section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # Describes a specific SPDX Document.
+        &quot;createTime&quot;: &quot;A String&quot;, # Identify when the SPDX file was originally created. The date is to be specified according to combined date and time in UTC format as specified in ISO 8601 standard
+        &quot;creatorComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide general comments about the creation of the SPDX file or any other relevant comment not included in the other fields
+        &quot;creators&quot;: [ # Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an individual, indicate the person&#x27;s name
+          &quot;A String&quot;,
+        ],
+        &quot;documentComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file content to provide comments to the consumers of the SPDX document
+        &quot;externalDocumentRefs&quot;: [ # Identify any external SPDX documents referenced within this SPDX document
+          &quot;A String&quot;,
+        ],
+        &quot;id&quot;: &quot;A String&quot;, # Identify the current SPDX document which may be referenced in relationships by other files, packages internally and documents externally
+        &quot;licenseListVersion&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created
+        &quot;namespace&quot;: &quot;A String&quot;, # Provide an SPDX document specific namespace as a unique absolute Uniform Resource Identifier (URI) as specified in RFC-3986, with the exception of the ‘#’ delimiter
+        &quot;title&quot;: &quot;A String&quot;, # Identify name of this document as designated by creator
+      },
+      &quot;spdxFile&quot;: { # FileOccurrence represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # Describes a specific SPDX File.
+        &quot;attributions&quot;: [ # This field provides a place for the SPDX data creator to record, at the file level, acknowledgements that may be needed to be communicated in some contexts
+          &quot;A String&quot;,
+        ],
+        &quot;comment&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any general comments about the file
+        &quot;contributors&quot;: [ # This field provides a place for the SPDX file creator to record file contributors
+          &quot;A String&quot;,
+        ],
+        &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holder of the file, as well as any dates present
+        &quot;filesLicenseInfo&quot;: [ # This field contains the license information actually found in the file, if any
+          &quot;A String&quot;,
+        ],
+        &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+        &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background references or analysis that went in to arriving at the Concluded License for a file
+        &quot;licenseConcluded&quot;: &quot;A String&quot;, # This field contains the license the SPDX file creator has concluded as governing the file or alternative values if the governing license cannot be determined
+        &quot;notice&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record license notices or other such related notices found in the file
+      },
+      &quot;spdxPackage&quot;: { # PackageOccurrence represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # Describes a specific SPDX Package.
+        &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the package being described
+        &quot;filename&quot;: &quot;A String&quot;, # Provide the actual file name of the package, or path of the directory being treated as a package
+        &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+        &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background information or analysis that went in to arriving at the Concluded License for a package
+        &quot;licenseConcluded&quot;: &quot;A String&quot;, # package or alternative values, if the governing license cannot be determined
+        &quot;sourceInfo&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record any relevant background information or additional comments about the origin of the package
+      },
+      &quot;spdxRelationship&quot;: { # RelationshipOccurrence represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # Describes a specific SPDX Relationship.
+        &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the relationship
+        &quot;source&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-A The source SPDX element (file, package, etc)
+        &quot;target&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-B The target SPDC element (file, package, etc) In cases where there are &quot;known unknowns&quot;, the use of the keyword NOASSERTION can be used The keywords NONE can be used to indicate that an SPDX element (package/file/snippet) has no other elements connected by some relationship to it
+        &quot;type&quot;: &quot;A String&quot;, # The type of relationship between the source and target SPDX elements
+      },
       &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was last updated.
       &quot;vulnerability&quot;: { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
         &quot;cvssScore&quot;: 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a scale of 0-10 where 0 indicates low severity and 10 indicates high severity.
@@ -2579,6 +2895,52 @@
     &quot;name&quot;: &quot;A String&quot;, # Deprecated, do not use. Use uri instead. The name of the resource. For example, the name of a Docker image - &quot;Debian&quot;.
     &quot;uri&quot;: &quot;A String&quot;, # Required. The unique URI of the resource. For example, `https://gcr.io/project/image@sha256:foo` for a Docker image.
   },
+  &quot;sbom&quot;: { # DocumentOccurrence represents an SPDX Document Creation Information section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # Describes a specific SPDX Document.
+    &quot;createTime&quot;: &quot;A String&quot;, # Identify when the SPDX file was originally created. The date is to be specified according to combined date and time in UTC format as specified in ISO 8601 standard
+    &quot;creatorComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide general comments about the creation of the SPDX file or any other relevant comment not included in the other fields
+    &quot;creators&quot;: [ # Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an individual, indicate the person&#x27;s name
+      &quot;A String&quot;,
+    ],
+    &quot;documentComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file content to provide comments to the consumers of the SPDX document
+    &quot;externalDocumentRefs&quot;: [ # Identify any external SPDX documents referenced within this SPDX document
+      &quot;A String&quot;,
+    ],
+    &quot;id&quot;: &quot;A String&quot;, # Identify the current SPDX document which may be referenced in relationships by other files, packages internally and documents externally
+    &quot;licenseListVersion&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created
+    &quot;namespace&quot;: &quot;A String&quot;, # Provide an SPDX document specific namespace as a unique absolute Uniform Resource Identifier (URI) as specified in RFC-3986, with the exception of the ‘#’ delimiter
+    &quot;title&quot;: &quot;A String&quot;, # Identify name of this document as designated by creator
+  },
+  &quot;spdxFile&quot;: { # FileOccurrence represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # Describes a specific SPDX File.
+    &quot;attributions&quot;: [ # This field provides a place for the SPDX data creator to record, at the file level, acknowledgements that may be needed to be communicated in some contexts
+      &quot;A String&quot;,
+    ],
+    &quot;comment&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any general comments about the file
+    &quot;contributors&quot;: [ # This field provides a place for the SPDX file creator to record file contributors
+      &quot;A String&quot;,
+    ],
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holder of the file, as well as any dates present
+    &quot;filesLicenseInfo&quot;: [ # This field contains the license information actually found in the file, if any
+      &quot;A String&quot;,
+    ],
+    &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+    &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background references or analysis that went in to arriving at the Concluded License for a file
+    &quot;licenseConcluded&quot;: &quot;A String&quot;, # This field contains the license the SPDX file creator has concluded as governing the file or alternative values if the governing license cannot be determined
+    &quot;notice&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record license notices or other such related notices found in the file
+  },
+  &quot;spdxPackage&quot;: { # PackageOccurrence represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # Describes a specific SPDX Package.
+    &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the package being described
+    &quot;filename&quot;: &quot;A String&quot;, # Provide the actual file name of the package, or path of the directory being treated as a package
+    &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+    &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background information or analysis that went in to arriving at the Concluded License for a package
+    &quot;licenseConcluded&quot;: &quot;A String&quot;, # package or alternative values, if the governing license cannot be determined
+    &quot;sourceInfo&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record any relevant background information or additional comments about the origin of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipOccurrence represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # Describes a specific SPDX Relationship.
+    &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the relationship
+    &quot;source&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-A The source SPDX element (file, package, etc)
+    &quot;target&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-B The target SPDC element (file, package, etc) In cases where there are &quot;known unknowns&quot;, the use of the keyword NOASSERTION can be used The keywords NONE can be used to indicate that an SPDX element (package/file/snippet) has no other elements connected by some relationship to it
+    &quot;type&quot;: &quot;A String&quot;, # The type of relationship between the source and target SPDX elements
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was last updated.
   &quot;vulnerability&quot;: { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
     &quot;cvssScore&quot;: 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a scale of 0-10 where 0 indicates low severity and 10 indicates high severity.
@@ -2891,6 +3253,52 @@
     &quot;name&quot;: &quot;A String&quot;, # Deprecated, do not use. Use uri instead. The name of the resource. For example, the name of a Docker image - &quot;Debian&quot;.
     &quot;uri&quot;: &quot;A String&quot;, # Required. The unique URI of the resource. For example, `https://gcr.io/project/image@sha256:foo` for a Docker image.
   },
+  &quot;sbom&quot;: { # DocumentOccurrence represents an SPDX Document Creation Information section: https://spdx.github.io/spdx-spec/2-document-creation-information/ # Describes a specific SPDX Document.
+    &quot;createTime&quot;: &quot;A String&quot;, # Identify when the SPDX file was originally created. The date is to be specified according to combined date and time in UTC format as specified in ISO 8601 standard
+    &quot;creatorComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide general comments about the creation of the SPDX file or any other relevant comment not included in the other fields
+    &quot;creators&quot;: [ # Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an individual, indicate the person&#x27;s name
+      &quot;A String&quot;,
+    ],
+    &quot;documentComment&quot;: &quot;A String&quot;, # A field for creators of the SPDX file content to provide comments to the consumers of the SPDX document
+    &quot;externalDocumentRefs&quot;: [ # Identify any external SPDX documents referenced within this SPDX document
+      &quot;A String&quot;,
+    ],
+    &quot;id&quot;: &quot;A String&quot;, # Identify the current SPDX document which may be referenced in relationships by other files, packages internally and documents externally
+    &quot;licenseListVersion&quot;: &quot;A String&quot;, # A field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created
+    &quot;namespace&quot;: &quot;A String&quot;, # Provide an SPDX document specific namespace as a unique absolute Uniform Resource Identifier (URI) as specified in RFC-3986, with the exception of the ‘#’ delimiter
+    &quot;title&quot;: &quot;A String&quot;, # Identify name of this document as designated by creator
+  },
+  &quot;spdxFile&quot;: { # FileOccurrence represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/ # Describes a specific SPDX File.
+    &quot;attributions&quot;: [ # This field provides a place for the SPDX data creator to record, at the file level, acknowledgements that may be needed to be communicated in some contexts
+      &quot;A String&quot;,
+    ],
+    &quot;comment&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any general comments about the file
+    &quot;contributors&quot;: [ # This field provides a place for the SPDX file creator to record file contributors
+      &quot;A String&quot;,
+    ],
+    &quot;copyright&quot;: &quot;A String&quot;, # Identify the copyright holder of the file, as well as any dates present
+    &quot;filesLicenseInfo&quot;: [ # This field contains the license information actually found in the file, if any
+      &quot;A String&quot;,
+    ],
+    &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+    &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background references or analysis that went in to arriving at the Concluded License for a file
+    &quot;licenseConcluded&quot;: &quot;A String&quot;, # This field contains the license the SPDX file creator has concluded as governing the file or alternative values if the governing license cannot be determined
+    &quot;notice&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record license notices or other such related notices found in the file
+  },
+  &quot;spdxPackage&quot;: { # PackageOccurrence represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/ # Describes a specific SPDX Package.
+    &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the package being described
+    &quot;filename&quot;: &quot;A String&quot;, # Provide the actual file name of the package, or path of the directory being treated as a package
+    &quot;id&quot;: &quot;A String&quot;, # Uniquely identify any element in an SPDX document which may be referenced by other elements
+    &quot;licenseComments&quot;: &quot;A String&quot;, # This field provides a place for the SPDX file creator to record any relevant background information or analysis that went in to arriving at the Concluded License for a package
+    &quot;licenseConcluded&quot;: &quot;A String&quot;, # package or alternative values, if the governing license cannot be determined
+    &quot;sourceInfo&quot;: &quot;A String&quot;, # Provide a place for the SPDX file creator to record any relevant background information or additional comments about the origin of the package
+  },
+  &quot;spdxRelationship&quot;: { # RelationshipOccurrence represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/ # Describes a specific SPDX Relationship.
+    &quot;comment&quot;: &quot;A String&quot;, # A place for the SPDX file creator to record any general comments about the relationship
+    &quot;source&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-A The source SPDX element (file, package, etc)
+    &quot;target&quot;: &quot;A String&quot;, # Also referred to as SPDXRef-B The target SPDC element (file, package, etc) In cases where there are &quot;known unknowns&quot;, the use of the keyword NOASSERTION can be used The keywords NONE can be used to indicate that an SPDX element (package/file/snippet) has no other elements connected by some relationship to it
+    &quot;type&quot;: &quot;A String&quot;, # The type of relationship between the source and target SPDX elements
+  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time this occurrence was last updated.
   &quot;vulnerability&quot;: { # Details of a vulnerability Occurrence. # Describes a security vulnerability.
     &quot;cvssScore&quot;: 3.14, # Output only. The CVSS score of this vulnerability. CVSS score is on a scale of 0-10 where 0 indicates low severity and 10 indicates high severity.
diff --git a/docs/dyn/datacatalog_v1.entries.html b/docs/dyn/datacatalog_v1.entries.html
index 1488063..3b90eaf 100644
--- a/docs/dyn/datacatalog_v1.entries.html
+++ b/docs/dyn/datacatalog_v1.entries.html
@@ -93,7 +93,7 @@
 Args:
   fullyQualifiedName: string, Fully qualified name (FQN) of the resource. FQNs take two forms: * For non-regionalized resources: `{SYSTEM}:{PROJECT}.{PATH_TO_RESOURCE_SEPARATED_WITH_DOTS}` * For regionalized resources: `{SYSTEM}:{PROJECT}.{LOCATION_ID}.{PATH_TO_RESOURCE_SEPARATED_WITH_DOTS}` Example for a DPMS table: `dataproc_metastore:{PROJECT_ID}.{LOCATION_ID}.{INSTANCE_ID}.{DATABASE_ID}.{TABLE_ID}`
   linkedResource: string, The full name of the Google Cloud Platform resource the Data Catalog entry represents. For more information, see [Full Resource Name] (https://cloud.google.com/apis/design/resource_names#full_resource_name). Full names are case-sensitive. For example: * `//bigquery.googleapis.com/projects/{PROJECT_ID}/datasets/{DATASET_ID}/tables/{TABLE_ID}` * `//pubsub.googleapis.com/projects/{PROJECT_ID}/topics/{TOPIC_ID}`
-  sqlResource: string, The SQL name of the entry. SQL names are case-sensitive. Examples: * `pubsub.{PROJECT_ID}.{TOPIC_ID}` * `pubsub.{PROJECT_ID}.{TOPIC.ID.SEPARATED.WITH.DOTS}` * `bigquery.table.{PROJECT_ID}.{DATASET_ID}.{TABLE_ID}` * `bigquery.dataset.{PROJECT_ID}.{DATASET_ID}` * `datacatalog.entry.{PROJECT_ID}.{LOCATION_ID}.{ENTRY_GROUP_ID}.{ENTRY_ID}` Identifiers (`*_ID`) should comply with the [Lexical structure in Standard SQL] (https://cloud.google.com/bigquery/docs/reference/standard-sql/lexical).
+  sqlResource: string, The SQL name of the entry. SQL names are case-sensitive. Examples: * `pubsub.topic.{PROJECT_ID}.{TOPIC_ID}` * `pubsub.topic.{PROJECT_ID}.`\``{TOPIC.ID.SEPARATED.WITH.DOTS}`\` * `bigquery.table.{PROJECT_ID}.{DATASET_ID}.{TABLE_ID}` * `bigquery.dataset.{PROJECT_ID}.{DATASET_ID}` * `datacatalog.entry.{PROJECT_ID}.{LOCATION_ID}.{ENTRY_GROUP_ID}.{ENTRY_ID}` Identifiers (`*_ID`) should comply with the [Lexical structure in Standard SQL] (https://cloud.google.com/bigquery/docs/reference/standard-sql/lexical).
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
diff --git a/docs/dyn/datacatalog_v1.projects.locations.tagTemplates.html b/docs/dyn/datacatalog_v1.projects.locations.tagTemplates.html
index 34d756f..56877bf 100644
--- a/docs/dyn/datacatalog_v1.projects.locations.tagTemplates.html
+++ b/docs/dyn/datacatalog_v1.projects.locations.tagTemplates.html
@@ -139,7 +139,7 @@
       },
     },
   },
-  &quot;isPubliclyReadable&quot;: True or False, # Indicates whether this is a public tag template. Every user has view access to a *public* tag template by default. This means that: * Every user can use this tag template to tag an entry. * If an entry is tagged using the tag template, the tag is always shown in the response to ``ListTags`` called on the entry. * To get the template using the GetTagTemplate method, you need view access either on the project or the organization the tag template resides in but no other permission is needed. * Operations on the tag template other than viewing (for example, editing IAM policies) follow standard IAM structures. Tags created with a public tag template are referred to as public tags. You can search for a public tag by value with a simple search query instead of using a ``tag:`` predicate. Public tag templates may not appear in search results depending on scope, see: include_public_tag_templates
+  &quot;isPubliclyReadable&quot;: True or False, # Indicates whether this is a public tag template. Every user has view access to a *public* tag template by default. This means that: * Every user can use this tag template to tag an entry. * If an entry is tagged using the tag template, the tag is always shown in the response to ``ListTags`` called on the entry. * To get the template using the GetTagTemplate method, you need view access either on the project or the organization the tag template resides in but no other permission is needed. * Operations on the tag template other than viewing (for example, editing IAM policies) follow standard IAM structures. Tags created with a public tag template are referred to as public tags. You can search for a public tag by value with a simple search query instead of using a ``tag:`` predicate. Public tag templates may not appear in search results depending on scope, see: include_public_tag_templates Note: If an [IAM domain restriction](https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains) is configured in the tag template&#x27;s location, the public access will not be enabled but the simple search for tag values will still work.
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the tag template in URL format. Note: The tag template itself and its child resources might not be stored in the location specified in its name.
 }
 
@@ -173,7 +173,7 @@
       },
     },
   },
-  &quot;isPubliclyReadable&quot;: True or False, # Indicates whether this is a public tag template. Every user has view access to a *public* tag template by default. This means that: * Every user can use this tag template to tag an entry. * If an entry is tagged using the tag template, the tag is always shown in the response to ``ListTags`` called on the entry. * To get the template using the GetTagTemplate method, you need view access either on the project or the organization the tag template resides in but no other permission is needed. * Operations on the tag template other than viewing (for example, editing IAM policies) follow standard IAM structures. Tags created with a public tag template are referred to as public tags. You can search for a public tag by value with a simple search query instead of using a ``tag:`` predicate. Public tag templates may not appear in search results depending on scope, see: include_public_tag_templates
+  &quot;isPubliclyReadable&quot;: True or False, # Indicates whether this is a public tag template. Every user has view access to a *public* tag template by default. This means that: * Every user can use this tag template to tag an entry. * If an entry is tagged using the tag template, the tag is always shown in the response to ``ListTags`` called on the entry. * To get the template using the GetTagTemplate method, you need view access either on the project or the organization the tag template resides in but no other permission is needed. * Operations on the tag template other than viewing (for example, editing IAM policies) follow standard IAM structures. Tags created with a public tag template are referred to as public tags. You can search for a public tag by value with a simple search query instead of using a ``tag:`` predicate. Public tag templates may not appear in search results depending on scope, see: include_public_tag_templates Note: If an [IAM domain restriction](https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains) is configured in the tag template&#x27;s location, the public access will not be enabled but the simple search for tag values will still work.
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the tag template in URL format. Note: The tag template itself and its child resources might not be stored in the location specified in its name.
 }</pre>
 </div>
@@ -232,7 +232,7 @@
       },
     },
   },
-  &quot;isPubliclyReadable&quot;: True or False, # Indicates whether this is a public tag template. Every user has view access to a *public* tag template by default. This means that: * Every user can use this tag template to tag an entry. * If an entry is tagged using the tag template, the tag is always shown in the response to ``ListTags`` called on the entry. * To get the template using the GetTagTemplate method, you need view access either on the project or the organization the tag template resides in but no other permission is needed. * Operations on the tag template other than viewing (for example, editing IAM policies) follow standard IAM structures. Tags created with a public tag template are referred to as public tags. You can search for a public tag by value with a simple search query instead of using a ``tag:`` predicate. Public tag templates may not appear in search results depending on scope, see: include_public_tag_templates
+  &quot;isPubliclyReadable&quot;: True or False, # Indicates whether this is a public tag template. Every user has view access to a *public* tag template by default. This means that: * Every user can use this tag template to tag an entry. * If an entry is tagged using the tag template, the tag is always shown in the response to ``ListTags`` called on the entry. * To get the template using the GetTagTemplate method, you need view access either on the project or the organization the tag template resides in but no other permission is needed. * Operations on the tag template other than viewing (for example, editing IAM policies) follow standard IAM structures. Tags created with a public tag template are referred to as public tags. You can search for a public tag by value with a simple search query instead of using a ``tag:`` predicate. Public tag templates may not appear in search results depending on scope, see: include_public_tag_templates Note: If an [IAM domain restriction](https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains) is configured in the tag template&#x27;s location, the public access will not be enabled but the simple search for tag values will still work.
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the tag template in URL format. Note: The tag template itself and its child resources might not be stored in the location specified in its name.
 }</pre>
 </div>
@@ -310,7 +310,7 @@
       },
     },
   },
-  &quot;isPubliclyReadable&quot;: True or False, # Indicates whether this is a public tag template. Every user has view access to a *public* tag template by default. This means that: * Every user can use this tag template to tag an entry. * If an entry is tagged using the tag template, the tag is always shown in the response to ``ListTags`` called on the entry. * To get the template using the GetTagTemplate method, you need view access either on the project or the organization the tag template resides in but no other permission is needed. * Operations on the tag template other than viewing (for example, editing IAM policies) follow standard IAM structures. Tags created with a public tag template are referred to as public tags. You can search for a public tag by value with a simple search query instead of using a ``tag:`` predicate. Public tag templates may not appear in search results depending on scope, see: include_public_tag_templates
+  &quot;isPubliclyReadable&quot;: True or False, # Indicates whether this is a public tag template. Every user has view access to a *public* tag template by default. This means that: * Every user can use this tag template to tag an entry. * If an entry is tagged using the tag template, the tag is always shown in the response to ``ListTags`` called on the entry. * To get the template using the GetTagTemplate method, you need view access either on the project or the organization the tag template resides in but no other permission is needed. * Operations on the tag template other than viewing (for example, editing IAM policies) follow standard IAM structures. Tags created with a public tag template are referred to as public tags. You can search for a public tag by value with a simple search query instead of using a ``tag:`` predicate. Public tag templates may not appear in search results depending on scope, see: include_public_tag_templates Note: If an [IAM domain restriction](https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains) is configured in the tag template&#x27;s location, the public access will not be enabled but the simple search for tag values will still work.
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the tag template in URL format. Note: The tag template itself and its child resources might not be stored in the location specified in its name.
 }
 
@@ -344,7 +344,7 @@
       },
     },
   },
-  &quot;isPubliclyReadable&quot;: True or False, # Indicates whether this is a public tag template. Every user has view access to a *public* tag template by default. This means that: * Every user can use this tag template to tag an entry. * If an entry is tagged using the tag template, the tag is always shown in the response to ``ListTags`` called on the entry. * To get the template using the GetTagTemplate method, you need view access either on the project or the organization the tag template resides in but no other permission is needed. * Operations on the tag template other than viewing (for example, editing IAM policies) follow standard IAM structures. Tags created with a public tag template are referred to as public tags. You can search for a public tag by value with a simple search query instead of using a ``tag:`` predicate. Public tag templates may not appear in search results depending on scope, see: include_public_tag_templates
+  &quot;isPubliclyReadable&quot;: True or False, # Indicates whether this is a public tag template. Every user has view access to a *public* tag template by default. This means that: * Every user can use this tag template to tag an entry. * If an entry is tagged using the tag template, the tag is always shown in the response to ``ListTags`` called on the entry. * To get the template using the GetTagTemplate method, you need view access either on the project or the organization the tag template resides in but no other permission is needed. * Operations on the tag template other than viewing (for example, editing IAM policies) follow standard IAM structures. Tags created with a public tag template are referred to as public tags. You can search for a public tag by value with a simple search query instead of using a ``tag:`` predicate. Public tag templates may not appear in search results depending on scope, see: include_public_tag_templates Note: If an [IAM domain restriction](https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains) is configured in the tag template&#x27;s location, the public access will not be enabled but the simple search for tag values will still work.
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the tag template in URL format. Note: The tag template itself and its child resources might not be stored in the location specified in its name.
 }</pre>
 </div>
diff --git a/docs/dyn/dialogflow_v2.projects.agent.html b/docs/dyn/dialogflow_v2.projects.agent.html
index 3e05f78..42dc8db 100644
--- a/docs/dyn/dialogflow_v2.projects.agent.html
+++ b/docs/dyn/dialogflow_v2.projects.agent.html
@@ -238,7 +238,7 @@
       &quot;entries&quot;: [ # The names of the entries that the error is associated with. Format: - &quot;projects//agent&quot;, if the error is associated with the entire agent. - &quot;projects//agent/intents/&quot;, if the error is associated with certain intents. - &quot;projects//agent/intents//trainingPhrases/&quot;, if the error is associated with certain intent training phrases. - &quot;projects//agent/intents//parameters/&quot;, if the error is associated with certain intent parameters. - &quot;projects//agent/entities/&quot;, if the error is associated with certain entities.
         &quot;A String&quot;,
       ],
-      &quot;errorMessage&quot;: &quot;A String&quot;, # The detailed error messsage.
+      &quot;errorMessage&quot;: &quot;A String&quot;, # The detailed error message.
       &quot;severity&quot;: &quot;A String&quot;, # The severity of the error.
     },
   ],
diff --git a/docs/dyn/dialogflow_v2.projects.locations.agent.html b/docs/dyn/dialogflow_v2.projects.locations.agent.html
index c8f6f04..b978f50 100644
--- a/docs/dyn/dialogflow_v2.projects.locations.agent.html
+++ b/docs/dyn/dialogflow_v2.projects.locations.agent.html
@@ -233,7 +233,7 @@
       &quot;entries&quot;: [ # The names of the entries that the error is associated with. Format: - &quot;projects//agent&quot;, if the error is associated with the entire agent. - &quot;projects//agent/intents/&quot;, if the error is associated with certain intents. - &quot;projects//agent/intents//trainingPhrases/&quot;, if the error is associated with certain intent training phrases. - &quot;projects//agent/intents//parameters/&quot;, if the error is associated with certain intent parameters. - &quot;projects//agent/entities/&quot;, if the error is associated with certain entities.
         &quot;A String&quot;,
       ],
-      &quot;errorMessage&quot;: &quot;A String&quot;, # The detailed error messsage.
+      &quot;errorMessage&quot;: &quot;A String&quot;, # The detailed error message.
       &quot;severity&quot;: &quot;A String&quot;, # The severity of the error.
     },
   ],
diff --git a/docs/dyn/dialogflow_v2beta1.projects.agent.html b/docs/dyn/dialogflow_v2beta1.projects.agent.html
index 7dfc2ce..cf3a0c3 100644
--- a/docs/dyn/dialogflow_v2beta1.projects.agent.html
+++ b/docs/dyn/dialogflow_v2beta1.projects.agent.html
@@ -238,7 +238,7 @@
       &quot;entries&quot;: [ # The names of the entries that the error is associated with. Format: - &quot;projects//agent&quot;, if the error is associated with the entire agent. - &quot;projects//agent/intents/&quot;, if the error is associated with certain intents. - &quot;projects//agent/intents//trainingPhrases/&quot;, if the error is associated with certain intent training phrases. - &quot;projects//agent/intents//parameters/&quot;, if the error is associated with certain intent parameters. - &quot;projects//agent/entities/&quot;, if the error is associated with certain entities.
         &quot;A String&quot;,
       ],
-      &quot;errorMessage&quot;: &quot;A String&quot;, # The detailed error messsage.
+      &quot;errorMessage&quot;: &quot;A String&quot;, # The detailed error message.
       &quot;severity&quot;: &quot;A String&quot;, # The severity of the error.
     },
   ],
diff --git a/docs/dyn/dialogflow_v2beta1.projects.conversationProfiles.html b/docs/dyn/dialogflow_v2beta1.projects.conversationProfiles.html
index c9946d8..d291b03 100644
--- a/docs/dyn/dialogflow_v2beta1.projects.conversationProfiles.html
+++ b/docs/dyn/dialogflow_v2beta1.projects.conversationProfiles.html
@@ -217,7 +217,7 @@
       &quot;organizationId&quot;: &quot;A String&quot;, # Required. The organization ID of the Salesforce account.
     },
   },
-  &quot;languageCode&quot;: &quot;A String&quot;, # Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages.
+  &quot;languageCode&quot;: &quot;A String&quot;, # Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages. This should be a [BCP-47](https://www.rfc-editor.org/rfc/bcp/bcp47.txt) language tag. Example: &quot;en-US&quot;.
   &quot;loggingConfig&quot;: { # Defines logging behavior for conversation lifecycle events. # Configuration for logging conversation lifecycle events.
     &quot;enableStackdriverLogging&quot;: True or False, # Whether to log conversation events like CONVERSATION_STARTED to Stackdriver in the conversation project as JSON format ConversationEvent protos.
   },
@@ -230,9 +230,11 @@
     &quot;messageFormat&quot;: &quot;A String&quot;, # Format of message.
     &quot;topic&quot;: &quot;A String&quot;, # Name of the Pub/Sub topic to publish conversation events like CONVERSATION_STARTED as serialized ConversationEvent protos. Notification works for phone calls, if this topic either is in the same project as the conversation or you grant `service-@gcp-sa-dialogflow.iam.gserviceaccount.com` the `Dialogflow Service Agent` role in the topic project. Format: `projects//locations//topics/`.
   },
+  &quot;securitySettings&quot;: &quot;A String&quot;, # Name of the CX SecuritySettings reference for the agent. Format: `projects//locations//securitySettings/`.
   &quot;sttConfig&quot;: { # Configures speech transcription for ConversationProfile. # Settings for speech transcription.
     &quot;speechModelVariant&quot;: &quot;A String&quot;, # Optional. The speech model used in speech to text. `SPEECH_MODEL_VARIANT_UNSPECIFIED`, `USE_BEST_AVAILABLE` will be treated as `USE_ENHANCED`. It can be overridden in AnalyzeContentRequest and StreamingAnalyzeContentRequest request.
   },
+  &quot;timeZone&quot;: &quot;A String&quot;, # The time zone of this conversational profile from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York, Europe/Paris. Defaults to America/New_York.
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. Update time of the conversation profile.
 }
 
@@ -351,7 +353,7 @@
       &quot;organizationId&quot;: &quot;A String&quot;, # Required. The organization ID of the Salesforce account.
     },
   },
-  &quot;languageCode&quot;: &quot;A String&quot;, # Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages.
+  &quot;languageCode&quot;: &quot;A String&quot;, # Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages. This should be a [BCP-47](https://www.rfc-editor.org/rfc/bcp/bcp47.txt) language tag. Example: &quot;en-US&quot;.
   &quot;loggingConfig&quot;: { # Defines logging behavior for conversation lifecycle events. # Configuration for logging conversation lifecycle events.
     &quot;enableStackdriverLogging&quot;: True or False, # Whether to log conversation events like CONVERSATION_STARTED to Stackdriver in the conversation project as JSON format ConversationEvent protos.
   },
@@ -364,9 +366,11 @@
     &quot;messageFormat&quot;: &quot;A String&quot;, # Format of message.
     &quot;topic&quot;: &quot;A String&quot;, # Name of the Pub/Sub topic to publish conversation events like CONVERSATION_STARTED as serialized ConversationEvent protos. Notification works for phone calls, if this topic either is in the same project as the conversation or you grant `service-@gcp-sa-dialogflow.iam.gserviceaccount.com` the `Dialogflow Service Agent` role in the topic project. Format: `projects//locations//topics/`.
   },
+  &quot;securitySettings&quot;: &quot;A String&quot;, # Name of the CX SecuritySettings reference for the agent. Format: `projects//locations//securitySettings/`.
   &quot;sttConfig&quot;: { # Configures speech transcription for ConversationProfile. # Settings for speech transcription.
     &quot;speechModelVariant&quot;: &quot;A String&quot;, # Optional. The speech model used in speech to text. `SPEECH_MODEL_VARIANT_UNSPECIFIED`, `USE_BEST_AVAILABLE` will be treated as `USE_ENHANCED`. It can be overridden in AnalyzeContentRequest and StreamingAnalyzeContentRequest request.
   },
+  &quot;timeZone&quot;: &quot;A String&quot;, # The time zone of this conversational profile from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York, Europe/Paris. Defaults to America/New_York.
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. Update time of the conversation profile.
 }</pre>
 </div>
@@ -510,7 +514,7 @@
       &quot;organizationId&quot;: &quot;A String&quot;, # Required. The organization ID of the Salesforce account.
     },
   },
-  &quot;languageCode&quot;: &quot;A String&quot;, # Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages.
+  &quot;languageCode&quot;: &quot;A String&quot;, # Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages. This should be a [BCP-47](https://www.rfc-editor.org/rfc/bcp/bcp47.txt) language tag. Example: &quot;en-US&quot;.
   &quot;loggingConfig&quot;: { # Defines logging behavior for conversation lifecycle events. # Configuration for logging conversation lifecycle events.
     &quot;enableStackdriverLogging&quot;: True or False, # Whether to log conversation events like CONVERSATION_STARTED to Stackdriver in the conversation project as JSON format ConversationEvent protos.
   },
@@ -523,9 +527,11 @@
     &quot;messageFormat&quot;: &quot;A String&quot;, # Format of message.
     &quot;topic&quot;: &quot;A String&quot;, # Name of the Pub/Sub topic to publish conversation events like CONVERSATION_STARTED as serialized ConversationEvent protos. Notification works for phone calls, if this topic either is in the same project as the conversation or you grant `service-@gcp-sa-dialogflow.iam.gserviceaccount.com` the `Dialogflow Service Agent` role in the topic project. Format: `projects//locations//topics/`.
   },
+  &quot;securitySettings&quot;: &quot;A String&quot;, # Name of the CX SecuritySettings reference for the agent. Format: `projects//locations//securitySettings/`.
   &quot;sttConfig&quot;: { # Configures speech transcription for ConversationProfile. # Settings for speech transcription.
     &quot;speechModelVariant&quot;: &quot;A String&quot;, # Optional. The speech model used in speech to text. `SPEECH_MODEL_VARIANT_UNSPECIFIED`, `USE_BEST_AVAILABLE` will be treated as `USE_ENHANCED`. It can be overridden in AnalyzeContentRequest and StreamingAnalyzeContentRequest request.
   },
+  &quot;timeZone&quot;: &quot;A String&quot;, # The time zone of this conversational profile from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York, Europe/Paris. Defaults to America/New_York.
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. Update time of the conversation profile.
 }</pre>
 </div>
@@ -655,7 +661,7 @@
           &quot;organizationId&quot;: &quot;A String&quot;, # Required. The organization ID of the Salesforce account.
         },
       },
-      &quot;languageCode&quot;: &quot;A String&quot;, # Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages.
+      &quot;languageCode&quot;: &quot;A String&quot;, # Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages. This should be a [BCP-47](https://www.rfc-editor.org/rfc/bcp/bcp47.txt) language tag. Example: &quot;en-US&quot;.
       &quot;loggingConfig&quot;: { # Defines logging behavior for conversation lifecycle events. # Configuration for logging conversation lifecycle events.
         &quot;enableStackdriverLogging&quot;: True or False, # Whether to log conversation events like CONVERSATION_STARTED to Stackdriver in the conversation project as JSON format ConversationEvent protos.
       },
@@ -668,9 +674,11 @@
         &quot;messageFormat&quot;: &quot;A String&quot;, # Format of message.
         &quot;topic&quot;: &quot;A String&quot;, # Name of the Pub/Sub topic to publish conversation events like CONVERSATION_STARTED as serialized ConversationEvent protos. Notification works for phone calls, if this topic either is in the same project as the conversation or you grant `service-@gcp-sa-dialogflow.iam.gserviceaccount.com` the `Dialogflow Service Agent` role in the topic project. Format: `projects//locations//topics/`.
       },
+      &quot;securitySettings&quot;: &quot;A String&quot;, # Name of the CX SecuritySettings reference for the agent. Format: `projects//locations//securitySettings/`.
       &quot;sttConfig&quot;: { # Configures speech transcription for ConversationProfile. # Settings for speech transcription.
         &quot;speechModelVariant&quot;: &quot;A String&quot;, # Optional. The speech model used in speech to text. `SPEECH_MODEL_VARIANT_UNSPECIFIED`, `USE_BEST_AVAILABLE` will be treated as `USE_ENHANCED`. It can be overridden in AnalyzeContentRequest and StreamingAnalyzeContentRequest request.
       },
+      &quot;timeZone&quot;: &quot;A String&quot;, # The time zone of this conversational profile from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York, Europe/Paris. Defaults to America/New_York.
       &quot;updateTime&quot;: &quot;A String&quot;, # Output only. Update time of the conversation profile.
     },
   ],
@@ -808,7 +816,7 @@
       &quot;organizationId&quot;: &quot;A String&quot;, # Required. The organization ID of the Salesforce account.
     },
   },
-  &quot;languageCode&quot;: &quot;A String&quot;, # Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages.
+  &quot;languageCode&quot;: &quot;A String&quot;, # Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages. This should be a [BCP-47](https://www.rfc-editor.org/rfc/bcp/bcp47.txt) language tag. Example: &quot;en-US&quot;.
   &quot;loggingConfig&quot;: { # Defines logging behavior for conversation lifecycle events. # Configuration for logging conversation lifecycle events.
     &quot;enableStackdriverLogging&quot;: True or False, # Whether to log conversation events like CONVERSATION_STARTED to Stackdriver in the conversation project as JSON format ConversationEvent protos.
   },
@@ -821,9 +829,11 @@
     &quot;messageFormat&quot;: &quot;A String&quot;, # Format of message.
     &quot;topic&quot;: &quot;A String&quot;, # Name of the Pub/Sub topic to publish conversation events like CONVERSATION_STARTED as serialized ConversationEvent protos. Notification works for phone calls, if this topic either is in the same project as the conversation or you grant `service-@gcp-sa-dialogflow.iam.gserviceaccount.com` the `Dialogflow Service Agent` role in the topic project. Format: `projects//locations//topics/`.
   },
+  &quot;securitySettings&quot;: &quot;A String&quot;, # Name of the CX SecuritySettings reference for the agent. Format: `projects//locations//securitySettings/`.
   &quot;sttConfig&quot;: { # Configures speech transcription for ConversationProfile. # Settings for speech transcription.
     &quot;speechModelVariant&quot;: &quot;A String&quot;, # Optional. The speech model used in speech to text. `SPEECH_MODEL_VARIANT_UNSPECIFIED`, `USE_BEST_AVAILABLE` will be treated as `USE_ENHANCED`. It can be overridden in AnalyzeContentRequest and StreamingAnalyzeContentRequest request.
   },
+  &quot;timeZone&quot;: &quot;A String&quot;, # The time zone of this conversational profile from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York, Europe/Paris. Defaults to America/New_York.
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. Update time of the conversation profile.
 }
 
@@ -943,7 +953,7 @@
       &quot;organizationId&quot;: &quot;A String&quot;, # Required. The organization ID of the Salesforce account.
     },
   },
-  &quot;languageCode&quot;: &quot;A String&quot;, # Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages.
+  &quot;languageCode&quot;: &quot;A String&quot;, # Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages. This should be a [BCP-47](https://www.rfc-editor.org/rfc/bcp/bcp47.txt) language tag. Example: &quot;en-US&quot;.
   &quot;loggingConfig&quot;: { # Defines logging behavior for conversation lifecycle events. # Configuration for logging conversation lifecycle events.
     &quot;enableStackdriverLogging&quot;: True or False, # Whether to log conversation events like CONVERSATION_STARTED to Stackdriver in the conversation project as JSON format ConversationEvent protos.
   },
@@ -956,9 +966,11 @@
     &quot;messageFormat&quot;: &quot;A String&quot;, # Format of message.
     &quot;topic&quot;: &quot;A String&quot;, # Name of the Pub/Sub topic to publish conversation events like CONVERSATION_STARTED as serialized ConversationEvent protos. Notification works for phone calls, if this topic either is in the same project as the conversation or you grant `service-@gcp-sa-dialogflow.iam.gserviceaccount.com` the `Dialogflow Service Agent` role in the topic project. Format: `projects//locations//topics/`.
   },
+  &quot;securitySettings&quot;: &quot;A String&quot;, # Name of the CX SecuritySettings reference for the agent. Format: `projects//locations//securitySettings/`.
   &quot;sttConfig&quot;: { # Configures speech transcription for ConversationProfile. # Settings for speech transcription.
     &quot;speechModelVariant&quot;: &quot;A String&quot;, # Optional. The speech model used in speech to text. `SPEECH_MODEL_VARIANT_UNSPECIFIED`, `USE_BEST_AVAILABLE` will be treated as `USE_ENHANCED`. It can be overridden in AnalyzeContentRequest and StreamingAnalyzeContentRequest request.
   },
+  &quot;timeZone&quot;: &quot;A String&quot;, # The time zone of this conversational profile from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York, Europe/Paris. Defaults to America/New_York.
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. Update time of the conversation profile.
 }</pre>
 </div>
diff --git a/docs/dyn/dialogflow_v2beta1.projects.locations.agent.html b/docs/dyn/dialogflow_v2beta1.projects.locations.agent.html
index 356ef85..62e5fad 100644
--- a/docs/dyn/dialogflow_v2beta1.projects.locations.agent.html
+++ b/docs/dyn/dialogflow_v2beta1.projects.locations.agent.html
@@ -233,7 +233,7 @@
       &quot;entries&quot;: [ # The names of the entries that the error is associated with. Format: - &quot;projects//agent&quot;, if the error is associated with the entire agent. - &quot;projects//agent/intents/&quot;, if the error is associated with certain intents. - &quot;projects//agent/intents//trainingPhrases/&quot;, if the error is associated with certain intent training phrases. - &quot;projects//agent/intents//parameters/&quot;, if the error is associated with certain intent parameters. - &quot;projects//agent/entities/&quot;, if the error is associated with certain entities.
         &quot;A String&quot;,
       ],
-      &quot;errorMessage&quot;: &quot;A String&quot;, # The detailed error messsage.
+      &quot;errorMessage&quot;: &quot;A String&quot;, # The detailed error message.
       &quot;severity&quot;: &quot;A String&quot;, # The severity of the error.
     },
   ],
diff --git a/docs/dyn/dialogflow_v2beta1.projects.locations.conversationProfiles.html b/docs/dyn/dialogflow_v2beta1.projects.locations.conversationProfiles.html
index b46ae42..33419ce 100644
--- a/docs/dyn/dialogflow_v2beta1.projects.locations.conversationProfiles.html
+++ b/docs/dyn/dialogflow_v2beta1.projects.locations.conversationProfiles.html
@@ -217,7 +217,7 @@
       &quot;organizationId&quot;: &quot;A String&quot;, # Required. The organization ID of the Salesforce account.
     },
   },
-  &quot;languageCode&quot;: &quot;A String&quot;, # Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages.
+  &quot;languageCode&quot;: &quot;A String&quot;, # Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages. This should be a [BCP-47](https://www.rfc-editor.org/rfc/bcp/bcp47.txt) language tag. Example: &quot;en-US&quot;.
   &quot;loggingConfig&quot;: { # Defines logging behavior for conversation lifecycle events. # Configuration for logging conversation lifecycle events.
     &quot;enableStackdriverLogging&quot;: True or False, # Whether to log conversation events like CONVERSATION_STARTED to Stackdriver in the conversation project as JSON format ConversationEvent protos.
   },
@@ -230,9 +230,11 @@
     &quot;messageFormat&quot;: &quot;A String&quot;, # Format of message.
     &quot;topic&quot;: &quot;A String&quot;, # Name of the Pub/Sub topic to publish conversation events like CONVERSATION_STARTED as serialized ConversationEvent protos. Notification works for phone calls, if this topic either is in the same project as the conversation or you grant `service-@gcp-sa-dialogflow.iam.gserviceaccount.com` the `Dialogflow Service Agent` role in the topic project. Format: `projects//locations//topics/`.
   },
+  &quot;securitySettings&quot;: &quot;A String&quot;, # Name of the CX SecuritySettings reference for the agent. Format: `projects//locations//securitySettings/`.
   &quot;sttConfig&quot;: { # Configures speech transcription for ConversationProfile. # Settings for speech transcription.
     &quot;speechModelVariant&quot;: &quot;A String&quot;, # Optional. The speech model used in speech to text. `SPEECH_MODEL_VARIANT_UNSPECIFIED`, `USE_BEST_AVAILABLE` will be treated as `USE_ENHANCED`. It can be overridden in AnalyzeContentRequest and StreamingAnalyzeContentRequest request.
   },
+  &quot;timeZone&quot;: &quot;A String&quot;, # The time zone of this conversational profile from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York, Europe/Paris. Defaults to America/New_York.
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. Update time of the conversation profile.
 }
 
@@ -351,7 +353,7 @@
       &quot;organizationId&quot;: &quot;A String&quot;, # Required. The organization ID of the Salesforce account.
     },
   },
-  &quot;languageCode&quot;: &quot;A String&quot;, # Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages.
+  &quot;languageCode&quot;: &quot;A String&quot;, # Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages. This should be a [BCP-47](https://www.rfc-editor.org/rfc/bcp/bcp47.txt) language tag. Example: &quot;en-US&quot;.
   &quot;loggingConfig&quot;: { # Defines logging behavior for conversation lifecycle events. # Configuration for logging conversation lifecycle events.
     &quot;enableStackdriverLogging&quot;: True or False, # Whether to log conversation events like CONVERSATION_STARTED to Stackdriver in the conversation project as JSON format ConversationEvent protos.
   },
@@ -364,9 +366,11 @@
     &quot;messageFormat&quot;: &quot;A String&quot;, # Format of message.
     &quot;topic&quot;: &quot;A String&quot;, # Name of the Pub/Sub topic to publish conversation events like CONVERSATION_STARTED as serialized ConversationEvent protos. Notification works for phone calls, if this topic either is in the same project as the conversation or you grant `service-@gcp-sa-dialogflow.iam.gserviceaccount.com` the `Dialogflow Service Agent` role in the topic project. Format: `projects//locations//topics/`.
   },
+  &quot;securitySettings&quot;: &quot;A String&quot;, # Name of the CX SecuritySettings reference for the agent. Format: `projects//locations//securitySettings/`.
   &quot;sttConfig&quot;: { # Configures speech transcription for ConversationProfile. # Settings for speech transcription.
     &quot;speechModelVariant&quot;: &quot;A String&quot;, # Optional. The speech model used in speech to text. `SPEECH_MODEL_VARIANT_UNSPECIFIED`, `USE_BEST_AVAILABLE` will be treated as `USE_ENHANCED`. It can be overridden in AnalyzeContentRequest and StreamingAnalyzeContentRequest request.
   },
+  &quot;timeZone&quot;: &quot;A String&quot;, # The time zone of this conversational profile from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York, Europe/Paris. Defaults to America/New_York.
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. Update time of the conversation profile.
 }</pre>
 </div>
@@ -510,7 +514,7 @@
       &quot;organizationId&quot;: &quot;A String&quot;, # Required. The organization ID of the Salesforce account.
     },
   },
-  &quot;languageCode&quot;: &quot;A String&quot;, # Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages.
+  &quot;languageCode&quot;: &quot;A String&quot;, # Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages. This should be a [BCP-47](https://www.rfc-editor.org/rfc/bcp/bcp47.txt) language tag. Example: &quot;en-US&quot;.
   &quot;loggingConfig&quot;: { # Defines logging behavior for conversation lifecycle events. # Configuration for logging conversation lifecycle events.
     &quot;enableStackdriverLogging&quot;: True or False, # Whether to log conversation events like CONVERSATION_STARTED to Stackdriver in the conversation project as JSON format ConversationEvent protos.
   },
@@ -523,9 +527,11 @@
     &quot;messageFormat&quot;: &quot;A String&quot;, # Format of message.
     &quot;topic&quot;: &quot;A String&quot;, # Name of the Pub/Sub topic to publish conversation events like CONVERSATION_STARTED as serialized ConversationEvent protos. Notification works for phone calls, if this topic either is in the same project as the conversation or you grant `service-@gcp-sa-dialogflow.iam.gserviceaccount.com` the `Dialogflow Service Agent` role in the topic project. Format: `projects//locations//topics/`.
   },
+  &quot;securitySettings&quot;: &quot;A String&quot;, # Name of the CX SecuritySettings reference for the agent. Format: `projects//locations//securitySettings/`.
   &quot;sttConfig&quot;: { # Configures speech transcription for ConversationProfile. # Settings for speech transcription.
     &quot;speechModelVariant&quot;: &quot;A String&quot;, # Optional. The speech model used in speech to text. `SPEECH_MODEL_VARIANT_UNSPECIFIED`, `USE_BEST_AVAILABLE` will be treated as `USE_ENHANCED`. It can be overridden in AnalyzeContentRequest and StreamingAnalyzeContentRequest request.
   },
+  &quot;timeZone&quot;: &quot;A String&quot;, # The time zone of this conversational profile from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York, Europe/Paris. Defaults to America/New_York.
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. Update time of the conversation profile.
 }</pre>
 </div>
@@ -655,7 +661,7 @@
           &quot;organizationId&quot;: &quot;A String&quot;, # Required. The organization ID of the Salesforce account.
         },
       },
-      &quot;languageCode&quot;: &quot;A String&quot;, # Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages.
+      &quot;languageCode&quot;: &quot;A String&quot;, # Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages. This should be a [BCP-47](https://www.rfc-editor.org/rfc/bcp/bcp47.txt) language tag. Example: &quot;en-US&quot;.
       &quot;loggingConfig&quot;: { # Defines logging behavior for conversation lifecycle events. # Configuration for logging conversation lifecycle events.
         &quot;enableStackdriverLogging&quot;: True or False, # Whether to log conversation events like CONVERSATION_STARTED to Stackdriver in the conversation project as JSON format ConversationEvent protos.
       },
@@ -668,9 +674,11 @@
         &quot;messageFormat&quot;: &quot;A String&quot;, # Format of message.
         &quot;topic&quot;: &quot;A String&quot;, # Name of the Pub/Sub topic to publish conversation events like CONVERSATION_STARTED as serialized ConversationEvent protos. Notification works for phone calls, if this topic either is in the same project as the conversation or you grant `service-@gcp-sa-dialogflow.iam.gserviceaccount.com` the `Dialogflow Service Agent` role in the topic project. Format: `projects//locations//topics/`.
       },
+      &quot;securitySettings&quot;: &quot;A String&quot;, # Name of the CX SecuritySettings reference for the agent. Format: `projects//locations//securitySettings/`.
       &quot;sttConfig&quot;: { # Configures speech transcription for ConversationProfile. # Settings for speech transcription.
         &quot;speechModelVariant&quot;: &quot;A String&quot;, # Optional. The speech model used in speech to text. `SPEECH_MODEL_VARIANT_UNSPECIFIED`, `USE_BEST_AVAILABLE` will be treated as `USE_ENHANCED`. It can be overridden in AnalyzeContentRequest and StreamingAnalyzeContentRequest request.
       },
+      &quot;timeZone&quot;: &quot;A String&quot;, # The time zone of this conversational profile from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York, Europe/Paris. Defaults to America/New_York.
       &quot;updateTime&quot;: &quot;A String&quot;, # Output only. Update time of the conversation profile.
     },
   ],
@@ -808,7 +816,7 @@
       &quot;organizationId&quot;: &quot;A String&quot;, # Required. The organization ID of the Salesforce account.
     },
   },
-  &quot;languageCode&quot;: &quot;A String&quot;, # Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages.
+  &quot;languageCode&quot;: &quot;A String&quot;, # Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages. This should be a [BCP-47](https://www.rfc-editor.org/rfc/bcp/bcp47.txt) language tag. Example: &quot;en-US&quot;.
   &quot;loggingConfig&quot;: { # Defines logging behavior for conversation lifecycle events. # Configuration for logging conversation lifecycle events.
     &quot;enableStackdriverLogging&quot;: True or False, # Whether to log conversation events like CONVERSATION_STARTED to Stackdriver in the conversation project as JSON format ConversationEvent protos.
   },
@@ -821,9 +829,11 @@
     &quot;messageFormat&quot;: &quot;A String&quot;, # Format of message.
     &quot;topic&quot;: &quot;A String&quot;, # Name of the Pub/Sub topic to publish conversation events like CONVERSATION_STARTED as serialized ConversationEvent protos. Notification works for phone calls, if this topic either is in the same project as the conversation or you grant `service-@gcp-sa-dialogflow.iam.gserviceaccount.com` the `Dialogflow Service Agent` role in the topic project. Format: `projects//locations//topics/`.
   },
+  &quot;securitySettings&quot;: &quot;A String&quot;, # Name of the CX SecuritySettings reference for the agent. Format: `projects//locations//securitySettings/`.
   &quot;sttConfig&quot;: { # Configures speech transcription for ConversationProfile. # Settings for speech transcription.
     &quot;speechModelVariant&quot;: &quot;A String&quot;, # Optional. The speech model used in speech to text. `SPEECH_MODEL_VARIANT_UNSPECIFIED`, `USE_BEST_AVAILABLE` will be treated as `USE_ENHANCED`. It can be overridden in AnalyzeContentRequest and StreamingAnalyzeContentRequest request.
   },
+  &quot;timeZone&quot;: &quot;A String&quot;, # The time zone of this conversational profile from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York, Europe/Paris. Defaults to America/New_York.
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. Update time of the conversation profile.
 }
 
@@ -943,7 +953,7 @@
       &quot;organizationId&quot;: &quot;A String&quot;, # Required. The organization ID of the Salesforce account.
     },
   },
-  &quot;languageCode&quot;: &quot;A String&quot;, # Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages.
+  &quot;languageCode&quot;: &quot;A String&quot;, # Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages. This should be a [BCP-47](https://www.rfc-editor.org/rfc/bcp/bcp47.txt) language tag. Example: &quot;en-US&quot;.
   &quot;loggingConfig&quot;: { # Defines logging behavior for conversation lifecycle events. # Configuration for logging conversation lifecycle events.
     &quot;enableStackdriverLogging&quot;: True or False, # Whether to log conversation events like CONVERSATION_STARTED to Stackdriver in the conversation project as JSON format ConversationEvent protos.
   },
@@ -956,9 +966,11 @@
     &quot;messageFormat&quot;: &quot;A String&quot;, # Format of message.
     &quot;topic&quot;: &quot;A String&quot;, # Name of the Pub/Sub topic to publish conversation events like CONVERSATION_STARTED as serialized ConversationEvent protos. Notification works for phone calls, if this topic either is in the same project as the conversation or you grant `service-@gcp-sa-dialogflow.iam.gserviceaccount.com` the `Dialogflow Service Agent` role in the topic project. Format: `projects//locations//topics/`.
   },
+  &quot;securitySettings&quot;: &quot;A String&quot;, # Name of the CX SecuritySettings reference for the agent. Format: `projects//locations//securitySettings/`.
   &quot;sttConfig&quot;: { # Configures speech transcription for ConversationProfile. # Settings for speech transcription.
     &quot;speechModelVariant&quot;: &quot;A String&quot;, # Optional. The speech model used in speech to text. `SPEECH_MODEL_VARIANT_UNSPECIFIED`, `USE_BEST_AVAILABLE` will be treated as `USE_ENHANCED`. It can be overridden in AnalyzeContentRequest and StreamingAnalyzeContentRequest request.
   },
+  &quot;timeZone&quot;: &quot;A String&quot;, # The time zone of this conversational profile from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York, Europe/Paris. Defaults to America/New_York.
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. Update time of the conversation profile.
 }</pre>
 </div>
diff --git a/docs/dyn/dialogflow_v3.projects.locations.agents.environments.sessions.html b/docs/dyn/dialogflow_v3.projects.locations.agents.environments.sessions.html
index e77a628..b52ffdb 100644
--- a/docs/dyn/dialogflow_v3.projects.locations.agents.environments.sessions.html
+++ b/docs/dyn/dialogflow_v3.projects.locations.agents.environments.sessions.html
@@ -157,6 +157,9 @@
     &quot;analyzeQueryTextSentiment&quot;: True or False, # Configures whether sentiment analysis should be performed. If not provided, sentiment analysis is not performed.
     &quot;currentPage&quot;: &quot;A String&quot;, # The unique identifier of the page to override the current page in the session. Format: `projects//locations//agents//flows//pages/`. If `current_page` is specified, the previous state of the session will be ignored by Dialogflow, including the previous page and the previous session parameters. In most cases, current_page and parameters should be configured together to direct a session to a specific state.
     &quot;disableWebhook&quot;: True or False, # Whether to disable webhook calls for this request.
+    &quot;flowVersions&quot;: [ # A list of flow versions to override for the request. Format: `projects//locations//agents//flows//versions/`. If version 1 of flow X is included in this list, the traffic of flow X will go through version 1 regardless of the version configuration in the environment. Each flow can have at most one version specified in this list.
+      &quot;A String&quot;,
+    ],
     &quot;geoLocation&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # The geo location of this conversational query.
       &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
       &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
@@ -1041,6 +1044,9 @@
       &quot;analyzeQueryTextSentiment&quot;: True or False, # Configures whether sentiment analysis should be performed. If not provided, sentiment analysis is not performed.
       &quot;currentPage&quot;: &quot;A String&quot;, # The unique identifier of the page to override the current page in the session. Format: `projects//locations//agents//flows//pages/`. If `current_page` is specified, the previous state of the session will be ignored by Dialogflow, including the previous page and the previous session parameters. In most cases, current_page and parameters should be configured together to direct a session to a specific state.
       &quot;disableWebhook&quot;: True or False, # Whether to disable webhook calls for this request.
+      &quot;flowVersions&quot;: [ # A list of flow versions to override for the request. Format: `projects//locations//agents//flows//versions/`. If version 1 of flow X is included in this list, the traffic of flow X will go through version 1 regardless of the version configuration in the environment. Each flow can have at most one version specified in this list.
+        &quot;A String&quot;,
+      ],
       &quot;geoLocation&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # The geo location of this conversational query.
         &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
         &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
@@ -1900,6 +1906,9 @@
     &quot;analyzeQueryTextSentiment&quot;: True or False, # Configures whether sentiment analysis should be performed. If not provided, sentiment analysis is not performed.
     &quot;currentPage&quot;: &quot;A String&quot;, # The unique identifier of the page to override the current page in the session. Format: `projects//locations//agents//flows//pages/`. If `current_page` is specified, the previous state of the session will be ignored by Dialogflow, including the previous page and the previous session parameters. In most cases, current_page and parameters should be configured together to direct a session to a specific state.
     &quot;disableWebhook&quot;: True or False, # Whether to disable webhook calls for this request.
+    &quot;flowVersions&quot;: [ # A list of flow versions to override for the request. Format: `projects//locations//agents//flows//versions/`. If version 1 of flow X is included in this list, the traffic of flow X will go through version 1 regardless of the version configuration in the environment. Each flow can have at most one version specified in this list.
+      &quot;A String&quot;,
+    ],
     &quot;geoLocation&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # The geo location of this conversational query.
       &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
       &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
diff --git a/docs/dyn/dialogflow_v3.projects.locations.agents.html b/docs/dyn/dialogflow_v3.projects.locations.agents.html
index ba66a09..3b0e1cc 100644
--- a/docs/dyn/dialogflow_v3.projects.locations.agents.html
+++ b/docs/dyn/dialogflow_v3.projects.locations.agents.html
@@ -158,12 +158,18 @@
     The object takes the form of:
 
 { # Agents are best described as Natural Language Understanding (NLU) modules that transform user requests into actionable data. You can include agents in your app, product, or service to determine user intent and respond to the user in a natural way. After you create an agent, you can add Intents, Entity Types, Flows, Fulfillments, Webhooks, and so on to manage the conversation flows..
+  &quot;advancedSettings&quot;: { # Hierarchical advanced settings for agent/flow/page/fulfillment/parameter. Settings exposed at lower level overrides the settings exposed at higher level. Hierarchy: Agent-&gt;Flow-&gt;Page-&gt;Fulfillment/Parameter. # Hierarchical advanced settings for this agent. The settings exposed at the lower level overrides the settings exposed at the higher level.
+    &quot;loggingSettings&quot;: { # Define behaviors on logging. # Settings for logging. Settings for Dialogflow History, Contact Center messages, StackDriver logs, and speech logging. Exposed at the following levels: - Agent level.
+      &quot;enableInteractionLogging&quot;: True or False, # If true, DF Interaction logging is currently enabled.
+      &quot;enableStackdriverLogging&quot;: True or False, # If true, StackDriver logging is currently enabled.
+    },
+  },
   &quot;avatarUri&quot;: &quot;A String&quot;, # The URI of the agent&#x27;s avatar. Avatars are used throughout the Dialogflow console and in the self-hosted [Web Demo](https://cloud.google.com/dialogflow/docs/integrations/web-demo) integration.
   &quot;defaultLanguageCode&quot;: &quot;A String&quot;, # Required. Immutable. The default language of the agent as a language tag. See [Language Support](https://cloud.google.com/dialogflow/cx/docs/reference/language) for a list of the currently supported language codes. This field cannot be set by the Agents.UpdateAgent method.
   &quot;description&quot;: &quot;A String&quot;, # The description of the agent. The maximum length is 500 characters. If exceeded, the request is rejected.
   &quot;displayName&quot;: &quot;A String&quot;, # Required. The human-readable name of the agent, unique within the location.
   &quot;enableSpellCorrection&quot;: True or False, # Indicates if automatic spell correction is enabled in detect intent requests.
-  &quot;enableStackdriverLogging&quot;: True or False, # Indicates if stackdriver logging is enabled for the agent.
+  &quot;enableStackdriverLogging&quot;: True or False, # Indicates if stackdriver logging is enabled for the agent. Please use agent.advanced_settings instead.
   &quot;name&quot;: &quot;A String&quot;, # The unique identifier of the agent. Required for the Agents.UpdateAgent method. Agents.CreateAgent populates the name automatically. Format: `projects//locations//agents/`.
   &quot;securitySettings&quot;: &quot;A String&quot;, # Name of the SecuritySettings reference for the agent. Format: `projects//locations//securitySettings/`.
   &quot;speechToTextSettings&quot;: { # Settings related to speech recognition. # Speech recognition related settings.
@@ -185,12 +191,18 @@
   An object of the form:
 
     { # Agents are best described as Natural Language Understanding (NLU) modules that transform user requests into actionable data. You can include agents in your app, product, or service to determine user intent and respond to the user in a natural way. After you create an agent, you can add Intents, Entity Types, Flows, Fulfillments, Webhooks, and so on to manage the conversation flows..
+  &quot;advancedSettings&quot;: { # Hierarchical advanced settings for agent/flow/page/fulfillment/parameter. Settings exposed at lower level overrides the settings exposed at higher level. Hierarchy: Agent-&gt;Flow-&gt;Page-&gt;Fulfillment/Parameter. # Hierarchical advanced settings for this agent. The settings exposed at the lower level overrides the settings exposed at the higher level.
+    &quot;loggingSettings&quot;: { # Define behaviors on logging. # Settings for logging. Settings for Dialogflow History, Contact Center messages, StackDriver logs, and speech logging. Exposed at the following levels: - Agent level.
+      &quot;enableInteractionLogging&quot;: True or False, # If true, DF Interaction logging is currently enabled.
+      &quot;enableStackdriverLogging&quot;: True or False, # If true, StackDriver logging is currently enabled.
+    },
+  },
   &quot;avatarUri&quot;: &quot;A String&quot;, # The URI of the agent&#x27;s avatar. Avatars are used throughout the Dialogflow console and in the self-hosted [Web Demo](https://cloud.google.com/dialogflow/docs/integrations/web-demo) integration.
   &quot;defaultLanguageCode&quot;: &quot;A String&quot;, # Required. Immutable. The default language of the agent as a language tag. See [Language Support](https://cloud.google.com/dialogflow/cx/docs/reference/language) for a list of the currently supported language codes. This field cannot be set by the Agents.UpdateAgent method.
   &quot;description&quot;: &quot;A String&quot;, # The description of the agent. The maximum length is 500 characters. If exceeded, the request is rejected.
   &quot;displayName&quot;: &quot;A String&quot;, # Required. The human-readable name of the agent, unique within the location.
   &quot;enableSpellCorrection&quot;: True or False, # Indicates if automatic spell correction is enabled in detect intent requests.
-  &quot;enableStackdriverLogging&quot;: True or False, # Indicates if stackdriver logging is enabled for the agent.
+  &quot;enableStackdriverLogging&quot;: True or False, # Indicates if stackdriver logging is enabled for the agent. Please use agent.advanced_settings instead.
   &quot;name&quot;: &quot;A String&quot;, # The unique identifier of the agent. Required for the Agents.UpdateAgent method. Agents.CreateAgent populates the name automatically. Format: `projects//locations//agents/`.
   &quot;securitySettings&quot;: &quot;A String&quot;, # Name of the SecuritySettings reference for the agent. Format: `projects//locations//securitySettings/`.
   &quot;speechToTextSettings&quot;: { # Settings related to speech recognition. # Speech recognition related settings.
@@ -280,12 +292,18 @@
   An object of the form:
 
     { # Agents are best described as Natural Language Understanding (NLU) modules that transform user requests into actionable data. You can include agents in your app, product, or service to determine user intent and respond to the user in a natural way. After you create an agent, you can add Intents, Entity Types, Flows, Fulfillments, Webhooks, and so on to manage the conversation flows..
+  &quot;advancedSettings&quot;: { # Hierarchical advanced settings for agent/flow/page/fulfillment/parameter. Settings exposed at lower level overrides the settings exposed at higher level. Hierarchy: Agent-&gt;Flow-&gt;Page-&gt;Fulfillment/Parameter. # Hierarchical advanced settings for this agent. The settings exposed at the lower level overrides the settings exposed at the higher level.
+    &quot;loggingSettings&quot;: { # Define behaviors on logging. # Settings for logging. Settings for Dialogflow History, Contact Center messages, StackDriver logs, and speech logging. Exposed at the following levels: - Agent level.
+      &quot;enableInteractionLogging&quot;: True or False, # If true, DF Interaction logging is currently enabled.
+      &quot;enableStackdriverLogging&quot;: True or False, # If true, StackDriver logging is currently enabled.
+    },
+  },
   &quot;avatarUri&quot;: &quot;A String&quot;, # The URI of the agent&#x27;s avatar. Avatars are used throughout the Dialogflow console and in the self-hosted [Web Demo](https://cloud.google.com/dialogflow/docs/integrations/web-demo) integration.
   &quot;defaultLanguageCode&quot;: &quot;A String&quot;, # Required. Immutable. The default language of the agent as a language tag. See [Language Support](https://cloud.google.com/dialogflow/cx/docs/reference/language) for a list of the currently supported language codes. This field cannot be set by the Agents.UpdateAgent method.
   &quot;description&quot;: &quot;A String&quot;, # The description of the agent. The maximum length is 500 characters. If exceeded, the request is rejected.
   &quot;displayName&quot;: &quot;A String&quot;, # Required. The human-readable name of the agent, unique within the location.
   &quot;enableSpellCorrection&quot;: True or False, # Indicates if automatic spell correction is enabled in detect intent requests.
-  &quot;enableStackdriverLogging&quot;: True or False, # Indicates if stackdriver logging is enabled for the agent.
+  &quot;enableStackdriverLogging&quot;: True or False, # Indicates if stackdriver logging is enabled for the agent. Please use agent.advanced_settings instead.
   &quot;name&quot;: &quot;A String&quot;, # The unique identifier of the agent. Required for the Agents.UpdateAgent method. Agents.CreateAgent populates the name automatically. Format: `projects//locations//agents/`.
   &quot;securitySettings&quot;: &quot;A String&quot;, # Name of the SecuritySettings reference for the agent. Format: `projects//locations//securitySettings/`.
   &quot;speechToTextSettings&quot;: { # Settings related to speech recognition. # Speech recognition related settings.
@@ -360,12 +378,18 @@
     { # The response message for Agents.ListAgents.
   &quot;agents&quot;: [ # The list of agents. There will be a maximum number of items returned based on the page_size field in the request.
     { # Agents are best described as Natural Language Understanding (NLU) modules that transform user requests into actionable data. You can include agents in your app, product, or service to determine user intent and respond to the user in a natural way. After you create an agent, you can add Intents, Entity Types, Flows, Fulfillments, Webhooks, and so on to manage the conversation flows..
+      &quot;advancedSettings&quot;: { # Hierarchical advanced settings for agent/flow/page/fulfillment/parameter. Settings exposed at lower level overrides the settings exposed at higher level. Hierarchy: Agent-&gt;Flow-&gt;Page-&gt;Fulfillment/Parameter. # Hierarchical advanced settings for this agent. The settings exposed at the lower level overrides the settings exposed at the higher level.
+        &quot;loggingSettings&quot;: { # Define behaviors on logging. # Settings for logging. Settings for Dialogflow History, Contact Center messages, StackDriver logs, and speech logging. Exposed at the following levels: - Agent level.
+          &quot;enableInteractionLogging&quot;: True or False, # If true, DF Interaction logging is currently enabled.
+          &quot;enableStackdriverLogging&quot;: True or False, # If true, StackDriver logging is currently enabled.
+        },
+      },
       &quot;avatarUri&quot;: &quot;A String&quot;, # The URI of the agent&#x27;s avatar. Avatars are used throughout the Dialogflow console and in the self-hosted [Web Demo](https://cloud.google.com/dialogflow/docs/integrations/web-demo) integration.
       &quot;defaultLanguageCode&quot;: &quot;A String&quot;, # Required. Immutable. The default language of the agent as a language tag. See [Language Support](https://cloud.google.com/dialogflow/cx/docs/reference/language) for a list of the currently supported language codes. This field cannot be set by the Agents.UpdateAgent method.
       &quot;description&quot;: &quot;A String&quot;, # The description of the agent. The maximum length is 500 characters. If exceeded, the request is rejected.
       &quot;displayName&quot;: &quot;A String&quot;, # Required. The human-readable name of the agent, unique within the location.
       &quot;enableSpellCorrection&quot;: True or False, # Indicates if automatic spell correction is enabled in detect intent requests.
-      &quot;enableStackdriverLogging&quot;: True or False, # Indicates if stackdriver logging is enabled for the agent.
+      &quot;enableStackdriverLogging&quot;: True or False, # Indicates if stackdriver logging is enabled for the agent. Please use agent.advanced_settings instead.
       &quot;name&quot;: &quot;A String&quot;, # The unique identifier of the agent. Required for the Agents.UpdateAgent method. Agents.CreateAgent populates the name automatically. Format: `projects//locations//agents/`.
       &quot;securitySettings&quot;: &quot;A String&quot;, # Name of the SecuritySettings reference for the agent. Format: `projects//locations//securitySettings/`.
       &quot;speechToTextSettings&quot;: { # Settings related to speech recognition. # Speech recognition related settings.
@@ -406,12 +430,18 @@
     The object takes the form of:
 
 { # Agents are best described as Natural Language Understanding (NLU) modules that transform user requests into actionable data. You can include agents in your app, product, or service to determine user intent and respond to the user in a natural way. After you create an agent, you can add Intents, Entity Types, Flows, Fulfillments, Webhooks, and so on to manage the conversation flows..
+  &quot;advancedSettings&quot;: { # Hierarchical advanced settings for agent/flow/page/fulfillment/parameter. Settings exposed at lower level overrides the settings exposed at higher level. Hierarchy: Agent-&gt;Flow-&gt;Page-&gt;Fulfillment/Parameter. # Hierarchical advanced settings for this agent. The settings exposed at the lower level overrides the settings exposed at the higher level.
+    &quot;loggingSettings&quot;: { # Define behaviors on logging. # Settings for logging. Settings for Dialogflow History, Contact Center messages, StackDriver logs, and speech logging. Exposed at the following levels: - Agent level.
+      &quot;enableInteractionLogging&quot;: True or False, # If true, DF Interaction logging is currently enabled.
+      &quot;enableStackdriverLogging&quot;: True or False, # If true, StackDriver logging is currently enabled.
+    },
+  },
   &quot;avatarUri&quot;: &quot;A String&quot;, # The URI of the agent&#x27;s avatar. Avatars are used throughout the Dialogflow console and in the self-hosted [Web Demo](https://cloud.google.com/dialogflow/docs/integrations/web-demo) integration.
   &quot;defaultLanguageCode&quot;: &quot;A String&quot;, # Required. Immutable. The default language of the agent as a language tag. See [Language Support](https://cloud.google.com/dialogflow/cx/docs/reference/language) for a list of the currently supported language codes. This field cannot be set by the Agents.UpdateAgent method.
   &quot;description&quot;: &quot;A String&quot;, # The description of the agent. The maximum length is 500 characters. If exceeded, the request is rejected.
   &quot;displayName&quot;: &quot;A String&quot;, # Required. The human-readable name of the agent, unique within the location.
   &quot;enableSpellCorrection&quot;: True or False, # Indicates if automatic spell correction is enabled in detect intent requests.
-  &quot;enableStackdriverLogging&quot;: True or False, # Indicates if stackdriver logging is enabled for the agent.
+  &quot;enableStackdriverLogging&quot;: True or False, # Indicates if stackdriver logging is enabled for the agent. Please use agent.advanced_settings instead.
   &quot;name&quot;: &quot;A String&quot;, # The unique identifier of the agent. Required for the Agents.UpdateAgent method. Agents.CreateAgent populates the name automatically. Format: `projects//locations//agents/`.
   &quot;securitySettings&quot;: &quot;A String&quot;, # Name of the SecuritySettings reference for the agent. Format: `projects//locations//securitySettings/`.
   &quot;speechToTextSettings&quot;: { # Settings related to speech recognition. # Speech recognition related settings.
@@ -434,12 +464,18 @@
   An object of the form:
 
     { # Agents are best described as Natural Language Understanding (NLU) modules that transform user requests into actionable data. You can include agents in your app, product, or service to determine user intent and respond to the user in a natural way. After you create an agent, you can add Intents, Entity Types, Flows, Fulfillments, Webhooks, and so on to manage the conversation flows..
+  &quot;advancedSettings&quot;: { # Hierarchical advanced settings for agent/flow/page/fulfillment/parameter. Settings exposed at lower level overrides the settings exposed at higher level. Hierarchy: Agent-&gt;Flow-&gt;Page-&gt;Fulfillment/Parameter. # Hierarchical advanced settings for this agent. The settings exposed at the lower level overrides the settings exposed at the higher level.
+    &quot;loggingSettings&quot;: { # Define behaviors on logging. # Settings for logging. Settings for Dialogflow History, Contact Center messages, StackDriver logs, and speech logging. Exposed at the following levels: - Agent level.
+      &quot;enableInteractionLogging&quot;: True or False, # If true, DF Interaction logging is currently enabled.
+      &quot;enableStackdriverLogging&quot;: True or False, # If true, StackDriver logging is currently enabled.
+    },
+  },
   &quot;avatarUri&quot;: &quot;A String&quot;, # The URI of the agent&#x27;s avatar. Avatars are used throughout the Dialogflow console and in the self-hosted [Web Demo](https://cloud.google.com/dialogflow/docs/integrations/web-demo) integration.
   &quot;defaultLanguageCode&quot;: &quot;A String&quot;, # Required. Immutable. The default language of the agent as a language tag. See [Language Support](https://cloud.google.com/dialogflow/cx/docs/reference/language) for a list of the currently supported language codes. This field cannot be set by the Agents.UpdateAgent method.
   &quot;description&quot;: &quot;A String&quot;, # The description of the agent. The maximum length is 500 characters. If exceeded, the request is rejected.
   &quot;displayName&quot;: &quot;A String&quot;, # Required. The human-readable name of the agent, unique within the location.
   &quot;enableSpellCorrection&quot;: True or False, # Indicates if automatic spell correction is enabled in detect intent requests.
-  &quot;enableStackdriverLogging&quot;: True or False, # Indicates if stackdriver logging is enabled for the agent.
+  &quot;enableStackdriverLogging&quot;: True or False, # Indicates if stackdriver logging is enabled for the agent. Please use agent.advanced_settings instead.
   &quot;name&quot;: &quot;A String&quot;, # The unique identifier of the agent. Required for the Agents.UpdateAgent method. Agents.CreateAgent populates the name automatically. Format: `projects//locations//agents/`.
   &quot;securitySettings&quot;: &quot;A String&quot;, # Name of the SecuritySettings reference for the agent. Format: `projects//locations//securitySettings/`.
   &quot;speechToTextSettings&quot;: { # Settings related to speech recognition. # Speech recognition related settings.
diff --git a/docs/dyn/dialogflow_v3.projects.locations.agents.sessions.html b/docs/dyn/dialogflow_v3.projects.locations.agents.sessions.html
index 3faea3e..c091d52 100644
--- a/docs/dyn/dialogflow_v3.projects.locations.agents.sessions.html
+++ b/docs/dyn/dialogflow_v3.projects.locations.agents.sessions.html
@@ -157,6 +157,9 @@
     &quot;analyzeQueryTextSentiment&quot;: True or False, # Configures whether sentiment analysis should be performed. If not provided, sentiment analysis is not performed.
     &quot;currentPage&quot;: &quot;A String&quot;, # The unique identifier of the page to override the current page in the session. Format: `projects//locations//agents//flows//pages/`. If `current_page` is specified, the previous state of the session will be ignored by Dialogflow, including the previous page and the previous session parameters. In most cases, current_page and parameters should be configured together to direct a session to a specific state.
     &quot;disableWebhook&quot;: True or False, # Whether to disable webhook calls for this request.
+    &quot;flowVersions&quot;: [ # A list of flow versions to override for the request. Format: `projects//locations//agents//flows//versions/`. If version 1 of flow X is included in this list, the traffic of flow X will go through version 1 regardless of the version configuration in the environment. Each flow can have at most one version specified in this list.
+      &quot;A String&quot;,
+    ],
     &quot;geoLocation&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # The geo location of this conversational query.
       &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
       &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
@@ -1041,6 +1044,9 @@
       &quot;analyzeQueryTextSentiment&quot;: True or False, # Configures whether sentiment analysis should be performed. If not provided, sentiment analysis is not performed.
       &quot;currentPage&quot;: &quot;A String&quot;, # The unique identifier of the page to override the current page in the session. Format: `projects//locations//agents//flows//pages/`. If `current_page` is specified, the previous state of the session will be ignored by Dialogflow, including the previous page and the previous session parameters. In most cases, current_page and parameters should be configured together to direct a session to a specific state.
       &quot;disableWebhook&quot;: True or False, # Whether to disable webhook calls for this request.
+      &quot;flowVersions&quot;: [ # A list of flow versions to override for the request. Format: `projects//locations//agents//flows//versions/`. If version 1 of flow X is included in this list, the traffic of flow X will go through version 1 regardless of the version configuration in the environment. Each flow can have at most one version specified in this list.
+        &quot;A String&quot;,
+      ],
       &quot;geoLocation&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # The geo location of this conversational query.
         &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
         &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
@@ -1900,6 +1906,9 @@
     &quot;analyzeQueryTextSentiment&quot;: True or False, # Configures whether sentiment analysis should be performed. If not provided, sentiment analysis is not performed.
     &quot;currentPage&quot;: &quot;A String&quot;, # The unique identifier of the page to override the current page in the session. Format: `projects//locations//agents//flows//pages/`. If `current_page` is specified, the previous state of the session will be ignored by Dialogflow, including the previous page and the previous session parameters. In most cases, current_page and parameters should be configured together to direct a session to a specific state.
     &quot;disableWebhook&quot;: True or False, # Whether to disable webhook calls for this request.
+    &quot;flowVersions&quot;: [ # A list of flow versions to override for the request. Format: `projects//locations//agents//flows//versions/`. If version 1 of flow X is included in this list, the traffic of flow X will go through version 1 regardless of the version configuration in the environment. Each flow can have at most one version specified in this list.
+      &quot;A String&quot;,
+    ],
     &quot;geoLocation&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # The geo location of this conversational query.
       &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
       &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
diff --git a/docs/dyn/dialogflow_v3.projects.locations.securitySettings.html b/docs/dyn/dialogflow_v3.projects.locations.securitySettings.html
index e1fe56a..023e0a3 100644
--- a/docs/dyn/dialogflow_v3.projects.locations.securitySettings.html
+++ b/docs/dyn/dialogflow_v3.projects.locations.securitySettings.html
@@ -112,6 +112,9 @@
 
 { # Represents the settings related to security issues, such as data redaction and data retention. It may take hours for updates on the settings to propagate to all the related components and take effect.
   &quot;displayName&quot;: &quot;A String&quot;, # Required. The human-readable name of the security settings, unique within the location.
+  &quot;insightsExportSettings&quot;: { # Settings for exporting conversations to [Insights](https://cloud.google.com/dialogflow/priv/docs/insights). # Optional. Controls conversation exporting settings to Insights after conversation is completed. If retention_strategy is set to REMOVE_AFTER_CONVERSATION, Insights export is disabled no matter what you configure here.
+    &quot;enableInsightsExport&quot;: True or False, # If enabled, we will automatically exports conversations to Insights and Insights runs its analyzers.
+  },
   &quot;inspectTemplate&quot;: &quot;A String&quot;, # [DLP](https://cloud.google.com/dlp/docs) inspect template name. Use this template to define inspect base settings. If empty, we use the default DLP inspect config. The template name will have one of the following formats: `projects//inspectTemplates/` OR `projects//locations//inspectTemplates/` OR `organizations//inspectTemplates/`
   &quot;name&quot;: &quot;A String&quot;, # Required. Resource name of the settings. Format: `projects//locations//securitySettings/`.
   &quot;purgeDataTypes&quot;: [ # List of types of data to remove when retention settings triggers purge.
@@ -132,6 +135,9 @@
 
     { # Represents the settings related to security issues, such as data redaction and data retention. It may take hours for updates on the settings to propagate to all the related components and take effect.
   &quot;displayName&quot;: &quot;A String&quot;, # Required. The human-readable name of the security settings, unique within the location.
+  &quot;insightsExportSettings&quot;: { # Settings for exporting conversations to [Insights](https://cloud.google.com/dialogflow/priv/docs/insights). # Optional. Controls conversation exporting settings to Insights after conversation is completed. If retention_strategy is set to REMOVE_AFTER_CONVERSATION, Insights export is disabled no matter what you configure here.
+    &quot;enableInsightsExport&quot;: True or False, # If enabled, we will automatically exports conversations to Insights and Insights runs its analyzers.
+  },
   &quot;inspectTemplate&quot;: &quot;A String&quot;, # [DLP](https://cloud.google.com/dlp/docs) inspect template name. Use this template to define inspect base settings. If empty, we use the default DLP inspect config. The template name will have one of the following formats: `projects//inspectTemplates/` OR `projects//locations//inspectTemplates/` OR `organizations//inspectTemplates/`
   &quot;name&quot;: &quot;A String&quot;, # Required. Resource name of the settings. Format: `projects//locations//securitySettings/`.
   &quot;purgeDataTypes&quot;: [ # List of types of data to remove when retention settings triggers purge.
@@ -177,6 +183,9 @@
 
     { # Represents the settings related to security issues, such as data redaction and data retention. It may take hours for updates on the settings to propagate to all the related components and take effect.
   &quot;displayName&quot;: &quot;A String&quot;, # Required. The human-readable name of the security settings, unique within the location.
+  &quot;insightsExportSettings&quot;: { # Settings for exporting conversations to [Insights](https://cloud.google.com/dialogflow/priv/docs/insights). # Optional. Controls conversation exporting settings to Insights after conversation is completed. If retention_strategy is set to REMOVE_AFTER_CONVERSATION, Insights export is disabled no matter what you configure here.
+    &quot;enableInsightsExport&quot;: True or False, # If enabled, we will automatically exports conversations to Insights and Insights runs its analyzers.
+  },
   &quot;inspectTemplate&quot;: &quot;A String&quot;, # [DLP](https://cloud.google.com/dlp/docs) inspect template name. Use this template to define inspect base settings. If empty, we use the default DLP inspect config. The template name will have one of the following formats: `projects//inspectTemplates/` OR `projects//locations//inspectTemplates/` OR `organizations//inspectTemplates/`
   &quot;name&quot;: &quot;A String&quot;, # Required. Resource name of the settings. Format: `projects//locations//securitySettings/`.
   &quot;purgeDataTypes&quot;: [ # List of types of data to remove when retention settings triggers purge.
@@ -209,6 +218,9 @@
   &quot;securitySettings&quot;: [ # The list of security settings.
     { # Represents the settings related to security issues, such as data redaction and data retention. It may take hours for updates on the settings to propagate to all the related components and take effect.
       &quot;displayName&quot;: &quot;A String&quot;, # Required. The human-readable name of the security settings, unique within the location.
+      &quot;insightsExportSettings&quot;: { # Settings for exporting conversations to [Insights](https://cloud.google.com/dialogflow/priv/docs/insights). # Optional. Controls conversation exporting settings to Insights after conversation is completed. If retention_strategy is set to REMOVE_AFTER_CONVERSATION, Insights export is disabled no matter what you configure here.
+        &quot;enableInsightsExport&quot;: True or False, # If enabled, we will automatically exports conversations to Insights and Insights runs its analyzers.
+      },
       &quot;inspectTemplate&quot;: &quot;A String&quot;, # [DLP](https://cloud.google.com/dlp/docs) inspect template name. Use this template to define inspect base settings. If empty, we use the default DLP inspect config. The template name will have one of the following formats: `projects//inspectTemplates/` OR `projects//locations//inspectTemplates/` OR `organizations//inspectTemplates/`
       &quot;name&quot;: &quot;A String&quot;, # Required. Resource name of the settings. Format: `projects//locations//securitySettings/`.
       &quot;purgeDataTypes&quot;: [ # List of types of data to remove when retention settings triggers purge.
@@ -247,6 +259,9 @@
 
 { # Represents the settings related to security issues, such as data redaction and data retention. It may take hours for updates on the settings to propagate to all the related components and take effect.
   &quot;displayName&quot;: &quot;A String&quot;, # Required. The human-readable name of the security settings, unique within the location.
+  &quot;insightsExportSettings&quot;: { # Settings for exporting conversations to [Insights](https://cloud.google.com/dialogflow/priv/docs/insights). # Optional. Controls conversation exporting settings to Insights after conversation is completed. If retention_strategy is set to REMOVE_AFTER_CONVERSATION, Insights export is disabled no matter what you configure here.
+    &quot;enableInsightsExport&quot;: True or False, # If enabled, we will automatically exports conversations to Insights and Insights runs its analyzers.
+  },
   &quot;inspectTemplate&quot;: &quot;A String&quot;, # [DLP](https://cloud.google.com/dlp/docs) inspect template name. Use this template to define inspect base settings. If empty, we use the default DLP inspect config. The template name will have one of the following formats: `projects//inspectTemplates/` OR `projects//locations//inspectTemplates/` OR `organizations//inspectTemplates/`
   &quot;name&quot;: &quot;A String&quot;, # Required. Resource name of the settings. Format: `projects//locations//securitySettings/`.
   &quot;purgeDataTypes&quot;: [ # List of types of data to remove when retention settings triggers purge.
@@ -268,6 +283,9 @@
 
     { # Represents the settings related to security issues, such as data redaction and data retention. It may take hours for updates on the settings to propagate to all the related components and take effect.
   &quot;displayName&quot;: &quot;A String&quot;, # Required. The human-readable name of the security settings, unique within the location.
+  &quot;insightsExportSettings&quot;: { # Settings for exporting conversations to [Insights](https://cloud.google.com/dialogflow/priv/docs/insights). # Optional. Controls conversation exporting settings to Insights after conversation is completed. If retention_strategy is set to REMOVE_AFTER_CONVERSATION, Insights export is disabled no matter what you configure here.
+    &quot;enableInsightsExport&quot;: True or False, # If enabled, we will automatically exports conversations to Insights and Insights runs its analyzers.
+  },
   &quot;inspectTemplate&quot;: &quot;A String&quot;, # [DLP](https://cloud.google.com/dlp/docs) inspect template name. Use this template to define inspect base settings. If empty, we use the default DLP inspect config. The template name will have one of the following formats: `projects//inspectTemplates/` OR `projects//locations//inspectTemplates/` OR `organizations//inspectTemplates/`
   &quot;name&quot;: &quot;A String&quot;, # Required. Resource name of the settings. Format: `projects//locations//securitySettings/`.
   &quot;purgeDataTypes&quot;: [ # List of types of data to remove when retention settings triggers purge.
diff --git a/docs/dyn/dialogflow_v3beta1.projects.locations.agents.environments.sessions.html b/docs/dyn/dialogflow_v3beta1.projects.locations.agents.environments.sessions.html
index 7ab3ab4..d775997 100644
--- a/docs/dyn/dialogflow_v3beta1.projects.locations.agents.environments.sessions.html
+++ b/docs/dyn/dialogflow_v3beta1.projects.locations.agents.environments.sessions.html
@@ -157,6 +157,9 @@
     &quot;analyzeQueryTextSentiment&quot;: True or False, # Configures whether sentiment analysis should be performed. If not provided, sentiment analysis is not performed.
     &quot;currentPage&quot;: &quot;A String&quot;, # The unique identifier of the page to override the current page in the session. Format: `projects//locations//agents//flows//pages/`. If `current_page` is specified, the previous state of the session will be ignored by Dialogflow, including the previous page and the previous session parameters. In most cases, current_page and parameters should be configured together to direct a session to a specific state.
     &quot;disableWebhook&quot;: True or False, # Whether to disable webhook calls for this request.
+    &quot;flowVersions&quot;: [ # A list of flow versions to override for the request. Format: `projects//locations//agents//flows//versions/`. If version 1 of flow X is included in this list, the traffic of flow X will go through version 1 regardless of the version configuration in the environment. Each flow can have at most one version specified in this list.
+      &quot;A String&quot;,
+    ],
     &quot;geoLocation&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # The geo location of this conversational query.
       &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
       &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
@@ -1041,6 +1044,9 @@
       &quot;analyzeQueryTextSentiment&quot;: True or False, # Configures whether sentiment analysis should be performed. If not provided, sentiment analysis is not performed.
       &quot;currentPage&quot;: &quot;A String&quot;, # The unique identifier of the page to override the current page in the session. Format: `projects//locations//agents//flows//pages/`. If `current_page` is specified, the previous state of the session will be ignored by Dialogflow, including the previous page and the previous session parameters. In most cases, current_page and parameters should be configured together to direct a session to a specific state.
       &quot;disableWebhook&quot;: True or False, # Whether to disable webhook calls for this request.
+      &quot;flowVersions&quot;: [ # A list of flow versions to override for the request. Format: `projects//locations//agents//flows//versions/`. If version 1 of flow X is included in this list, the traffic of flow X will go through version 1 regardless of the version configuration in the environment. Each flow can have at most one version specified in this list.
+        &quot;A String&quot;,
+      ],
       &quot;geoLocation&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # The geo location of this conversational query.
         &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
         &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
@@ -1900,6 +1906,9 @@
     &quot;analyzeQueryTextSentiment&quot;: True or False, # Configures whether sentiment analysis should be performed. If not provided, sentiment analysis is not performed.
     &quot;currentPage&quot;: &quot;A String&quot;, # The unique identifier of the page to override the current page in the session. Format: `projects//locations//agents//flows//pages/`. If `current_page` is specified, the previous state of the session will be ignored by Dialogflow, including the previous page and the previous session parameters. In most cases, current_page and parameters should be configured together to direct a session to a specific state.
     &quot;disableWebhook&quot;: True or False, # Whether to disable webhook calls for this request.
+    &quot;flowVersions&quot;: [ # A list of flow versions to override for the request. Format: `projects//locations//agents//flows//versions/`. If version 1 of flow X is included in this list, the traffic of flow X will go through version 1 regardless of the version configuration in the environment. Each flow can have at most one version specified in this list.
+      &quot;A String&quot;,
+    ],
     &quot;geoLocation&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # The geo location of this conversational query.
       &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
       &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
diff --git a/docs/dyn/dialogflow_v3beta1.projects.locations.agents.html b/docs/dyn/dialogflow_v3beta1.projects.locations.agents.html
index 8d79189..7c9aff5 100644
--- a/docs/dyn/dialogflow_v3beta1.projects.locations.agents.html
+++ b/docs/dyn/dialogflow_v3beta1.projects.locations.agents.html
@@ -158,12 +158,18 @@
     The object takes the form of:
 
 { # Agents are best described as Natural Language Understanding (NLU) modules that transform user requests into actionable data. You can include agents in your app, product, or service to determine user intent and respond to the user in a natural way. After you create an agent, you can add Intents, Entity Types, Flows, Fulfillments, Webhooks, and so on to manage the conversation flows..
+  &quot;advancedSettings&quot;: { # Hierarchical advanced settings for agent/flow/page/fulfillment/parameter. Settings exposed at lower level overrides the settings exposed at higher level. Hierarchy: Agent-&gt;Flow-&gt;Page-&gt;Fulfillment/Parameter. # Hierarchical advanced settings for this agent. The settings exposed at the lower level overrides the settings exposed at the higher level.
+    &quot;loggingSettings&quot;: { # Define behaviors on logging. # Settings for logging. Settings for Dialogflow History, Contact Center messages, StackDriver logs, and speech logging. Exposed at the following levels: - Agent level.
+      &quot;enableInteractionLogging&quot;: True or False, # If true, DF Interaction logging is currently enabled.
+      &quot;enableStackdriverLogging&quot;: True or False, # If true, StackDriver logging is currently enabled.
+    },
+  },
   &quot;avatarUri&quot;: &quot;A String&quot;, # The URI of the agent&#x27;s avatar. Avatars are used throughout the Dialogflow console and in the self-hosted [Web Demo](https://cloud.google.com/dialogflow/docs/integrations/web-demo) integration.
   &quot;defaultLanguageCode&quot;: &quot;A String&quot;, # Required. Immutable. The default language of the agent as a language tag. See [Language Support](https://cloud.google.com/dialogflow/cx/docs/reference/language) for a list of the currently supported language codes. This field cannot be set by the Agents.UpdateAgent method.
   &quot;description&quot;: &quot;A String&quot;, # The description of the agent. The maximum length is 500 characters. If exceeded, the request is rejected.
   &quot;displayName&quot;: &quot;A String&quot;, # Required. The human-readable name of the agent, unique within the location.
   &quot;enableSpellCorrection&quot;: True or False, # Indicates if automatic spell correction is enabled in detect intent requests.
-  &quot;enableStackdriverLogging&quot;: True or False, # Indicates if stackdriver logging is enabled for the agent.
+  &quot;enableStackdriverLogging&quot;: True or False, # Indicates if stackdriver logging is enabled for the agent. Please use agent.advanced_settings instead.
   &quot;name&quot;: &quot;A String&quot;, # The unique identifier of the agent. Required for the Agents.UpdateAgent method. Agents.CreateAgent populates the name automatically. Format: `projects//locations//agents/`.
   &quot;securitySettings&quot;: &quot;A String&quot;, # Name of the SecuritySettings reference for the agent. Format: `projects//locations//securitySettings/`.
   &quot;speechToTextSettings&quot;: { # Settings related to speech recognition. # Speech recognition related settings.
@@ -185,12 +191,18 @@
   An object of the form:
 
     { # Agents are best described as Natural Language Understanding (NLU) modules that transform user requests into actionable data. You can include agents in your app, product, or service to determine user intent and respond to the user in a natural way. After you create an agent, you can add Intents, Entity Types, Flows, Fulfillments, Webhooks, and so on to manage the conversation flows..
+  &quot;advancedSettings&quot;: { # Hierarchical advanced settings for agent/flow/page/fulfillment/parameter. Settings exposed at lower level overrides the settings exposed at higher level. Hierarchy: Agent-&gt;Flow-&gt;Page-&gt;Fulfillment/Parameter. # Hierarchical advanced settings for this agent. The settings exposed at the lower level overrides the settings exposed at the higher level.
+    &quot;loggingSettings&quot;: { # Define behaviors on logging. # Settings for logging. Settings for Dialogflow History, Contact Center messages, StackDriver logs, and speech logging. Exposed at the following levels: - Agent level.
+      &quot;enableInteractionLogging&quot;: True or False, # If true, DF Interaction logging is currently enabled.
+      &quot;enableStackdriverLogging&quot;: True or False, # If true, StackDriver logging is currently enabled.
+    },
+  },
   &quot;avatarUri&quot;: &quot;A String&quot;, # The URI of the agent&#x27;s avatar. Avatars are used throughout the Dialogflow console and in the self-hosted [Web Demo](https://cloud.google.com/dialogflow/docs/integrations/web-demo) integration.
   &quot;defaultLanguageCode&quot;: &quot;A String&quot;, # Required. Immutable. The default language of the agent as a language tag. See [Language Support](https://cloud.google.com/dialogflow/cx/docs/reference/language) for a list of the currently supported language codes. This field cannot be set by the Agents.UpdateAgent method.
   &quot;description&quot;: &quot;A String&quot;, # The description of the agent. The maximum length is 500 characters. If exceeded, the request is rejected.
   &quot;displayName&quot;: &quot;A String&quot;, # Required. The human-readable name of the agent, unique within the location.
   &quot;enableSpellCorrection&quot;: True or False, # Indicates if automatic spell correction is enabled in detect intent requests.
-  &quot;enableStackdriverLogging&quot;: True or False, # Indicates if stackdriver logging is enabled for the agent.
+  &quot;enableStackdriverLogging&quot;: True or False, # Indicates if stackdriver logging is enabled for the agent. Please use agent.advanced_settings instead.
   &quot;name&quot;: &quot;A String&quot;, # The unique identifier of the agent. Required for the Agents.UpdateAgent method. Agents.CreateAgent populates the name automatically. Format: `projects//locations//agents/`.
   &quot;securitySettings&quot;: &quot;A String&quot;, # Name of the SecuritySettings reference for the agent. Format: `projects//locations//securitySettings/`.
   &quot;speechToTextSettings&quot;: { # Settings related to speech recognition. # Speech recognition related settings.
@@ -280,12 +292,18 @@
   An object of the form:
 
     { # Agents are best described as Natural Language Understanding (NLU) modules that transform user requests into actionable data. You can include agents in your app, product, or service to determine user intent and respond to the user in a natural way. After you create an agent, you can add Intents, Entity Types, Flows, Fulfillments, Webhooks, and so on to manage the conversation flows..
+  &quot;advancedSettings&quot;: { # Hierarchical advanced settings for agent/flow/page/fulfillment/parameter. Settings exposed at lower level overrides the settings exposed at higher level. Hierarchy: Agent-&gt;Flow-&gt;Page-&gt;Fulfillment/Parameter. # Hierarchical advanced settings for this agent. The settings exposed at the lower level overrides the settings exposed at the higher level.
+    &quot;loggingSettings&quot;: { # Define behaviors on logging. # Settings for logging. Settings for Dialogflow History, Contact Center messages, StackDriver logs, and speech logging. Exposed at the following levels: - Agent level.
+      &quot;enableInteractionLogging&quot;: True or False, # If true, DF Interaction logging is currently enabled.
+      &quot;enableStackdriverLogging&quot;: True or False, # If true, StackDriver logging is currently enabled.
+    },
+  },
   &quot;avatarUri&quot;: &quot;A String&quot;, # The URI of the agent&#x27;s avatar. Avatars are used throughout the Dialogflow console and in the self-hosted [Web Demo](https://cloud.google.com/dialogflow/docs/integrations/web-demo) integration.
   &quot;defaultLanguageCode&quot;: &quot;A String&quot;, # Required. Immutable. The default language of the agent as a language tag. See [Language Support](https://cloud.google.com/dialogflow/cx/docs/reference/language) for a list of the currently supported language codes. This field cannot be set by the Agents.UpdateAgent method.
   &quot;description&quot;: &quot;A String&quot;, # The description of the agent. The maximum length is 500 characters. If exceeded, the request is rejected.
   &quot;displayName&quot;: &quot;A String&quot;, # Required. The human-readable name of the agent, unique within the location.
   &quot;enableSpellCorrection&quot;: True or False, # Indicates if automatic spell correction is enabled in detect intent requests.
-  &quot;enableStackdriverLogging&quot;: True or False, # Indicates if stackdriver logging is enabled for the agent.
+  &quot;enableStackdriverLogging&quot;: True or False, # Indicates if stackdriver logging is enabled for the agent. Please use agent.advanced_settings instead.
   &quot;name&quot;: &quot;A String&quot;, # The unique identifier of the agent. Required for the Agents.UpdateAgent method. Agents.CreateAgent populates the name automatically. Format: `projects//locations//agents/`.
   &quot;securitySettings&quot;: &quot;A String&quot;, # Name of the SecuritySettings reference for the agent. Format: `projects//locations//securitySettings/`.
   &quot;speechToTextSettings&quot;: { # Settings related to speech recognition. # Speech recognition related settings.
@@ -360,12 +378,18 @@
     { # The response message for Agents.ListAgents.
   &quot;agents&quot;: [ # The list of agents. There will be a maximum number of items returned based on the page_size field in the request.
     { # Agents are best described as Natural Language Understanding (NLU) modules that transform user requests into actionable data. You can include agents in your app, product, or service to determine user intent and respond to the user in a natural way. After you create an agent, you can add Intents, Entity Types, Flows, Fulfillments, Webhooks, and so on to manage the conversation flows..
+      &quot;advancedSettings&quot;: { # Hierarchical advanced settings for agent/flow/page/fulfillment/parameter. Settings exposed at lower level overrides the settings exposed at higher level. Hierarchy: Agent-&gt;Flow-&gt;Page-&gt;Fulfillment/Parameter. # Hierarchical advanced settings for this agent. The settings exposed at the lower level overrides the settings exposed at the higher level.
+        &quot;loggingSettings&quot;: { # Define behaviors on logging. # Settings for logging. Settings for Dialogflow History, Contact Center messages, StackDriver logs, and speech logging. Exposed at the following levels: - Agent level.
+          &quot;enableInteractionLogging&quot;: True or False, # If true, DF Interaction logging is currently enabled.
+          &quot;enableStackdriverLogging&quot;: True or False, # If true, StackDriver logging is currently enabled.
+        },
+      },
       &quot;avatarUri&quot;: &quot;A String&quot;, # The URI of the agent&#x27;s avatar. Avatars are used throughout the Dialogflow console and in the self-hosted [Web Demo](https://cloud.google.com/dialogflow/docs/integrations/web-demo) integration.
       &quot;defaultLanguageCode&quot;: &quot;A String&quot;, # Required. Immutable. The default language of the agent as a language tag. See [Language Support](https://cloud.google.com/dialogflow/cx/docs/reference/language) for a list of the currently supported language codes. This field cannot be set by the Agents.UpdateAgent method.
       &quot;description&quot;: &quot;A String&quot;, # The description of the agent. The maximum length is 500 characters. If exceeded, the request is rejected.
       &quot;displayName&quot;: &quot;A String&quot;, # Required. The human-readable name of the agent, unique within the location.
       &quot;enableSpellCorrection&quot;: True or False, # Indicates if automatic spell correction is enabled in detect intent requests.
-      &quot;enableStackdriverLogging&quot;: True or False, # Indicates if stackdriver logging is enabled for the agent.
+      &quot;enableStackdriverLogging&quot;: True or False, # Indicates if stackdriver logging is enabled for the agent. Please use agent.advanced_settings instead.
       &quot;name&quot;: &quot;A String&quot;, # The unique identifier of the agent. Required for the Agents.UpdateAgent method. Agents.CreateAgent populates the name automatically. Format: `projects//locations//agents/`.
       &quot;securitySettings&quot;: &quot;A String&quot;, # Name of the SecuritySettings reference for the agent. Format: `projects//locations//securitySettings/`.
       &quot;speechToTextSettings&quot;: { # Settings related to speech recognition. # Speech recognition related settings.
@@ -406,12 +430,18 @@
     The object takes the form of:
 
 { # Agents are best described as Natural Language Understanding (NLU) modules that transform user requests into actionable data. You can include agents in your app, product, or service to determine user intent and respond to the user in a natural way. After you create an agent, you can add Intents, Entity Types, Flows, Fulfillments, Webhooks, and so on to manage the conversation flows..
+  &quot;advancedSettings&quot;: { # Hierarchical advanced settings for agent/flow/page/fulfillment/parameter. Settings exposed at lower level overrides the settings exposed at higher level. Hierarchy: Agent-&gt;Flow-&gt;Page-&gt;Fulfillment/Parameter. # Hierarchical advanced settings for this agent. The settings exposed at the lower level overrides the settings exposed at the higher level.
+    &quot;loggingSettings&quot;: { # Define behaviors on logging. # Settings for logging. Settings for Dialogflow History, Contact Center messages, StackDriver logs, and speech logging. Exposed at the following levels: - Agent level.
+      &quot;enableInteractionLogging&quot;: True or False, # If true, DF Interaction logging is currently enabled.
+      &quot;enableStackdriverLogging&quot;: True or False, # If true, StackDriver logging is currently enabled.
+    },
+  },
   &quot;avatarUri&quot;: &quot;A String&quot;, # The URI of the agent&#x27;s avatar. Avatars are used throughout the Dialogflow console and in the self-hosted [Web Demo](https://cloud.google.com/dialogflow/docs/integrations/web-demo) integration.
   &quot;defaultLanguageCode&quot;: &quot;A String&quot;, # Required. Immutable. The default language of the agent as a language tag. See [Language Support](https://cloud.google.com/dialogflow/cx/docs/reference/language) for a list of the currently supported language codes. This field cannot be set by the Agents.UpdateAgent method.
   &quot;description&quot;: &quot;A String&quot;, # The description of the agent. The maximum length is 500 characters. If exceeded, the request is rejected.
   &quot;displayName&quot;: &quot;A String&quot;, # Required. The human-readable name of the agent, unique within the location.
   &quot;enableSpellCorrection&quot;: True or False, # Indicates if automatic spell correction is enabled in detect intent requests.
-  &quot;enableStackdriverLogging&quot;: True or False, # Indicates if stackdriver logging is enabled for the agent.
+  &quot;enableStackdriverLogging&quot;: True or False, # Indicates if stackdriver logging is enabled for the agent. Please use agent.advanced_settings instead.
   &quot;name&quot;: &quot;A String&quot;, # The unique identifier of the agent. Required for the Agents.UpdateAgent method. Agents.CreateAgent populates the name automatically. Format: `projects//locations//agents/`.
   &quot;securitySettings&quot;: &quot;A String&quot;, # Name of the SecuritySettings reference for the agent. Format: `projects//locations//securitySettings/`.
   &quot;speechToTextSettings&quot;: { # Settings related to speech recognition. # Speech recognition related settings.
@@ -434,12 +464,18 @@
   An object of the form:
 
     { # Agents are best described as Natural Language Understanding (NLU) modules that transform user requests into actionable data. You can include agents in your app, product, or service to determine user intent and respond to the user in a natural way. After you create an agent, you can add Intents, Entity Types, Flows, Fulfillments, Webhooks, and so on to manage the conversation flows..
+  &quot;advancedSettings&quot;: { # Hierarchical advanced settings for agent/flow/page/fulfillment/parameter. Settings exposed at lower level overrides the settings exposed at higher level. Hierarchy: Agent-&gt;Flow-&gt;Page-&gt;Fulfillment/Parameter. # Hierarchical advanced settings for this agent. The settings exposed at the lower level overrides the settings exposed at the higher level.
+    &quot;loggingSettings&quot;: { # Define behaviors on logging. # Settings for logging. Settings for Dialogflow History, Contact Center messages, StackDriver logs, and speech logging. Exposed at the following levels: - Agent level.
+      &quot;enableInteractionLogging&quot;: True or False, # If true, DF Interaction logging is currently enabled.
+      &quot;enableStackdriverLogging&quot;: True or False, # If true, StackDriver logging is currently enabled.
+    },
+  },
   &quot;avatarUri&quot;: &quot;A String&quot;, # The URI of the agent&#x27;s avatar. Avatars are used throughout the Dialogflow console and in the self-hosted [Web Demo](https://cloud.google.com/dialogflow/docs/integrations/web-demo) integration.
   &quot;defaultLanguageCode&quot;: &quot;A String&quot;, # Required. Immutable. The default language of the agent as a language tag. See [Language Support](https://cloud.google.com/dialogflow/cx/docs/reference/language) for a list of the currently supported language codes. This field cannot be set by the Agents.UpdateAgent method.
   &quot;description&quot;: &quot;A String&quot;, # The description of the agent. The maximum length is 500 characters. If exceeded, the request is rejected.
   &quot;displayName&quot;: &quot;A String&quot;, # Required. The human-readable name of the agent, unique within the location.
   &quot;enableSpellCorrection&quot;: True or False, # Indicates if automatic spell correction is enabled in detect intent requests.
-  &quot;enableStackdriverLogging&quot;: True or False, # Indicates if stackdriver logging is enabled for the agent.
+  &quot;enableStackdriverLogging&quot;: True or False, # Indicates if stackdriver logging is enabled for the agent. Please use agent.advanced_settings instead.
   &quot;name&quot;: &quot;A String&quot;, # The unique identifier of the agent. Required for the Agents.UpdateAgent method. Agents.CreateAgent populates the name automatically. Format: `projects//locations//agents/`.
   &quot;securitySettings&quot;: &quot;A String&quot;, # Name of the SecuritySettings reference for the agent. Format: `projects//locations//securitySettings/`.
   &quot;speechToTextSettings&quot;: { # Settings related to speech recognition. # Speech recognition related settings.
diff --git a/docs/dyn/dialogflow_v3beta1.projects.locations.agents.sessions.html b/docs/dyn/dialogflow_v3beta1.projects.locations.agents.sessions.html
index ae32058..e753f6e 100644
--- a/docs/dyn/dialogflow_v3beta1.projects.locations.agents.sessions.html
+++ b/docs/dyn/dialogflow_v3beta1.projects.locations.agents.sessions.html
@@ -157,6 +157,9 @@
     &quot;analyzeQueryTextSentiment&quot;: True or False, # Configures whether sentiment analysis should be performed. If not provided, sentiment analysis is not performed.
     &quot;currentPage&quot;: &quot;A String&quot;, # The unique identifier of the page to override the current page in the session. Format: `projects//locations//agents//flows//pages/`. If `current_page` is specified, the previous state of the session will be ignored by Dialogflow, including the previous page and the previous session parameters. In most cases, current_page and parameters should be configured together to direct a session to a specific state.
     &quot;disableWebhook&quot;: True or False, # Whether to disable webhook calls for this request.
+    &quot;flowVersions&quot;: [ # A list of flow versions to override for the request. Format: `projects//locations//agents//flows//versions/`. If version 1 of flow X is included in this list, the traffic of flow X will go through version 1 regardless of the version configuration in the environment. Each flow can have at most one version specified in this list.
+      &quot;A String&quot;,
+    ],
     &quot;geoLocation&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # The geo location of this conversational query.
       &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
       &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
@@ -1041,6 +1044,9 @@
       &quot;analyzeQueryTextSentiment&quot;: True or False, # Configures whether sentiment analysis should be performed. If not provided, sentiment analysis is not performed.
       &quot;currentPage&quot;: &quot;A String&quot;, # The unique identifier of the page to override the current page in the session. Format: `projects//locations//agents//flows//pages/`. If `current_page` is specified, the previous state of the session will be ignored by Dialogflow, including the previous page and the previous session parameters. In most cases, current_page and parameters should be configured together to direct a session to a specific state.
       &quot;disableWebhook&quot;: True or False, # Whether to disable webhook calls for this request.
+      &quot;flowVersions&quot;: [ # A list of flow versions to override for the request. Format: `projects//locations//agents//flows//versions/`. If version 1 of flow X is included in this list, the traffic of flow X will go through version 1 regardless of the version configuration in the environment. Each flow can have at most one version specified in this list.
+        &quot;A String&quot;,
+      ],
       &quot;geoLocation&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # The geo location of this conversational query.
         &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
         &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
@@ -1900,6 +1906,9 @@
     &quot;analyzeQueryTextSentiment&quot;: True or False, # Configures whether sentiment analysis should be performed. If not provided, sentiment analysis is not performed.
     &quot;currentPage&quot;: &quot;A String&quot;, # The unique identifier of the page to override the current page in the session. Format: `projects//locations//agents//flows//pages/`. If `current_page` is specified, the previous state of the session will be ignored by Dialogflow, including the previous page and the previous session parameters. In most cases, current_page and parameters should be configured together to direct a session to a specific state.
     &quot;disableWebhook&quot;: True or False, # Whether to disable webhook calls for this request.
+    &quot;flowVersions&quot;: [ # A list of flow versions to override for the request. Format: `projects//locations//agents//flows//versions/`. If version 1 of flow X is included in this list, the traffic of flow X will go through version 1 regardless of the version configuration in the environment. Each flow can have at most one version specified in this list.
+      &quot;A String&quot;,
+    ],
     &quot;geoLocation&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # The geo location of this conversational query.
       &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
       &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
diff --git a/docs/dyn/dialogflow_v3beta1.projects.locations.securitySettings.html b/docs/dyn/dialogflow_v3beta1.projects.locations.securitySettings.html
index 2da4dba..c23bd5b 100644
--- a/docs/dyn/dialogflow_v3beta1.projects.locations.securitySettings.html
+++ b/docs/dyn/dialogflow_v3beta1.projects.locations.securitySettings.html
@@ -112,6 +112,9 @@
 
 { # Represents the settings related to security issues, such as data redaction and data retention. It may take hours for updates on the settings to propagate to all the related components and take effect.
   &quot;displayName&quot;: &quot;A String&quot;, # Required. The human-readable name of the security settings, unique within the location.
+  &quot;insightsExportSettings&quot;: { # Settings for exporting conversations to [Insights](https://cloud.google.com/dialogflow/priv/docs/insights). # Optional. Controls conversation exporting settings to Insights after conversation is completed. If retention_strategy is set to REMOVE_AFTER_CONVERSATION, Insights export is disabled no matter what you configure here.
+    &quot;enableInsightsExport&quot;: True or False, # If enabled, we will automatically exports conversations to Insights and Insights runs its analyzers.
+  },
   &quot;inspectTemplate&quot;: &quot;A String&quot;, # [DLP](https://cloud.google.com/dlp/docs) inspect template name. Use this template to define inspect base settings. If empty, we use the default DLP inspect config. The template name will have one of the following formats: `projects//inspectTemplates/` OR `projects//locations//inspectTemplates/` OR `organizations//inspectTemplates/`
   &quot;name&quot;: &quot;A String&quot;, # Required. Resource name of the settings. Format: `projects//locations//securitySettings/`.
   &quot;purgeDataTypes&quot;: [ # List of types of data to remove when retention settings triggers purge.
@@ -132,6 +135,9 @@
 
     { # Represents the settings related to security issues, such as data redaction and data retention. It may take hours for updates on the settings to propagate to all the related components and take effect.
   &quot;displayName&quot;: &quot;A String&quot;, # Required. The human-readable name of the security settings, unique within the location.
+  &quot;insightsExportSettings&quot;: { # Settings for exporting conversations to [Insights](https://cloud.google.com/dialogflow/priv/docs/insights). # Optional. Controls conversation exporting settings to Insights after conversation is completed. If retention_strategy is set to REMOVE_AFTER_CONVERSATION, Insights export is disabled no matter what you configure here.
+    &quot;enableInsightsExport&quot;: True or False, # If enabled, we will automatically exports conversations to Insights and Insights runs its analyzers.
+  },
   &quot;inspectTemplate&quot;: &quot;A String&quot;, # [DLP](https://cloud.google.com/dlp/docs) inspect template name. Use this template to define inspect base settings. If empty, we use the default DLP inspect config. The template name will have one of the following formats: `projects//inspectTemplates/` OR `projects//locations//inspectTemplates/` OR `organizations//inspectTemplates/`
   &quot;name&quot;: &quot;A String&quot;, # Required. Resource name of the settings. Format: `projects//locations//securitySettings/`.
   &quot;purgeDataTypes&quot;: [ # List of types of data to remove when retention settings triggers purge.
@@ -177,6 +183,9 @@
 
     { # Represents the settings related to security issues, such as data redaction and data retention. It may take hours for updates on the settings to propagate to all the related components and take effect.
   &quot;displayName&quot;: &quot;A String&quot;, # Required. The human-readable name of the security settings, unique within the location.
+  &quot;insightsExportSettings&quot;: { # Settings for exporting conversations to [Insights](https://cloud.google.com/dialogflow/priv/docs/insights). # Optional. Controls conversation exporting settings to Insights after conversation is completed. If retention_strategy is set to REMOVE_AFTER_CONVERSATION, Insights export is disabled no matter what you configure here.
+    &quot;enableInsightsExport&quot;: True or False, # If enabled, we will automatically exports conversations to Insights and Insights runs its analyzers.
+  },
   &quot;inspectTemplate&quot;: &quot;A String&quot;, # [DLP](https://cloud.google.com/dlp/docs) inspect template name. Use this template to define inspect base settings. If empty, we use the default DLP inspect config. The template name will have one of the following formats: `projects//inspectTemplates/` OR `projects//locations//inspectTemplates/` OR `organizations//inspectTemplates/`
   &quot;name&quot;: &quot;A String&quot;, # Required. Resource name of the settings. Format: `projects//locations//securitySettings/`.
   &quot;purgeDataTypes&quot;: [ # List of types of data to remove when retention settings triggers purge.
@@ -209,6 +218,9 @@
   &quot;securitySettings&quot;: [ # The list of security settings.
     { # Represents the settings related to security issues, such as data redaction and data retention. It may take hours for updates on the settings to propagate to all the related components and take effect.
       &quot;displayName&quot;: &quot;A String&quot;, # Required. The human-readable name of the security settings, unique within the location.
+      &quot;insightsExportSettings&quot;: { # Settings for exporting conversations to [Insights](https://cloud.google.com/dialogflow/priv/docs/insights). # Optional. Controls conversation exporting settings to Insights after conversation is completed. If retention_strategy is set to REMOVE_AFTER_CONVERSATION, Insights export is disabled no matter what you configure here.
+        &quot;enableInsightsExport&quot;: True or False, # If enabled, we will automatically exports conversations to Insights and Insights runs its analyzers.
+      },
       &quot;inspectTemplate&quot;: &quot;A String&quot;, # [DLP](https://cloud.google.com/dlp/docs) inspect template name. Use this template to define inspect base settings. If empty, we use the default DLP inspect config. The template name will have one of the following formats: `projects//inspectTemplates/` OR `projects//locations//inspectTemplates/` OR `organizations//inspectTemplates/`
       &quot;name&quot;: &quot;A String&quot;, # Required. Resource name of the settings. Format: `projects//locations//securitySettings/`.
       &quot;purgeDataTypes&quot;: [ # List of types of data to remove when retention settings triggers purge.
@@ -247,6 +259,9 @@
 
 { # Represents the settings related to security issues, such as data redaction and data retention. It may take hours for updates on the settings to propagate to all the related components and take effect.
   &quot;displayName&quot;: &quot;A String&quot;, # Required. The human-readable name of the security settings, unique within the location.
+  &quot;insightsExportSettings&quot;: { # Settings for exporting conversations to [Insights](https://cloud.google.com/dialogflow/priv/docs/insights). # Optional. Controls conversation exporting settings to Insights after conversation is completed. If retention_strategy is set to REMOVE_AFTER_CONVERSATION, Insights export is disabled no matter what you configure here.
+    &quot;enableInsightsExport&quot;: True or False, # If enabled, we will automatically exports conversations to Insights and Insights runs its analyzers.
+  },
   &quot;inspectTemplate&quot;: &quot;A String&quot;, # [DLP](https://cloud.google.com/dlp/docs) inspect template name. Use this template to define inspect base settings. If empty, we use the default DLP inspect config. The template name will have one of the following formats: `projects//inspectTemplates/` OR `projects//locations//inspectTemplates/` OR `organizations//inspectTemplates/`
   &quot;name&quot;: &quot;A String&quot;, # Required. Resource name of the settings. Format: `projects//locations//securitySettings/`.
   &quot;purgeDataTypes&quot;: [ # List of types of data to remove when retention settings triggers purge.
@@ -268,6 +283,9 @@
 
     { # Represents the settings related to security issues, such as data redaction and data retention. It may take hours for updates on the settings to propagate to all the related components and take effect.
   &quot;displayName&quot;: &quot;A String&quot;, # Required. The human-readable name of the security settings, unique within the location.
+  &quot;insightsExportSettings&quot;: { # Settings for exporting conversations to [Insights](https://cloud.google.com/dialogflow/priv/docs/insights). # Optional. Controls conversation exporting settings to Insights after conversation is completed. If retention_strategy is set to REMOVE_AFTER_CONVERSATION, Insights export is disabled no matter what you configure here.
+    &quot;enableInsightsExport&quot;: True or False, # If enabled, we will automatically exports conversations to Insights and Insights runs its analyzers.
+  },
   &quot;inspectTemplate&quot;: &quot;A String&quot;, # [DLP](https://cloud.google.com/dlp/docs) inspect template name. Use this template to define inspect base settings. If empty, we use the default DLP inspect config. The template name will have one of the following formats: `projects//inspectTemplates/` OR `projects//locations//inspectTemplates/` OR `organizations//inspectTemplates/`
   &quot;name&quot;: &quot;A String&quot;, # Required. Resource name of the settings. Format: `projects//locations//securitySettings/`.
   &quot;purgeDataTypes&quot;: [ # List of types of data to remove when retention settings triggers purge.
diff --git a/docs/dyn/dlp_v2.organizations.deidentifyTemplates.html b/docs/dyn/dlp_v2.organizations.deidentifyTemplates.html
index fd78a08..a47624e 100644
--- a/docs/dyn/dlp_v2.organizations.deidentifyTemplates.html
+++ b/docs/dyn/dlp_v2.organizations.deidentifyTemplates.html
@@ -201,8 +201,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -218,8 +218,8 @@
                 },
               },
               &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -236,8 +236,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -258,8 +258,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -475,8 +475,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -492,8 +492,8 @@
                       },
                     },
                     &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -510,8 +510,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -532,8 +532,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -699,8 +699,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -716,8 +716,8 @@
                 },
               },
               &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -734,8 +734,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -756,8 +756,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -996,8 +996,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1013,8 +1013,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1031,8 +1031,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1053,8 +1053,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1270,8 +1270,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -1287,8 +1287,8 @@
                     },
                   },
                   &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -1305,8 +1305,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -1327,8 +1327,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -1494,8 +1494,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1511,8 +1511,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1529,8 +1529,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1551,8 +1551,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1813,8 +1813,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1830,8 +1830,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1848,8 +1848,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1870,8 +1870,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2087,8 +2087,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -2104,8 +2104,8 @@
                     },
                   },
                   &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -2122,8 +2122,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -2144,8 +2144,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -2311,8 +2311,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2328,8 +2328,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2346,8 +2346,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2368,8 +2368,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2618,8 +2618,8 @@
                   &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                     &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                   },
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -2635,8 +2635,8 @@
                   },
                 },
                 &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -2653,8 +2653,8 @@
                   &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                     &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                   },
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -2675,8 +2675,8 @@
                   &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                     &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                   },
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -2892,8 +2892,8 @@
                         &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                           &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                         },
-                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                             &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                             &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                           },
@@ -2909,8 +2909,8 @@
                         },
                       },
                       &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                             &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                             &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                           },
@@ -2927,8 +2927,8 @@
                         &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                           &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                         },
-                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                             &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                             &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                           },
@@ -2949,8 +2949,8 @@
                         &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                           &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                         },
-                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                             &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                             &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                           },
@@ -3116,8 +3116,8 @@
                   &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                     &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                   },
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -3133,8 +3133,8 @@
                   },
                 },
                 &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -3151,8 +3151,8 @@
                   &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                     &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                   },
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -3173,8 +3173,8 @@
                   &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                     &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                   },
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -3430,8 +3430,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3447,8 +3447,8 @@
                 },
               },
               &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3465,8 +3465,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3487,8 +3487,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3704,8 +3704,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -3721,8 +3721,8 @@
                       },
                     },
                     &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -3739,8 +3739,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -3761,8 +3761,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -3928,8 +3928,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3945,8 +3945,8 @@
                 },
               },
               &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3963,8 +3963,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3985,8 +3985,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -4224,8 +4224,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4241,8 +4241,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4259,8 +4259,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4281,8 +4281,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4498,8 +4498,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -4515,8 +4515,8 @@
                     },
                   },
                   &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -4533,8 +4533,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -4555,8 +4555,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -4722,8 +4722,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4739,8 +4739,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4757,8 +4757,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4779,8 +4779,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
diff --git a/docs/dyn/dlp_v2.organizations.locations.deidentifyTemplates.html b/docs/dyn/dlp_v2.organizations.locations.deidentifyTemplates.html
index 1c3e485..a996449 100644
--- a/docs/dyn/dlp_v2.organizations.locations.deidentifyTemplates.html
+++ b/docs/dyn/dlp_v2.organizations.locations.deidentifyTemplates.html
@@ -201,8 +201,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -218,8 +218,8 @@
                 },
               },
               &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -236,8 +236,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -258,8 +258,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -475,8 +475,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -492,8 +492,8 @@
                       },
                     },
                     &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -510,8 +510,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -532,8 +532,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -699,8 +699,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -716,8 +716,8 @@
                 },
               },
               &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -734,8 +734,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -756,8 +756,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -996,8 +996,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1013,8 +1013,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1031,8 +1031,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1053,8 +1053,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1270,8 +1270,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -1287,8 +1287,8 @@
                     },
                   },
                   &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -1305,8 +1305,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -1327,8 +1327,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -1494,8 +1494,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1511,8 +1511,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1529,8 +1529,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1551,8 +1551,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1813,8 +1813,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1830,8 +1830,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1848,8 +1848,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1870,8 +1870,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2087,8 +2087,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -2104,8 +2104,8 @@
                     },
                   },
                   &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -2122,8 +2122,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -2144,8 +2144,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -2311,8 +2311,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2328,8 +2328,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2346,8 +2346,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2368,8 +2368,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2618,8 +2618,8 @@
                   &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                     &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                   },
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -2635,8 +2635,8 @@
                   },
                 },
                 &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -2653,8 +2653,8 @@
                   &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                     &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                   },
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -2675,8 +2675,8 @@
                   &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                     &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                   },
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -2892,8 +2892,8 @@
                         &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                           &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                         },
-                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                             &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                             &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                           },
@@ -2909,8 +2909,8 @@
                         },
                       },
                       &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                             &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                             &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                           },
@@ -2927,8 +2927,8 @@
                         &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                           &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                         },
-                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                             &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                             &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                           },
@@ -2949,8 +2949,8 @@
                         &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                           &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                         },
-                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                             &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                             &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                           },
@@ -3116,8 +3116,8 @@
                   &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                     &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                   },
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -3133,8 +3133,8 @@
                   },
                 },
                 &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -3151,8 +3151,8 @@
                   &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                     &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                   },
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -3173,8 +3173,8 @@
                   &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                     &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                   },
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -3430,8 +3430,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3447,8 +3447,8 @@
                 },
               },
               &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3465,8 +3465,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3487,8 +3487,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3704,8 +3704,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -3721,8 +3721,8 @@
                       },
                     },
                     &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -3739,8 +3739,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -3761,8 +3761,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -3928,8 +3928,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3945,8 +3945,8 @@
                 },
               },
               &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3963,8 +3963,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3985,8 +3985,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -4224,8 +4224,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4241,8 +4241,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4259,8 +4259,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4281,8 +4281,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4498,8 +4498,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -4515,8 +4515,8 @@
                     },
                   },
                   &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -4533,8 +4533,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -4555,8 +4555,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -4722,8 +4722,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4739,8 +4739,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4757,8 +4757,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4779,8 +4779,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
diff --git a/docs/dyn/dlp_v2.projects.content.html b/docs/dyn/dlp_v2.projects.content.html
index 9cd2723..6ac3019 100644
--- a/docs/dyn/dlp_v2.projects.content.html
+++ b/docs/dyn/dlp_v2.projects.content.html
@@ -190,8 +190,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -207,8 +207,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -225,8 +225,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -247,8 +247,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -464,8 +464,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -481,8 +481,8 @@
                     },
                   },
                   &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -499,8 +499,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -521,8 +521,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -688,8 +688,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -705,8 +705,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -723,8 +723,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -745,8 +745,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1235,8 +1235,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -1252,8 +1252,8 @@
                       },
                     },
                     &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -1270,8 +1270,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -1292,8 +1292,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -1459,8 +1459,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -1476,8 +1476,8 @@
                 },
               },
               &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -1494,8 +1494,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -1516,8 +1516,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -1728,8 +1728,8 @@
             &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
               &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
             },
-            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                 &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                 &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
               },
@@ -1745,8 +1745,8 @@
             },
           },
           &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                 &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                 &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
               },
@@ -1763,8 +1763,8 @@
             &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
               &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
             },
-            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                 &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                 &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
               },
@@ -1785,8 +1785,8 @@
             &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
               &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
             },
-            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                 &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                 &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
               },
@@ -2466,8 +2466,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2483,8 +2483,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2501,8 +2501,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2523,8 +2523,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2740,8 +2740,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -2757,8 +2757,8 @@
                     },
                   },
                   &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -2775,8 +2775,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -2797,8 +2797,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -2964,8 +2964,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2981,8 +2981,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2999,8 +2999,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -3021,8 +3021,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -3339,8 +3339,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -3356,8 +3356,8 @@
                       },
                     },
                     &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -3374,8 +3374,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -3396,8 +3396,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -3563,8 +3563,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3580,8 +3580,8 @@
                 },
               },
               &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3598,8 +3598,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3620,8 +3620,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3832,8 +3832,8 @@
             &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
               &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
             },
-            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                 &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                 &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
               },
@@ -3849,8 +3849,8 @@
             },
           },
           &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                 &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                 &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
               },
@@ -3867,8 +3867,8 @@
             &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
               &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
             },
-            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                 &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                 &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
               },
@@ -3889,8 +3889,8 @@
             &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
               &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
             },
-            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                 &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                 &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
               },
diff --git a/docs/dyn/dlp_v2.projects.deidentifyTemplates.html b/docs/dyn/dlp_v2.projects.deidentifyTemplates.html
index 2ea181b..1d1a505 100644
--- a/docs/dyn/dlp_v2.projects.deidentifyTemplates.html
+++ b/docs/dyn/dlp_v2.projects.deidentifyTemplates.html
@@ -201,8 +201,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -218,8 +218,8 @@
                 },
               },
               &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -236,8 +236,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -258,8 +258,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -475,8 +475,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -492,8 +492,8 @@
                       },
                     },
                     &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -510,8 +510,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -532,8 +532,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -699,8 +699,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -716,8 +716,8 @@
                 },
               },
               &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -734,8 +734,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -756,8 +756,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -996,8 +996,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1013,8 +1013,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1031,8 +1031,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1053,8 +1053,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1270,8 +1270,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -1287,8 +1287,8 @@
                     },
                   },
                   &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -1305,8 +1305,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -1327,8 +1327,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -1494,8 +1494,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1511,8 +1511,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1529,8 +1529,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1551,8 +1551,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1813,8 +1813,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1830,8 +1830,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1848,8 +1848,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1870,8 +1870,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2087,8 +2087,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -2104,8 +2104,8 @@
                     },
                   },
                   &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -2122,8 +2122,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -2144,8 +2144,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -2311,8 +2311,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2328,8 +2328,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2346,8 +2346,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2368,8 +2368,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2618,8 +2618,8 @@
                   &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                     &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                   },
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -2635,8 +2635,8 @@
                   },
                 },
                 &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -2653,8 +2653,8 @@
                   &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                     &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                   },
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -2675,8 +2675,8 @@
                   &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                     &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                   },
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -2892,8 +2892,8 @@
                         &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                           &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                         },
-                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                             &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                             &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                           },
@@ -2909,8 +2909,8 @@
                         },
                       },
                       &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                             &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                             &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                           },
@@ -2927,8 +2927,8 @@
                         &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                           &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                         },
-                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                             &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                             &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                           },
@@ -2949,8 +2949,8 @@
                         &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                           &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                         },
-                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                             &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                             &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                           },
@@ -3116,8 +3116,8 @@
                   &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                     &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                   },
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -3133,8 +3133,8 @@
                   },
                 },
                 &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -3151,8 +3151,8 @@
                   &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                     &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                   },
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -3173,8 +3173,8 @@
                   &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                     &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                   },
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -3430,8 +3430,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3447,8 +3447,8 @@
                 },
               },
               &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3465,8 +3465,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3487,8 +3487,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3704,8 +3704,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -3721,8 +3721,8 @@
                       },
                     },
                     &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -3739,8 +3739,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -3761,8 +3761,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -3928,8 +3928,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3945,8 +3945,8 @@
                 },
               },
               &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3963,8 +3963,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3985,8 +3985,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -4224,8 +4224,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4241,8 +4241,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4259,8 +4259,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4281,8 +4281,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4498,8 +4498,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -4515,8 +4515,8 @@
                     },
                   },
                   &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -4533,8 +4533,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -4555,8 +4555,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -4722,8 +4722,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4739,8 +4739,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4757,8 +4757,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4779,8 +4779,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
diff --git a/docs/dyn/dlp_v2.projects.locations.content.html b/docs/dyn/dlp_v2.projects.locations.content.html
index 7aa6964..bf1a87a 100644
--- a/docs/dyn/dlp_v2.projects.locations.content.html
+++ b/docs/dyn/dlp_v2.projects.locations.content.html
@@ -190,8 +190,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -207,8 +207,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -225,8 +225,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -247,8 +247,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -464,8 +464,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -481,8 +481,8 @@
                     },
                   },
                   &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -499,8 +499,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -521,8 +521,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -688,8 +688,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -705,8 +705,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -723,8 +723,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -745,8 +745,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1235,8 +1235,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -1252,8 +1252,8 @@
                       },
                     },
                     &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -1270,8 +1270,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -1292,8 +1292,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -1459,8 +1459,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -1476,8 +1476,8 @@
                 },
               },
               &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -1494,8 +1494,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -1516,8 +1516,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -1728,8 +1728,8 @@
             &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
               &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
             },
-            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                 &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                 &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
               },
@@ -1745,8 +1745,8 @@
             },
           },
           &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                 &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                 &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
               },
@@ -1763,8 +1763,8 @@
             &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
               &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
             },
-            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                 &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                 &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
               },
@@ -1785,8 +1785,8 @@
             &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
               &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
             },
-            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                 &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                 &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
               },
@@ -2466,8 +2466,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2483,8 +2483,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2501,8 +2501,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2523,8 +2523,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2740,8 +2740,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -2757,8 +2757,8 @@
                     },
                   },
                   &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -2775,8 +2775,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -2797,8 +2797,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -2964,8 +2964,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2981,8 +2981,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2999,8 +2999,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -3021,8 +3021,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -3339,8 +3339,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -3356,8 +3356,8 @@
                       },
                     },
                     &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -3374,8 +3374,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -3396,8 +3396,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -3563,8 +3563,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3580,8 +3580,8 @@
                 },
               },
               &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3598,8 +3598,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3620,8 +3620,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3832,8 +3832,8 @@
             &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
               &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
             },
-            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                 &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                 &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
               },
@@ -3849,8 +3849,8 @@
             },
           },
           &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                 &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                 &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
               },
@@ -3867,8 +3867,8 @@
             &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
               &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
             },
-            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                 &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                 &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
               },
@@ -3889,8 +3889,8 @@
             &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
               &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
             },
-            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+            &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+              &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                 &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                 &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
               },
diff --git a/docs/dyn/dlp_v2.projects.locations.deidentifyTemplates.html b/docs/dyn/dlp_v2.projects.locations.deidentifyTemplates.html
index bf7244f..dc6a3ac 100644
--- a/docs/dyn/dlp_v2.projects.locations.deidentifyTemplates.html
+++ b/docs/dyn/dlp_v2.projects.locations.deidentifyTemplates.html
@@ -201,8 +201,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -218,8 +218,8 @@
                 },
               },
               &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -236,8 +236,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -258,8 +258,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -475,8 +475,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -492,8 +492,8 @@
                       },
                     },
                     &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -510,8 +510,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -532,8 +532,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -699,8 +699,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -716,8 +716,8 @@
                 },
               },
               &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -734,8 +734,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -756,8 +756,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -996,8 +996,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1013,8 +1013,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1031,8 +1031,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1053,8 +1053,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1270,8 +1270,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -1287,8 +1287,8 @@
                     },
                   },
                   &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -1305,8 +1305,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -1327,8 +1327,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -1494,8 +1494,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1511,8 +1511,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1529,8 +1529,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1551,8 +1551,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1813,8 +1813,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1830,8 +1830,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1848,8 +1848,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -1870,8 +1870,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2087,8 +2087,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -2104,8 +2104,8 @@
                     },
                   },
                   &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -2122,8 +2122,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -2144,8 +2144,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -2311,8 +2311,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2328,8 +2328,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2346,8 +2346,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2368,8 +2368,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -2618,8 +2618,8 @@
                   &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                     &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                   },
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -2635,8 +2635,8 @@
                   },
                 },
                 &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -2653,8 +2653,8 @@
                   &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                     &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                   },
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -2675,8 +2675,8 @@
                   &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                     &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                   },
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -2892,8 +2892,8 @@
                         &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                           &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                         },
-                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                             &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                             &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                           },
@@ -2909,8 +2909,8 @@
                         },
                       },
                       &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                             &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                             &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                           },
@@ -2927,8 +2927,8 @@
                         &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                           &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                         },
-                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                             &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                             &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                           },
@@ -2949,8 +2949,8 @@
                         &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                           &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                         },
-                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                        &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                          &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                             &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                             &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                           },
@@ -3116,8 +3116,8 @@
                   &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                     &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                   },
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -3133,8 +3133,8 @@
                   },
                 },
                 &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -3151,8 +3151,8 @@
                   &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                     &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                   },
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -3173,8 +3173,8 @@
                   &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                     &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                   },
-                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                  &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                    &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                       &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                       &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                     },
@@ -3430,8 +3430,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3447,8 +3447,8 @@
                 },
               },
               &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3465,8 +3465,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3487,8 +3487,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3704,8 +3704,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -3721,8 +3721,8 @@
                       },
                     },
                     &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -3739,8 +3739,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -3761,8 +3761,8 @@
                       &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                         &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                       },
-                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                      &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                        &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                           &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                           &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                         },
@@ -3928,8 +3928,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3945,8 +3945,8 @@
                 },
               },
               &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3963,8 +3963,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -3985,8 +3985,8 @@
                 &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                   &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                 },
-                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                  &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                     &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                     &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                   },
@@ -4224,8 +4224,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4241,8 +4241,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4259,8 +4259,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4281,8 +4281,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4498,8 +4498,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -4515,8 +4515,8 @@
                     },
                   },
                   &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -4533,8 +4533,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -4555,8 +4555,8 @@
                     &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                       &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
                     },
-                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+                    &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                      &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                         &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                         &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                       },
@@ -4722,8 +4722,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4739,8 +4739,8 @@
               },
             },
             &quot;cryptoHashConfig&quot;: { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # The key used by the hash function.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4757,8 +4757,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # The &#x27;tweak&#x27;, a context may be used for higher security since the same identifier in two different contexts won&#x27;t be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Required. The key used by the encryption algorithm.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
@@ -4779,8 +4779,8 @@
               &quot;context&quot;: { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
                 &quot;name&quot;: &quot;A String&quot;, # Name describing the field.
               },
-              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
-                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). # Kms wrapped key
+              &quot;cryptoKey&quot;: { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
+                &quot;kmsWrapped&quot;: { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). # Key wrapped using Cloud KMS
                   &quot;cryptoKeyName&quot;: &quot;A String&quot;, # Required. The resource name of the KMS CryptoKey to use for unwrapping.
                   &quot;wrappedKey&quot;: &quot;A String&quot;, # Required. The wrapped data crypto key.
                 },
diff --git a/docs/dyn/drive_v2.changes.html b/docs/dyn/drive_v2.changes.html
index 918ab52..ac8e160 100644
--- a/docs/dyn/drive_v2.changes.html
+++ b/docs/dyn/drive_v2.changes.html
@@ -234,7 +234,7 @@
     },
     &quot;fileExtension&quot;: &quot;A String&quot;, # The final component of fullFileExtension with trailing text that does not appear to be part of the extension removed. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
     &quot;fileSize&quot;: &quot;A String&quot;, # The size of the file in bytes. This field is populated for files with content stored in Google Drive and for files in Docs Editors; it is not populated for shortcut files.
-    &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette. Not populated for items in shared drives.
+    &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder or a shortcut to a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette.
     &quot;fullFileExtension&quot;: &quot;A String&quot;, # The full file extension; extracted from the title. May contain multiple concatenated extensions, such as &quot;tar.gz&quot;. Removing an extension from the title does not clear this field; however, changing the extension on the title does update this field. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
     &quot;hasAugmentedPermissions&quot;: True or False, # Whether there are permissions directly on this file. This field is only populated for items in shared drives.
     &quot;hasThumbnail&quot;: True or False, # Whether this file has a thumbnail. This does not indicate whether the requesting app has access to the thumbnail. To check access, look for the presence of the thumbnailLink field.
@@ -750,7 +750,7 @@
         },
         &quot;fileExtension&quot;: &quot;A String&quot;, # The final component of fullFileExtension with trailing text that does not appear to be part of the extension removed. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
         &quot;fileSize&quot;: &quot;A String&quot;, # The size of the file in bytes. This field is populated for files with content stored in Google Drive and for files in Docs Editors; it is not populated for shortcut files.
-        &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette. Not populated for items in shared drives.
+        &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder or a shortcut to a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette.
         &quot;fullFileExtension&quot;: &quot;A String&quot;, # The full file extension; extracted from the title. May contain multiple concatenated extensions, such as &quot;tar.gz&quot;. Removing an extension from the title does not clear this field; however, changing the extension on the title does update this field. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
         &quot;hasAugmentedPermissions&quot;: True or False, # Whether there are permissions directly on this file. This field is only populated for items in shared drives.
         &quot;hasThumbnail&quot;: True or False, # Whether this file has a thumbnail. This does not indicate whether the requesting app has access to the thumbnail. To check access, look for the presence of the thumbnailLink field.
diff --git a/docs/dyn/drive_v2.files.html b/docs/dyn/drive_v2.files.html
index 07e32b7..0223f2e 100644
--- a/docs/dyn/drive_v2.files.html
+++ b/docs/dyn/drive_v2.files.html
@@ -222,7 +222,7 @@
   },
   &quot;fileExtension&quot;: &quot;A String&quot;, # The final component of fullFileExtension with trailing text that does not appear to be part of the extension removed. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
   &quot;fileSize&quot;: &quot;A String&quot;, # The size of the file in bytes. This field is populated for files with content stored in Google Drive and for files in Docs Editors; it is not populated for shortcut files.
-  &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette. Not populated for items in shared drives.
+  &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder or a shortcut to a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette.
   &quot;fullFileExtension&quot;: &quot;A String&quot;, # The full file extension; extracted from the title. May contain multiple concatenated extensions, such as &quot;tar.gz&quot;. Removing an extension from the title does not clear this field; however, changing the extension on the title does update this field. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
   &quot;hasAugmentedPermissions&quot;: True or False, # Whether there are permissions directly on this file. This field is only populated for items in shared drives.
   &quot;hasThumbnail&quot;: True or False, # Whether this file has a thumbnail. This does not indicate whether the requesting app has access to the thumbnail. To check access, look for the presence of the thumbnailLink field.
@@ -614,7 +614,7 @@
   },
   &quot;fileExtension&quot;: &quot;A String&quot;, # The final component of fullFileExtension with trailing text that does not appear to be part of the extension removed. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
   &quot;fileSize&quot;: &quot;A String&quot;, # The size of the file in bytes. This field is populated for files with content stored in Google Drive and for files in Docs Editors; it is not populated for shortcut files.
-  &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette. Not populated for items in shared drives.
+  &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder or a shortcut to a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette.
   &quot;fullFileExtension&quot;: &quot;A String&quot;, # The full file extension; extracted from the title. May contain multiple concatenated extensions, such as &quot;tar.gz&quot;. Removing an extension from the title does not clear this field; however, changing the extension on the title does update this field. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
   &quot;hasAugmentedPermissions&quot;: True or False, # Whether there are permissions directly on this file. This field is only populated for items in shared drives.
   &quot;hasThumbnail&quot;: True or False, # Whether this file has a thumbnail. This does not indicate whether the requesting app has access to the thumbnail. To check access, look for the presence of the thumbnailLink field.
@@ -1071,7 +1071,7 @@
   },
   &quot;fileExtension&quot;: &quot;A String&quot;, # The final component of fullFileExtension with trailing text that does not appear to be part of the extension removed. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
   &quot;fileSize&quot;: &quot;A String&quot;, # The size of the file in bytes. This field is populated for files with content stored in Google Drive and for files in Docs Editors; it is not populated for shortcut files.
-  &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette. Not populated for items in shared drives.
+  &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder or a shortcut to a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette.
   &quot;fullFileExtension&quot;: &quot;A String&quot;, # The full file extension; extracted from the title. May contain multiple concatenated extensions, such as &quot;tar.gz&quot;. Removing an extension from the title does not clear this field; however, changing the extension on the title does update this field. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
   &quot;hasAugmentedPermissions&quot;: True or False, # Whether there are permissions directly on this file. This field is only populated for items in shared drives.
   &quot;hasThumbnail&quot;: True or False, # Whether this file has a thumbnail. This does not indicate whether the requesting app has access to the thumbnail. To check access, look for the presence of the thumbnailLink field.
@@ -1477,7 +1477,7 @@
   },
   &quot;fileExtension&quot;: &quot;A String&quot;, # The final component of fullFileExtension with trailing text that does not appear to be part of the extension removed. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
   &quot;fileSize&quot;: &quot;A String&quot;, # The size of the file in bytes. This field is populated for files with content stored in Google Drive and for files in Docs Editors; it is not populated for shortcut files.
-  &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette. Not populated for items in shared drives.
+  &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder or a shortcut to a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette.
   &quot;fullFileExtension&quot;: &quot;A String&quot;, # The full file extension; extracted from the title. May contain multiple concatenated extensions, such as &quot;tar.gz&quot;. Removing an extension from the title does not clear this field; however, changing the extension on the title does update this field. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
   &quot;hasAugmentedPermissions&quot;: True or False, # Whether there are permissions directly on this file. This field is only populated for items in shared drives.
   &quot;hasThumbnail&quot;: True or False, # Whether this file has a thumbnail. This does not indicate whether the requesting app has access to the thumbnail. To check access, look for the presence of the thumbnailLink field.
@@ -1872,7 +1872,7 @@
   },
   &quot;fileExtension&quot;: &quot;A String&quot;, # The final component of fullFileExtension with trailing text that does not appear to be part of the extension removed. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
   &quot;fileSize&quot;: &quot;A String&quot;, # The size of the file in bytes. This field is populated for files with content stored in Google Drive and for files in Docs Editors; it is not populated for shortcut files.
-  &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette. Not populated for items in shared drives.
+  &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder or a shortcut to a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette.
   &quot;fullFileExtension&quot;: &quot;A String&quot;, # The full file extension; extracted from the title. May contain multiple concatenated extensions, such as &quot;tar.gz&quot;. Removing an extension from the title does not clear this field; however, changing the extension on the title does update this field. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
   &quot;hasAugmentedPermissions&quot;: True or False, # Whether there are permissions directly on this file. This field is only populated for items in shared drives.
   &quot;hasThumbnail&quot;: True or False, # Whether this file has a thumbnail. This does not indicate whether the requesting app has access to the thumbnail. To check access, look for the presence of the thumbnailLink field.
@@ -2193,7 +2193,7 @@
       BASIC - Deprecated
       FULL - Deprecated
   q: string, Query string for searching files.
-  spaces: string, A comma-separated list of spaces to query. Supported values are &#x27;drive&#x27;, &#x27;appDataFolder&#x27; and &#x27;photos&#x27;.
+  spaces: string, A comma-separated list of spaces to query. Supported values are &#x27;drive&#x27; and &#x27;appDataFolder&#x27;.
   supportsAllDrives: boolean, Whether the requesting application supports both My Drives and shared drives.
   supportsTeamDrives: boolean, Deprecated use supportsAllDrives instead.
   teamDriveId: string, Deprecated use driveId instead.
@@ -2281,7 +2281,7 @@
       },
       &quot;fileExtension&quot;: &quot;A String&quot;, # The final component of fullFileExtension with trailing text that does not appear to be part of the extension removed. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
       &quot;fileSize&quot;: &quot;A String&quot;, # The size of the file in bytes. This field is populated for files with content stored in Google Drive and for files in Docs Editors; it is not populated for shortcut files.
-      &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette. Not populated for items in shared drives.
+      &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder or a shortcut to a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette.
       &quot;fullFileExtension&quot;: &quot;A String&quot;, # The full file extension; extracted from the title. May contain multiple concatenated extensions, such as &quot;tar.gz&quot;. Removing an extension from the title does not clear this field; however, changing the extension on the title does update this field. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
       &quot;hasAugmentedPermissions&quot;: True or False, # Whether there are permissions directly on this file. This field is only populated for items in shared drives.
       &quot;hasThumbnail&quot;: True or False, # Whether this file has a thumbnail. This does not indicate whether the requesting app has access to the thumbnail. To check access, look for the presence of the thumbnailLink field.
@@ -2685,7 +2685,7 @@
   },
   &quot;fileExtension&quot;: &quot;A String&quot;, # The final component of fullFileExtension with trailing text that does not appear to be part of the extension removed. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
   &quot;fileSize&quot;: &quot;A String&quot;, # The size of the file in bytes. This field is populated for files with content stored in Google Drive and for files in Docs Editors; it is not populated for shortcut files.
-  &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette. Not populated for items in shared drives.
+  &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder or a shortcut to a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette.
   &quot;fullFileExtension&quot;: &quot;A String&quot;, # The full file extension; extracted from the title. May contain multiple concatenated extensions, such as &quot;tar.gz&quot;. Removing an extension from the title does not clear this field; however, changing the extension on the title does update this field. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
   &quot;hasAugmentedPermissions&quot;: True or False, # Whether there are permissions directly on this file. This field is only populated for items in shared drives.
   &quot;hasThumbnail&quot;: True or False, # Whether this file has a thumbnail. This does not indicate whether the requesting app has access to the thumbnail. To check access, look for the presence of the thumbnailLink field.
@@ -3087,7 +3087,7 @@
   },
   &quot;fileExtension&quot;: &quot;A String&quot;, # The final component of fullFileExtension with trailing text that does not appear to be part of the extension removed. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
   &quot;fileSize&quot;: &quot;A String&quot;, # The size of the file in bytes. This field is populated for files with content stored in Google Drive and for files in Docs Editors; it is not populated for shortcut files.
-  &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette. Not populated for items in shared drives.
+  &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder or a shortcut to a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette.
   &quot;fullFileExtension&quot;: &quot;A String&quot;, # The full file extension; extracted from the title. May contain multiple concatenated extensions, such as &quot;tar.gz&quot;. Removing an extension from the title does not clear this field; however, changing the extension on the title does update this field. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
   &quot;hasAugmentedPermissions&quot;: True or False, # Whether there are permissions directly on this file. This field is only populated for items in shared drives.
   &quot;hasThumbnail&quot;: True or False, # Whether this file has a thumbnail. This does not indicate whether the requesting app has access to the thumbnail. To check access, look for the presence of the thumbnailLink field.
@@ -3475,7 +3475,7 @@
   },
   &quot;fileExtension&quot;: &quot;A String&quot;, # The final component of fullFileExtension with trailing text that does not appear to be part of the extension removed. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
   &quot;fileSize&quot;: &quot;A String&quot;, # The size of the file in bytes. This field is populated for files with content stored in Google Drive and for files in Docs Editors; it is not populated for shortcut files.
-  &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette. Not populated for items in shared drives.
+  &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder or a shortcut to a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette.
   &quot;fullFileExtension&quot;: &quot;A String&quot;, # The full file extension; extracted from the title. May contain multiple concatenated extensions, such as &quot;tar.gz&quot;. Removing an extension from the title does not clear this field; however, changing the extension on the title does update this field. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
   &quot;hasAugmentedPermissions&quot;: True or False, # Whether there are permissions directly on this file. This field is only populated for items in shared drives.
   &quot;hasThumbnail&quot;: True or False, # Whether this file has a thumbnail. This does not indicate whether the requesting app has access to the thumbnail. To check access, look for the presence of the thumbnailLink field.
@@ -3863,7 +3863,7 @@
   },
   &quot;fileExtension&quot;: &quot;A String&quot;, # The final component of fullFileExtension with trailing text that does not appear to be part of the extension removed. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
   &quot;fileSize&quot;: &quot;A String&quot;, # The size of the file in bytes. This field is populated for files with content stored in Google Drive and for files in Docs Editors; it is not populated for shortcut files.
-  &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette. Not populated for items in shared drives.
+  &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder or a shortcut to a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette.
   &quot;fullFileExtension&quot;: &quot;A String&quot;, # The full file extension; extracted from the title. May contain multiple concatenated extensions, such as &quot;tar.gz&quot;. Removing an extension from the title does not clear this field; however, changing the extension on the title does update this field. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
   &quot;hasAugmentedPermissions&quot;: True or False, # Whether there are permissions directly on this file. This field is only populated for items in shared drives.
   &quot;hasThumbnail&quot;: True or False, # Whether this file has a thumbnail. This does not indicate whether the requesting app has access to the thumbnail. To check access, look for the presence of the thumbnailLink field.
@@ -4251,7 +4251,7 @@
   },
   &quot;fileExtension&quot;: &quot;A String&quot;, # The final component of fullFileExtension with trailing text that does not appear to be part of the extension removed. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
   &quot;fileSize&quot;: &quot;A String&quot;, # The size of the file in bytes. This field is populated for files with content stored in Google Drive and for files in Docs Editors; it is not populated for shortcut files.
-  &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette. Not populated for items in shared drives.
+  &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder or a shortcut to a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette.
   &quot;fullFileExtension&quot;: &quot;A String&quot;, # The full file extension; extracted from the title. May contain multiple concatenated extensions, such as &quot;tar.gz&quot;. Removing an extension from the title does not clear this field; however, changing the extension on the title does update this field. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
   &quot;hasAugmentedPermissions&quot;: True or False, # Whether there are permissions directly on this file. This field is only populated for items in shared drives.
   &quot;hasThumbnail&quot;: True or False, # Whether this file has a thumbnail. This does not indicate whether the requesting app has access to the thumbnail. To check access, look for the presence of the thumbnailLink field.
@@ -4635,7 +4635,7 @@
   },
   &quot;fileExtension&quot;: &quot;A String&quot;, # The final component of fullFileExtension with trailing text that does not appear to be part of the extension removed. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
   &quot;fileSize&quot;: &quot;A String&quot;, # The size of the file in bytes. This field is populated for files with content stored in Google Drive and for files in Docs Editors; it is not populated for shortcut files.
-  &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette. Not populated for items in shared drives.
+  &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder or a shortcut to a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette.
   &quot;fullFileExtension&quot;: &quot;A String&quot;, # The full file extension; extracted from the title. May contain multiple concatenated extensions, such as &quot;tar.gz&quot;. Removing an extension from the title does not clear this field; however, changing the extension on the title does update this field. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
   &quot;hasAugmentedPermissions&quot;: True or False, # Whether there are permissions directly on this file. This field is only populated for items in shared drives.
   &quot;hasThumbnail&quot;: True or False, # Whether this file has a thumbnail. This does not indicate whether the requesting app has access to the thumbnail. To check access, look for the presence of the thumbnailLink field.
@@ -5039,7 +5039,7 @@
   },
   &quot;fileExtension&quot;: &quot;A String&quot;, # The final component of fullFileExtension with trailing text that does not appear to be part of the extension removed. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
   &quot;fileSize&quot;: &quot;A String&quot;, # The size of the file in bytes. This field is populated for files with content stored in Google Drive and for files in Docs Editors; it is not populated for shortcut files.
-  &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette. Not populated for items in shared drives.
+  &quot;folderColorRgb&quot;: &quot;A String&quot;, # Folder color as an RGB hex string if the file is a folder or a shortcut to a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette.
   &quot;fullFileExtension&quot;: &quot;A String&quot;, # The full file extension; extracted from the title. May contain multiple concatenated extensions, such as &quot;tar.gz&quot;. Removing an extension from the title does not clear this field; however, changing the extension on the title does update this field. This field is only populated for files with content stored in Google Drive; it is not populated for Docs Editors or shortcut files.
   &quot;hasAugmentedPermissions&quot;: True or False, # Whether there are permissions directly on this file. This field is only populated for items in shared drives.
   &quot;hasThumbnail&quot;: True or False, # Whether this file has a thumbnail. This does not indicate whether the requesting app has access to the thumbnail. To check access, look for the presence of the thumbnailLink field.
diff --git a/docs/dyn/drive_v3.changes.html b/docs/dyn/drive_v3.changes.html
index 7b82334..86d5675 100644
--- a/docs/dyn/drive_v3.changes.html
+++ b/docs/dyn/drive_v3.changes.html
@@ -257,7 +257,7 @@
           &quot;a_key&quot;: &quot;A String&quot;, # A mapping from export format to URL
         },
         &quot;fileExtension&quot;: &quot;A String&quot;, # The final component of fullFileExtension. This is only available for files with binary content in Google Drive.
-        &quot;folderColorRgb&quot;: &quot;A String&quot;, # The color for a folder as an RGB hex string. The supported colors are published in the folderColorPalette field of the About resource.
+        &quot;folderColorRgb&quot;: &quot;A String&quot;, # The color for a folder or shortcut to a folder as an RGB hex string. The supported colors are published in the folderColorPalette field of the About resource.
             # If an unsupported color is specified, the closest color in the palette will be used instead.
         &quot;fullFileExtension&quot;: &quot;A String&quot;, # The full file extension extracted from the name field. May contain multiple concatenated extensions, such as &quot;tar.gz&quot;. This is only available for files with binary content in Google Drive.
             # This is automatically updated when the name field changes, however it is not cleared if the new name does not contain a valid extension.
diff --git a/docs/dyn/drive_v3.files.html b/docs/dyn/drive_v3.files.html
index f01d687..ea498ea 100644
--- a/docs/dyn/drive_v3.files.html
+++ b/docs/dyn/drive_v3.files.html
@@ -208,7 +208,7 @@
     &quot;a_key&quot;: &quot;A String&quot;, # A mapping from export format to URL
   },
   &quot;fileExtension&quot;: &quot;A String&quot;, # The final component of fullFileExtension. This is only available for files with binary content in Google Drive.
-  &quot;folderColorRgb&quot;: &quot;A String&quot;, # The color for a folder as an RGB hex string. The supported colors are published in the folderColorPalette field of the About resource.
+  &quot;folderColorRgb&quot;: &quot;A String&quot;, # The color for a folder or shortcut to a folder as an RGB hex string. The supported colors are published in the folderColorPalette field of the About resource.
       # If an unsupported color is specified, the closest color in the palette will be used instead.
   &quot;fullFileExtension&quot;: &quot;A String&quot;, # The full file extension extracted from the name field. May contain multiple concatenated extensions, such as &quot;tar.gz&quot;. This is only available for files with binary content in Google Drive.
       # This is automatically updated when the name field changes, however it is not cleared if the new name does not contain a valid extension.
@@ -480,7 +480,7 @@
     &quot;a_key&quot;: &quot;A String&quot;, # A mapping from export format to URL
   },
   &quot;fileExtension&quot;: &quot;A String&quot;, # The final component of fullFileExtension. This is only available for files with binary content in Google Drive.
-  &quot;folderColorRgb&quot;: &quot;A String&quot;, # The color for a folder as an RGB hex string. The supported colors are published in the folderColorPalette field of the About resource.
+  &quot;folderColorRgb&quot;: &quot;A String&quot;, # The color for a folder or shortcut to a folder as an RGB hex string. The supported colors are published in the folderColorPalette field of the About resource.
       # If an unsupported color is specified, the closest color in the palette will be used instead.
   &quot;fullFileExtension&quot;: &quot;A String&quot;, # The full file extension extracted from the name field. May contain multiple concatenated extensions, such as &quot;tar.gz&quot;. This is only available for files with binary content in Google Drive.
       # This is automatically updated when the name field changes, however it is not cleared if the new name does not contain a valid extension.
@@ -750,7 +750,7 @@
     &quot;a_key&quot;: &quot;A String&quot;, # A mapping from export format to URL
   },
   &quot;fileExtension&quot;: &quot;A String&quot;, # The final component of fullFileExtension. This is only available for files with binary content in Google Drive.
-  &quot;folderColorRgb&quot;: &quot;A String&quot;, # The color for a folder as an RGB hex string. The supported colors are published in the folderColorPalette field of the About resource.
+  &quot;folderColorRgb&quot;: &quot;A String&quot;, # The color for a folder or shortcut to a folder as an RGB hex string. The supported colors are published in the folderColorPalette field of the About resource.
       # If an unsupported color is specified, the closest color in the palette will be used instead.
   &quot;fullFileExtension&quot;: &quot;A String&quot;, # The full file extension extracted from the name field. May contain multiple concatenated extensions, such as &quot;tar.gz&quot;. This is only available for files with binary content in Google Drive.
       # This is automatically updated when the name field changes, however it is not cleared if the new name does not contain a valid extension.
@@ -1025,7 +1025,7 @@
     &quot;a_key&quot;: &quot;A String&quot;, # A mapping from export format to URL
   },
   &quot;fileExtension&quot;: &quot;A String&quot;, # The final component of fullFileExtension. This is only available for files with binary content in Google Drive.
-  &quot;folderColorRgb&quot;: &quot;A String&quot;, # The color for a folder as an RGB hex string. The supported colors are published in the folderColorPalette field of the About resource.
+  &quot;folderColorRgb&quot;: &quot;A String&quot;, # The color for a folder or shortcut to a folder as an RGB hex string. The supported colors are published in the folderColorPalette field of the About resource.
       # If an unsupported color is specified, the closest color in the palette will be used instead.
   &quot;fullFileExtension&quot;: &quot;A String&quot;, # The full file extension extracted from the name field. May contain multiple concatenated extensions, such as &quot;tar.gz&quot;. This is only available for files with binary content in Google Drive.
       # This is automatically updated when the name field changes, however it is not cleared if the new name does not contain a valid extension.
@@ -1363,7 +1363,7 @@
     &quot;a_key&quot;: &quot;A String&quot;, # A mapping from export format to URL
   },
   &quot;fileExtension&quot;: &quot;A String&quot;, # The final component of fullFileExtension. This is only available for files with binary content in Google Drive.
-  &quot;folderColorRgb&quot;: &quot;A String&quot;, # The color for a folder as an RGB hex string. The supported colors are published in the folderColorPalette field of the About resource.
+  &quot;folderColorRgb&quot;: &quot;A String&quot;, # The color for a folder or shortcut to a folder as an RGB hex string. The supported colors are published in the folderColorPalette field of the About resource.
       # If an unsupported color is specified, the closest color in the palette will be used instead.
   &quot;fullFileExtension&quot;: &quot;A String&quot;, # The full file extension extracted from the name field. May contain multiple concatenated extensions, such as &quot;tar.gz&quot;. This is only available for files with binary content in Google Drive.
       # This is automatically updated when the name field changes, however it is not cleared if the new name does not contain a valid extension.
@@ -1586,7 +1586,7 @@
   pageSize: integer, The maximum number of files to return per page. Partial or empty result pages are possible even before the end of the files list has been reached.
   pageToken: string, The token for continuing a previous list request on the next page. This should be set to the value of &#x27;nextPageToken&#x27; from the previous response.
   q: string, A query for filtering the file results. See the &quot;Search for Files&quot; guide for supported syntax.
-  spaces: string, A comma-separated list of spaces to query within the corpus. Supported values are &#x27;drive&#x27;, &#x27;appDataFolder&#x27; and &#x27;photos&#x27;.
+  spaces: string, A comma-separated list of spaces to query within the corpus. Supported values are &#x27;drive&#x27; and &#x27;appDataFolder&#x27;.
   supportsAllDrives: boolean, Whether the requesting application supports both My Drives and shared drives.
   supportsTeamDrives: boolean, Deprecated use supportsAllDrives instead.
   teamDriveId: string, Deprecated use driveId instead.
@@ -1670,7 +1670,7 @@
         &quot;a_key&quot;: &quot;A String&quot;, # A mapping from export format to URL
       },
       &quot;fileExtension&quot;: &quot;A String&quot;, # The final component of fullFileExtension. This is only available for files with binary content in Google Drive.
-      &quot;folderColorRgb&quot;: &quot;A String&quot;, # The color for a folder as an RGB hex string. The supported colors are published in the folderColorPalette field of the About resource.
+      &quot;folderColorRgb&quot;: &quot;A String&quot;, # The color for a folder or shortcut to a folder as an RGB hex string. The supported colors are published in the folderColorPalette field of the About resource.
           # If an unsupported color is specified, the closest color in the palette will be used instead.
       &quot;fullFileExtension&quot;: &quot;A String&quot;, # The full file extension extracted from the name field. May contain multiple concatenated extensions, such as &quot;tar.gz&quot;. This is only available for files with binary content in Google Drive.
           # This is automatically updated when the name field changes, however it is not cleared if the new name does not contain a valid extension.
@@ -1960,7 +1960,7 @@
     &quot;a_key&quot;: &quot;A String&quot;, # A mapping from export format to URL
   },
   &quot;fileExtension&quot;: &quot;A String&quot;, # The final component of fullFileExtension. This is only available for files with binary content in Google Drive.
-  &quot;folderColorRgb&quot;: &quot;A String&quot;, # The color for a folder as an RGB hex string. The supported colors are published in the folderColorPalette field of the About resource.
+  &quot;folderColorRgb&quot;: &quot;A String&quot;, # The color for a folder or shortcut to a folder as an RGB hex string. The supported colors are published in the folderColorPalette field of the About resource.
       # If an unsupported color is specified, the closest color in the palette will be used instead.
   &quot;fullFileExtension&quot;: &quot;A String&quot;, # The full file extension extracted from the name field. May contain multiple concatenated extensions, such as &quot;tar.gz&quot;. This is only available for files with binary content in Google Drive.
       # This is automatically updated when the name field changes, however it is not cleared if the new name does not contain a valid extension.
@@ -2236,7 +2236,7 @@
     &quot;a_key&quot;: &quot;A String&quot;, # A mapping from export format to URL
   },
   &quot;fileExtension&quot;: &quot;A String&quot;, # The final component of fullFileExtension. This is only available for files with binary content in Google Drive.
-  &quot;folderColorRgb&quot;: &quot;A String&quot;, # The color for a folder as an RGB hex string. The supported colors are published in the folderColorPalette field of the About resource.
+  &quot;folderColorRgb&quot;: &quot;A String&quot;, # The color for a folder or shortcut to a folder as an RGB hex string. The supported colors are published in the folderColorPalette field of the About resource.
       # If an unsupported color is specified, the closest color in the palette will be used instead.
   &quot;fullFileExtension&quot;: &quot;A String&quot;, # The full file extension extracted from the name field. May contain multiple concatenated extensions, such as &quot;tar.gz&quot;. This is only available for files with binary content in Google Drive.
       # This is automatically updated when the name field changes, however it is not cleared if the new name does not contain a valid extension.
diff --git a/docs/dyn/iam_v1.projects.serviceAccounts.html b/docs/dyn/iam_v1.projects.serviceAccounts.html
index 1fc1949..6903bbc 100644
--- a/docs/dyn/iam_v1.projects.serviceAccounts.html
+++ b/docs/dyn/iam_v1.projects.serviceAccounts.html
@@ -534,7 +534,7 @@
     The object takes the form of:
 
 { # Deprecated. [Migrate to Service Account Credentials API](https://cloud.google.com/iam/help/credentials/migrate-api). The service account sign JWT request.
-  &quot;payload&quot;: &quot;A String&quot;, # Required. Deprecated. [Migrate to Service Account Credentials API](https://cloud.google.com/iam/help/credentials/migrate-api). The JWT payload to sign. Must be a serialized JSON object that contains a JWT Claims Set. For example: `{&quot;sub&quot;: &quot;user@example.com&quot;, &quot;iat&quot;: 313435}` If the JWT Claims Set contains an expiration time (`exp`) claim, it must be an integer timestamp that is not in the past and no more than 1 hour in the future. If the JWT Claims Set does not contain an expiration time (`exp`) claim, this claim is added automatically, with a timestamp that is 1 hour in the future.
+  &quot;payload&quot;: &quot;A String&quot;, # Required. Deprecated. [Migrate to Service Account Credentials API](https://cloud.google.com/iam/help/credentials/migrate-api). The JWT payload to sign. Must be a serialized JSON object that contains a JWT Claims Set. For example: `{&quot;sub&quot;: &quot;user@example.com&quot;, &quot;iat&quot;: 313435}` If the JWT Claims Set contains an expiration time (`exp`) claim, it must be an integer timestamp that is not in the past and no more than 12 hours in the future. If the JWT Claims Set does not contain an expiration time (`exp`) claim, this claim is added automatically, with a timestamp that is 1 hour in the future.
 }
 
   x__xgafv: string, V1 error format.
diff --git a/docs/dyn/ideahub_v1alpha.ideas.html b/docs/dyn/ideahub_v1alpha.ideas.html
index a9b61b3..9fb7516 100644
--- a/docs/dyn/ideahub_v1alpha.ideas.html
+++ b/docs/dyn/ideahub_v1alpha.ideas.html
@@ -122,6 +122,7 @@
         { # Represents a Topic umbrella for a list of questions that a Creator may want to respond to.
           &quot;displayName&quot;: &quot;A String&quot;, # String displayed to the creator indicating the name of the Topic.
           &quot;mid&quot;: &quot;A String&quot;, # The mID of the topic.
+          &quot;name&quot;: &quot;A String&quot;, # Unique identifier for the topic. Format: topics/{topic}
         },
       ],
     },
diff --git a/docs/dyn/ideahub_v1alpha.platforms.properties.ideaActivities.html b/docs/dyn/ideahub_v1alpha.platforms.properties.ideaActivities.html
index 89536e0..da3c7bd 100644
--- a/docs/dyn/ideahub_v1alpha.platforms.properties.ideaActivities.html
+++ b/docs/dyn/ideahub_v1alpha.platforms.properties.ideaActivities.html
@@ -96,11 +96,11 @@
     The object takes the form of:
 
 { # An idea activity entry.
-  &quot;ideaIds&quot;: [ # The Idea IDs for this entry.
+  &quot;ideas&quot;: [ # The Idea IDs for this entry.
     &quot;A String&quot;,
   ],
   &quot;name&quot;: &quot;A String&quot;, # Unique identifier for the idea activity. Format: platforms/{platform}/properties/{property}/ideaActivities/{idea_activity}
-  &quot;topicIds&quot;: [ # The Topic IDs for this entry.
+  &quot;topics&quot;: [ # The Topic IDs for this entry.
     &quot;A String&quot;,
   ],
   &quot;type&quot;: &quot;A String&quot;, # The type of activity performed.
@@ -116,11 +116,11 @@
   An object of the form:
 
     { # An idea activity entry.
-  &quot;ideaIds&quot;: [ # The Idea IDs for this entry.
+  &quot;ideas&quot;: [ # The Idea IDs for this entry.
     &quot;A String&quot;,
   ],
   &quot;name&quot;: &quot;A String&quot;, # Unique identifier for the idea activity. Format: platforms/{platform}/properties/{property}/ideaActivities/{idea_activity}
-  &quot;topicIds&quot;: [ # The Topic IDs for this entry.
+  &quot;topics&quot;: [ # The Topic IDs for this entry.
     &quot;A String&quot;,
   ],
   &quot;type&quot;: &quot;A String&quot;, # The type of activity performed.
diff --git a/docs/dyn/ideahub_v1alpha.platforms.properties.ideas.html b/docs/dyn/ideahub_v1alpha.platforms.properties.ideas.html
index 5f1b4ba..fc92dca 100644
--- a/docs/dyn/ideahub_v1alpha.platforms.properties.ideas.html
+++ b/docs/dyn/ideahub_v1alpha.platforms.properties.ideas.html
@@ -122,6 +122,7 @@
         { # Represents a Topic umbrella for a list of questions that a Creator may want to respond to.
           &quot;displayName&quot;: &quot;A String&quot;, # String displayed to the creator indicating the name of the Topic.
           &quot;mid&quot;: &quot;A String&quot;, # The mID of the topic.
+          &quot;name&quot;: &quot;A String&quot;, # Unique identifier for the topic. Format: topics/{topic}
         },
       ],
     },
diff --git a/docs/dyn/index.md b/docs/dyn/index.md
index f951e82..f1c27c3 100644
--- a/docs/dyn/index.md
+++ b/docs/dyn/index.md
@@ -666,6 +666,11 @@
 * [v1beta1](http://googleapis.github.io/google-api-python-client/docs/dyn/networksecurity_v1beta1.html)
 
 
+## networkservices
+* [v1](http://googleapis.github.io/google-api-python-client/docs/dyn/networkservices_v1.html)
+* [v1beta1](http://googleapis.github.io/google-api-python-client/docs/dyn/networkservices_v1beta1.html)
+
+
 ## notebooks
 * [v1](http://googleapis.github.io/google-api-python-client/docs/dyn/notebooks_v1.html)
 
@@ -715,6 +720,11 @@
 * [v1](http://googleapis.github.io/google-api-python-client/docs/dyn/playcustomapp_v1.html)
 
 
+## policyanalyzer
+* [v1](http://googleapis.github.io/google-api-python-client/docs/dyn/policyanalyzer_v1.html)
+* [v1beta1](http://googleapis.github.io/google-api-python-client/docs/dyn/policyanalyzer_v1beta1.html)
+
+
 ## policysimulator
 * [v1](http://googleapis.github.io/google-api-python-client/docs/dyn/policysimulator_v1.html)
 * [v1beta1](http://googleapis.github.io/google-api-python-client/docs/dyn/policysimulator_v1beta1.html)
diff --git a/docs/dyn/jobs_v3.projects.jobs.html b/docs/dyn/jobs_v3.projects.jobs.html
index c817cb4..7828e36 100644
--- a/docs/dyn/jobs_v3.projects.jobs.html
+++ b/docs/dyn/jobs_v3.projects.jobs.html
@@ -629,7 +629,7 @@
 
 Args:
   parent: string, Required. The resource name of the project under which the job is created. The format is &quot;projects/{project_id}&quot;, for example, &quot;projects/api-test-project&quot;. (required)
-  filter: string, Required. The filter string specifies the jobs to be enumerated. Supported operator: =, AND The fields eligible for filtering are: * `companyName` (Required) * `requisitionId` (Optional) Sample Query: * companyName = &quot;projects/api-test-project/companies/123&quot; * companyName = &quot;projects/api-test-project/companies/123&quot; AND requisitionId = &quot;req-1&quot;
+  filter: string, Required. The filter string specifies the jobs to be enumerated. Supported operator: =, AND The fields eligible for filtering are: * `companyName` * `requisitionId` * `status` Available values: OPEN, EXPIRED, ALL. Defaults to OPEN if no value is specified. At least one of `companyName` and `requisitionId` must present or an INVALID_ARGUMENT error is thrown. Sample Query: * companyName = &quot;projects/api-test-project/companies/123&quot; * companyName = &quot;projects/api-test-project/companies/123&quot; AND requisitionId = &quot;req-1&quot; * companyName = &quot;projects/api-test-project/companies/123&quot; AND status = &quot;EXPIRED&quot; * requisitionId = &quot;req-1&quot; * requisitionId = &quot;req-1&quot; AND status = &quot;EXPIRED&quot;
   jobView: string, Optional. The desired job attributes returned for jobs in the search response. Defaults to JobView.JOB_VIEW_FULL if no value is specified.
     Allowed values
       JOB_VIEW_UNSPECIFIED - Default value.
diff --git a/docs/dyn/jobs_v3p1beta1.projects.jobs.html b/docs/dyn/jobs_v3p1beta1.projects.jobs.html
index 9face68..acb681d 100644
--- a/docs/dyn/jobs_v3p1beta1.projects.jobs.html
+++ b/docs/dyn/jobs_v3p1beta1.projects.jobs.html
@@ -629,7 +629,7 @@
 
 Args:
   parent: string, Required. The resource name of the project under which the job is created. The format is &quot;projects/{project_id}&quot;, for example, &quot;projects/api-test-project&quot;. (required)
-  filter: string, Required. The filter string specifies the jobs to be enumerated. Supported operator: =, AND The fields eligible for filtering are: * `companyName` (Required) * `requisitionId` (Optional) Sample Query: * companyName = &quot;projects/api-test-project/companies/123&quot; * companyName = &quot;projects/api-test-project/companies/123&quot; AND requisitionId = &quot;req-1&quot;
+  filter: string, Required. The filter string specifies the jobs to be enumerated. Supported operator: =, AND The fields eligible for filtering are: * `companyName` * `requisitionId` * `status` Available values: OPEN, EXPIRED, ALL. Defaults to OPEN if no value is specified. At least one of `companyName` and `requisitionId` must present or an INVALID_ARGUMENT error is thrown. Sample Query: * companyName = &quot;projects/api-test-project/companies/123&quot; * companyName = &quot;projects/api-test-project/companies/123&quot; AND requisitionId = &quot;req-1&quot; * companyName = &quot;projects/api-test-project/companies/123&quot; AND status = &quot;EXPIRED&quot; * requisitionId = &quot;req-1&quot; * requisitionId = &quot;req-1&quot; AND status = &quot;EXPIRED&quot;
   jobView: string, Optional. The desired job attributes returned for jobs in the search response. Defaults to JobView.JOB_VIEW_FULL if no value is specified.
     Allowed values
       JOB_VIEW_UNSPECIFIED - Default value.
diff --git a/docs/dyn/jobs_v4.projects.tenants.jobs.html b/docs/dyn/jobs_v4.projects.tenants.jobs.html
index e32e5a9..7337c8b 100644
--- a/docs/dyn/jobs_v4.projects.tenants.jobs.html
+++ b/docs/dyn/jobs_v4.projects.tenants.jobs.html
@@ -1028,7 +1028,7 @@
 
 Args:
   parent: string, Required. The resource name of the tenant under which the job is created. The format is &quot;projects/{project_id}/tenants/{tenant_id}&quot;. For example, &quot;projects/foo/tenants/bar&quot;. (required)
-  filter: string, Required. The filter string specifies the jobs to be enumerated. Supported operator: =, AND The fields eligible for filtering are: * `companyName` (Required) * `requisitionId` * `status` Available values: OPEN, EXPIRED, ALL. Defaults to OPEN if no value is specified. Sample Query: * companyName = &quot;projects/foo/tenants/bar/companies/baz&quot; * companyName = &quot;projects/foo/tenants/bar/companies/baz&quot; AND requisitionId = &quot;req-1&quot; * companyName = &quot;projects/foo/tenants/bar/companies/baz&quot; AND status = &quot;EXPIRED&quot;
+  filter: string, Required. The filter string specifies the jobs to be enumerated. Supported operator: =, AND The fields eligible for filtering are: * `companyName` * `requisitionId` * `status` Available values: OPEN, EXPIRED, ALL. Defaults to OPEN if no value is specified. At least one of `companyName` and `requisitionId` must present or an INVALID_ARGUMENT error is thrown. Sample Query: * companyName = &quot;projects/foo/tenants/bar/companies/baz&quot; * companyName = &quot;projects/foo/tenants/bar/companies/baz&quot; AND requisitionId = &quot;req-1&quot; * companyName = &quot;projects/foo/tenants/bar/companies/baz&quot; AND status = &quot;EXPIRED&quot; * requisitionId = &quot;req-1&quot; * requisitionId = &quot;req-1&quot; AND status = &quot;EXPIRED&quot;
   jobView: string, The desired job attributes returned for jobs in the search response. Defaults to JobView.JOB_VIEW_FULL if no value is specified.
     Allowed values
       JOB_VIEW_UNSPECIFIED - Default value.
diff --git a/docs/dyn/metastore_v1alpha.projects.locations.services.backups.html b/docs/dyn/metastore_v1alpha.projects.locations.services.backups.html
index e870ec4..f541042 100644
--- a/docs/dyn/metastore_v1alpha.projects.locations.services.backups.html
+++ b/docs/dyn/metastore_v1alpha.projects.locations.services.backups.html
@@ -121,6 +121,9 @@
   &quot;description&quot;: &quot;A String&quot;, # The description of the backup.
   &quot;endTime&quot;: &quot;A String&quot;, # Output only. The time when the backup finished creating.
   &quot;name&quot;: &quot;A String&quot;, # Immutable. The relative resource name of the backup, in the following form:projects/{project_number}/locations/{location_id}/services/{service_id}/backups/{backup_id}
+  &quot;restoringServices&quot;: [ # Output only. Services that are restoring from the backup.
+    &quot;A String&quot;,
+  ],
   &quot;serviceRevision&quot;: { # A managed metastore service that serves metadata queries. # Output only. The revision of the service at the time of backup.
     &quot;artifactGcsUri&quot;: &quot;A String&quot;, # Output only. A Cloud Storage URI (starting with gs://) that specifies where artifacts related to the metastore service are stored.
     &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time when the metastore service was created.
@@ -273,6 +276,9 @@
   &quot;description&quot;: &quot;A String&quot;, # The description of the backup.
   &quot;endTime&quot;: &quot;A String&quot;, # Output only. The time when the backup finished creating.
   &quot;name&quot;: &quot;A String&quot;, # Immutable. The relative resource name of the backup, in the following form:projects/{project_number}/locations/{location_id}/services/{service_id}/backups/{backup_id}
+  &quot;restoringServices&quot;: [ # Output only. Services that are restoring from the backup.
+    &quot;A String&quot;,
+  ],
   &quot;serviceRevision&quot;: { # A managed metastore service that serves metadata queries. # Output only. The revision of the service at the time of backup.
     &quot;artifactGcsUri&quot;: &quot;A String&quot;, # Output only. A Cloud Storage URI (starting with gs://) that specifies where artifacts related to the metastore service are stored.
     &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time when the metastore service was created.
@@ -413,6 +419,9 @@
       &quot;description&quot;: &quot;A String&quot;, # The description of the backup.
       &quot;endTime&quot;: &quot;A String&quot;, # Output only. The time when the backup finished creating.
       &quot;name&quot;: &quot;A String&quot;, # Immutable. The relative resource name of the backup, in the following form:projects/{project_number}/locations/{location_id}/services/{service_id}/backups/{backup_id}
+      &quot;restoringServices&quot;: [ # Output only. Services that are restoring from the backup.
+        &quot;A String&quot;,
+      ],
       &quot;serviceRevision&quot;: { # A managed metastore service that serves metadata queries. # Output only. The revision of the service at the time of backup.
         &quot;artifactGcsUri&quot;: &quot;A String&quot;, # Output only. A Cloud Storage URI (starting with gs://) that specifies where artifacts related to the metastore service are stored.
         &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time when the metastore service was created.
diff --git a/docs/dyn/metastore_v1beta.projects.locations.services.backups.html b/docs/dyn/metastore_v1beta.projects.locations.services.backups.html
index 6cae1f4..97767ca 100644
--- a/docs/dyn/metastore_v1beta.projects.locations.services.backups.html
+++ b/docs/dyn/metastore_v1beta.projects.locations.services.backups.html
@@ -121,6 +121,9 @@
   &quot;description&quot;: &quot;A String&quot;, # The description of the backup.
   &quot;endTime&quot;: &quot;A String&quot;, # Output only. The time when the backup finished creating.
   &quot;name&quot;: &quot;A String&quot;, # Immutable. The relative resource name of the backup, in the following form:projects/{project_number}/locations/{location_id}/services/{service_id}/backups/{backup_id}
+  &quot;restoringServices&quot;: [ # Output only. Services that are restoring from the backup.
+    &quot;A String&quot;,
+  ],
   &quot;serviceRevision&quot;: { # A managed metastore service that serves metadata queries. # Output only. The revision of the service at the time of backup.
     &quot;artifactGcsUri&quot;: &quot;A String&quot;, # Output only. A Cloud Storage URI (starting with gs://) that specifies where artifacts related to the metastore service are stored.
     &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time when the metastore service was created.
@@ -273,6 +276,9 @@
   &quot;description&quot;: &quot;A String&quot;, # The description of the backup.
   &quot;endTime&quot;: &quot;A String&quot;, # Output only. The time when the backup finished creating.
   &quot;name&quot;: &quot;A String&quot;, # Immutable. The relative resource name of the backup, in the following form:projects/{project_number}/locations/{location_id}/services/{service_id}/backups/{backup_id}
+  &quot;restoringServices&quot;: [ # Output only. Services that are restoring from the backup.
+    &quot;A String&quot;,
+  ],
   &quot;serviceRevision&quot;: { # A managed metastore service that serves metadata queries. # Output only. The revision of the service at the time of backup.
     &quot;artifactGcsUri&quot;: &quot;A String&quot;, # Output only. A Cloud Storage URI (starting with gs://) that specifies where artifacts related to the metastore service are stored.
     &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time when the metastore service was created.
@@ -413,6 +419,9 @@
       &quot;description&quot;: &quot;A String&quot;, # The description of the backup.
       &quot;endTime&quot;: &quot;A String&quot;, # Output only. The time when the backup finished creating.
       &quot;name&quot;: &quot;A String&quot;, # Immutable. The relative resource name of the backup, in the following form:projects/{project_number}/locations/{location_id}/services/{service_id}/backups/{backup_id}
+      &quot;restoringServices&quot;: [ # Output only. Services that are restoring from the backup.
+        &quot;A String&quot;,
+      ],
       &quot;serviceRevision&quot;: { # A managed metastore service that serves metadata queries. # Output only. The revision of the service at the time of backup.
         &quot;artifactGcsUri&quot;: &quot;A String&quot;, # Output only. A Cloud Storage URI (starting with gs://) that specifies where artifacts related to the metastore service are stored.
         &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time when the metastore service was created.
diff --git a/docs/dyn/ml_v1.projects.jobs.html b/docs/dyn/ml_v1.projects.jobs.html
index 243645d..4a1387a 100644
--- a/docs/dyn/ml_v1.projects.jobs.html
+++ b/docs/dyn/ml_v1.projects.jobs.html
@@ -180,7 +180,7 @@
     &quot;args&quot;: [ # Optional. Command-line arguments passed to the training application when it starts. If your job uses a custom container, then the arguments are passed to the container&#x27;s `ENTRYPOINT` command.
       &quot;A String&quot;,
     ],
-    &quot;enableWebAccess&quot;: True or False, # Optional. Whether to enable web access for the training job.
+    &quot;enableWebAccess&quot;: True or False, # Optional. Whether you want AI Platform Training to enable [interactive shell access](https://cloud.google.com/ai-platform/training/docs/monitor-debug-interactive-shell) to training containers. If set to `true`, you can access interactive shells at the URIs given by TrainingOutput.web_access_uris or HyperparameterOutput.web_access_uris (within TrainingOutput.trials).
     &quot;encryptionConfig&quot;: { # Represents a custom encryption key configuration that can be applied to a resource. # Optional. Options for using customer-managed encryption keys (CMEK) to protect resources created by a training job, instead of using Google&#x27;s default encryption. If this is set, then all resources created by the training job will be encrypted with the customer-managed encryption key that you specify. [Learn how and when to use CMEK with AI Platform Training](/ai-platform/training/docs/cmek).
       &quot;kmsKeyName&quot;: &quot;A String&quot;, # The Cloud KMS resource identifier of the customer-managed encryption key used to protect a resource, such as a training job. It has the following format: `projects/{PROJECT_ID}/locations/{REGION}/keyRings/{KEY_RING_NAME}/cryptoKeys/{KEY_NAME}`
     },
@@ -344,12 +344,12 @@
         &quot;startTime&quot;: &quot;A String&quot;, # Output only. Start time for the trial.
         &quot;state&quot;: &quot;A String&quot;, # Output only. The detailed state of the trial.
         &quot;trialId&quot;: &quot;A String&quot;, # The trial id for these results.
-        &quot;webAccessUris&quot;: { # The web URIs for the training job. Currently for debug terminal access to the job. Only set for in-progress hyperparameter tuning trials with web access enabled.
+        &quot;webAccessUris&quot;: { # URIs for accessing [interactive shells](https://cloud.google.com/ai-platform/training/docs/monitor-debug-interactive-shell) (one URI for each training node). Only available if this trial is part of a hyperparameter tuning job and the job&#x27;s training_input.enable_web_access is `true`. The keys are names of each node in the training job; for example, `master-replica-0` for the master node, `worker-replica-0` for the first worker, and `ps-replica-0` for the first parameter server. The values are the URIs for each node&#x27;s interactive shell.
           &quot;a_key&quot;: &quot;A String&quot;,
         },
       },
     ],
-    &quot;webAccessUris&quot;: { # Output only. The web URIs for the training job. Currently for debug terminal access to the job.
+    &quot;webAccessUris&quot;: { # Output only. URIs for accessing [interactive shells](https://cloud.google.com/ai-platform/training/docs/monitor-debug-interactive-shell) (one URI for each training node). Only available if training_input.enable_web_access is `true`. The keys are names of each node in the training job; for example, `master-replica-0` for the master node, `worker-replica-0` for the first worker, and `ps-replica-0` for the first parameter server. The values are the URIs for each node&#x27;s interactive shell.
       &quot;a_key&quot;: &quot;A String&quot;,
     },
   },
@@ -400,7 +400,7 @@
     &quot;args&quot;: [ # Optional. Command-line arguments passed to the training application when it starts. If your job uses a custom container, then the arguments are passed to the container&#x27;s `ENTRYPOINT` command.
       &quot;A String&quot;,
     ],
-    &quot;enableWebAccess&quot;: True or False, # Optional. Whether to enable web access for the training job.
+    &quot;enableWebAccess&quot;: True or False, # Optional. Whether you want AI Platform Training to enable [interactive shell access](https://cloud.google.com/ai-platform/training/docs/monitor-debug-interactive-shell) to training containers. If set to `true`, you can access interactive shells at the URIs given by TrainingOutput.web_access_uris or HyperparameterOutput.web_access_uris (within TrainingOutput.trials).
     &quot;encryptionConfig&quot;: { # Represents a custom encryption key configuration that can be applied to a resource. # Optional. Options for using customer-managed encryption keys (CMEK) to protect resources created by a training job, instead of using Google&#x27;s default encryption. If this is set, then all resources created by the training job will be encrypted with the customer-managed encryption key that you specify. [Learn how and when to use CMEK with AI Platform Training](/ai-platform/training/docs/cmek).
       &quot;kmsKeyName&quot;: &quot;A String&quot;, # The Cloud KMS resource identifier of the customer-managed encryption key used to protect a resource, such as a training job. It has the following format: `projects/{PROJECT_ID}/locations/{REGION}/keyRings/{KEY_RING_NAME}/cryptoKeys/{KEY_NAME}`
     },
@@ -564,12 +564,12 @@
         &quot;startTime&quot;: &quot;A String&quot;, # Output only. Start time for the trial.
         &quot;state&quot;: &quot;A String&quot;, # Output only. The detailed state of the trial.
         &quot;trialId&quot;: &quot;A String&quot;, # The trial id for these results.
-        &quot;webAccessUris&quot;: { # The web URIs for the training job. Currently for debug terminal access to the job. Only set for in-progress hyperparameter tuning trials with web access enabled.
+        &quot;webAccessUris&quot;: { # URIs for accessing [interactive shells](https://cloud.google.com/ai-platform/training/docs/monitor-debug-interactive-shell) (one URI for each training node). Only available if this trial is part of a hyperparameter tuning job and the job&#x27;s training_input.enable_web_access is `true`. The keys are names of each node in the training job; for example, `master-replica-0` for the master node, `worker-replica-0` for the first worker, and `ps-replica-0` for the first parameter server. The values are the URIs for each node&#x27;s interactive shell.
           &quot;a_key&quot;: &quot;A String&quot;,
         },
       },
     ],
-    &quot;webAccessUris&quot;: { # Output only. The web URIs for the training job. Currently for debug terminal access to the job.
+    &quot;webAccessUris&quot;: { # Output only. URIs for accessing [interactive shells](https://cloud.google.com/ai-platform/training/docs/monitor-debug-interactive-shell) (one URI for each training node). Only available if training_input.enable_web_access is `true`. The keys are names of each node in the training job; for example, `master-replica-0` for the master node, `worker-replica-0` for the first worker, and `ps-replica-0` for the first parameter server. The values are the URIs for each node&#x27;s interactive shell.
       &quot;a_key&quot;: &quot;A String&quot;,
     },
   },
@@ -627,7 +627,7 @@
     &quot;args&quot;: [ # Optional. Command-line arguments passed to the training application when it starts. If your job uses a custom container, then the arguments are passed to the container&#x27;s `ENTRYPOINT` command.
       &quot;A String&quot;,
     ],
-    &quot;enableWebAccess&quot;: True or False, # Optional. Whether to enable web access for the training job.
+    &quot;enableWebAccess&quot;: True or False, # Optional. Whether you want AI Platform Training to enable [interactive shell access](https://cloud.google.com/ai-platform/training/docs/monitor-debug-interactive-shell) to training containers. If set to `true`, you can access interactive shells at the URIs given by TrainingOutput.web_access_uris or HyperparameterOutput.web_access_uris (within TrainingOutput.trials).
     &quot;encryptionConfig&quot;: { # Represents a custom encryption key configuration that can be applied to a resource. # Optional. Options for using customer-managed encryption keys (CMEK) to protect resources created by a training job, instead of using Google&#x27;s default encryption. If this is set, then all resources created by the training job will be encrypted with the customer-managed encryption key that you specify. [Learn how and when to use CMEK with AI Platform Training](/ai-platform/training/docs/cmek).
       &quot;kmsKeyName&quot;: &quot;A String&quot;, # The Cloud KMS resource identifier of the customer-managed encryption key used to protect a resource, such as a training job. It has the following format: `projects/{PROJECT_ID}/locations/{REGION}/keyRings/{KEY_RING_NAME}/cryptoKeys/{KEY_NAME}`
     },
@@ -791,12 +791,12 @@
         &quot;startTime&quot;: &quot;A String&quot;, # Output only. Start time for the trial.
         &quot;state&quot;: &quot;A String&quot;, # Output only. The detailed state of the trial.
         &quot;trialId&quot;: &quot;A String&quot;, # The trial id for these results.
-        &quot;webAccessUris&quot;: { # The web URIs for the training job. Currently for debug terminal access to the job. Only set for in-progress hyperparameter tuning trials with web access enabled.
+        &quot;webAccessUris&quot;: { # URIs for accessing [interactive shells](https://cloud.google.com/ai-platform/training/docs/monitor-debug-interactive-shell) (one URI for each training node). Only available if this trial is part of a hyperparameter tuning job and the job&#x27;s training_input.enable_web_access is `true`. The keys are names of each node in the training job; for example, `master-replica-0` for the master node, `worker-replica-0` for the first worker, and `ps-replica-0` for the first parameter server. The values are the URIs for each node&#x27;s interactive shell.
           &quot;a_key&quot;: &quot;A String&quot;,
         },
       },
     ],
-    &quot;webAccessUris&quot;: { # Output only. The web URIs for the training job. Currently for debug terminal access to the job.
+    &quot;webAccessUris&quot;: { # Output only. URIs for accessing [interactive shells](https://cloud.google.com/ai-platform/training/docs/monitor-debug-interactive-shell) (one URI for each training node). Only available if training_input.enable_web_access is `true`. The keys are names of each node in the training job; for example, `master-replica-0` for the master node, `worker-replica-0` for the first worker, and `ps-replica-0` for the first parameter server. The values are the URIs for each node&#x27;s interactive shell.
       &quot;a_key&quot;: &quot;A String&quot;,
     },
   },
@@ -907,7 +907,7 @@
         &quot;args&quot;: [ # Optional. Command-line arguments passed to the training application when it starts. If your job uses a custom container, then the arguments are passed to the container&#x27;s `ENTRYPOINT` command.
           &quot;A String&quot;,
         ],
-        &quot;enableWebAccess&quot;: True or False, # Optional. Whether to enable web access for the training job.
+        &quot;enableWebAccess&quot;: True or False, # Optional. Whether you want AI Platform Training to enable [interactive shell access](https://cloud.google.com/ai-platform/training/docs/monitor-debug-interactive-shell) to training containers. If set to `true`, you can access interactive shells at the URIs given by TrainingOutput.web_access_uris or HyperparameterOutput.web_access_uris (within TrainingOutput.trials).
         &quot;encryptionConfig&quot;: { # Represents a custom encryption key configuration that can be applied to a resource. # Optional. Options for using customer-managed encryption keys (CMEK) to protect resources created by a training job, instead of using Google&#x27;s default encryption. If this is set, then all resources created by the training job will be encrypted with the customer-managed encryption key that you specify. [Learn how and when to use CMEK with AI Platform Training](/ai-platform/training/docs/cmek).
           &quot;kmsKeyName&quot;: &quot;A String&quot;, # The Cloud KMS resource identifier of the customer-managed encryption key used to protect a resource, such as a training job. It has the following format: `projects/{PROJECT_ID}/locations/{REGION}/keyRings/{KEY_RING_NAME}/cryptoKeys/{KEY_NAME}`
         },
@@ -1071,12 +1071,12 @@
             &quot;startTime&quot;: &quot;A String&quot;, # Output only. Start time for the trial.
             &quot;state&quot;: &quot;A String&quot;, # Output only. The detailed state of the trial.
             &quot;trialId&quot;: &quot;A String&quot;, # The trial id for these results.
-            &quot;webAccessUris&quot;: { # The web URIs for the training job. Currently for debug terminal access to the job. Only set for in-progress hyperparameter tuning trials with web access enabled.
+            &quot;webAccessUris&quot;: { # URIs for accessing [interactive shells](https://cloud.google.com/ai-platform/training/docs/monitor-debug-interactive-shell) (one URI for each training node). Only available if this trial is part of a hyperparameter tuning job and the job&#x27;s training_input.enable_web_access is `true`. The keys are names of each node in the training job; for example, `master-replica-0` for the master node, `worker-replica-0` for the first worker, and `ps-replica-0` for the first parameter server. The values are the URIs for each node&#x27;s interactive shell.
               &quot;a_key&quot;: &quot;A String&quot;,
             },
           },
         ],
-        &quot;webAccessUris&quot;: { # Output only. The web URIs for the training job. Currently for debug terminal access to the job.
+        &quot;webAccessUris&quot;: { # Output only. URIs for accessing [interactive shells](https://cloud.google.com/ai-platform/training/docs/monitor-debug-interactive-shell) (one URI for each training node). Only available if training_input.enable_web_access is `true`. The keys are names of each node in the training job; for example, `master-replica-0` for the master node, `worker-replica-0` for the first worker, and `ps-replica-0` for the first parameter server. The values are the URIs for each node&#x27;s interactive shell.
           &quot;a_key&quot;: &quot;A String&quot;,
         },
       },
@@ -1146,7 +1146,7 @@
     &quot;args&quot;: [ # Optional. Command-line arguments passed to the training application when it starts. If your job uses a custom container, then the arguments are passed to the container&#x27;s `ENTRYPOINT` command.
       &quot;A String&quot;,
     ],
-    &quot;enableWebAccess&quot;: True or False, # Optional. Whether to enable web access for the training job.
+    &quot;enableWebAccess&quot;: True or False, # Optional. Whether you want AI Platform Training to enable [interactive shell access](https://cloud.google.com/ai-platform/training/docs/monitor-debug-interactive-shell) to training containers. If set to `true`, you can access interactive shells at the URIs given by TrainingOutput.web_access_uris or HyperparameterOutput.web_access_uris (within TrainingOutput.trials).
     &quot;encryptionConfig&quot;: { # Represents a custom encryption key configuration that can be applied to a resource. # Optional. Options for using customer-managed encryption keys (CMEK) to protect resources created by a training job, instead of using Google&#x27;s default encryption. If this is set, then all resources created by the training job will be encrypted with the customer-managed encryption key that you specify. [Learn how and when to use CMEK with AI Platform Training](/ai-platform/training/docs/cmek).
       &quot;kmsKeyName&quot;: &quot;A String&quot;, # The Cloud KMS resource identifier of the customer-managed encryption key used to protect a resource, such as a training job. It has the following format: `projects/{PROJECT_ID}/locations/{REGION}/keyRings/{KEY_RING_NAME}/cryptoKeys/{KEY_NAME}`
     },
@@ -1310,12 +1310,12 @@
         &quot;startTime&quot;: &quot;A String&quot;, # Output only. Start time for the trial.
         &quot;state&quot;: &quot;A String&quot;, # Output only. The detailed state of the trial.
         &quot;trialId&quot;: &quot;A String&quot;, # The trial id for these results.
-        &quot;webAccessUris&quot;: { # The web URIs for the training job. Currently for debug terminal access to the job. Only set for in-progress hyperparameter tuning trials with web access enabled.
+        &quot;webAccessUris&quot;: { # URIs for accessing [interactive shells](https://cloud.google.com/ai-platform/training/docs/monitor-debug-interactive-shell) (one URI for each training node). Only available if this trial is part of a hyperparameter tuning job and the job&#x27;s training_input.enable_web_access is `true`. The keys are names of each node in the training job; for example, `master-replica-0` for the master node, `worker-replica-0` for the first worker, and `ps-replica-0` for the first parameter server. The values are the URIs for each node&#x27;s interactive shell.
           &quot;a_key&quot;: &quot;A String&quot;,
         },
       },
     ],
-    &quot;webAccessUris&quot;: { # Output only. The web URIs for the training job. Currently for debug terminal access to the job.
+    &quot;webAccessUris&quot;: { # Output only. URIs for accessing [interactive shells](https://cloud.google.com/ai-platform/training/docs/monitor-debug-interactive-shell) (one URI for each training node). Only available if training_input.enable_web_access is `true`. The keys are names of each node in the training job; for example, `master-replica-0` for the master node, `worker-replica-0` for the first worker, and `ps-replica-0` for the first parameter server. The values are the URIs for each node&#x27;s interactive shell.
       &quot;a_key&quot;: &quot;A String&quot;,
     },
   },
@@ -1367,7 +1367,7 @@
     &quot;args&quot;: [ # Optional. Command-line arguments passed to the training application when it starts. If your job uses a custom container, then the arguments are passed to the container&#x27;s `ENTRYPOINT` command.
       &quot;A String&quot;,
     ],
-    &quot;enableWebAccess&quot;: True or False, # Optional. Whether to enable web access for the training job.
+    &quot;enableWebAccess&quot;: True or False, # Optional. Whether you want AI Platform Training to enable [interactive shell access](https://cloud.google.com/ai-platform/training/docs/monitor-debug-interactive-shell) to training containers. If set to `true`, you can access interactive shells at the URIs given by TrainingOutput.web_access_uris or HyperparameterOutput.web_access_uris (within TrainingOutput.trials).
     &quot;encryptionConfig&quot;: { # Represents a custom encryption key configuration that can be applied to a resource. # Optional. Options for using customer-managed encryption keys (CMEK) to protect resources created by a training job, instead of using Google&#x27;s default encryption. If this is set, then all resources created by the training job will be encrypted with the customer-managed encryption key that you specify. [Learn how and when to use CMEK with AI Platform Training](/ai-platform/training/docs/cmek).
       &quot;kmsKeyName&quot;: &quot;A String&quot;, # The Cloud KMS resource identifier of the customer-managed encryption key used to protect a resource, such as a training job. It has the following format: `projects/{PROJECT_ID}/locations/{REGION}/keyRings/{KEY_RING_NAME}/cryptoKeys/{KEY_NAME}`
     },
@@ -1531,12 +1531,12 @@
         &quot;startTime&quot;: &quot;A String&quot;, # Output only. Start time for the trial.
         &quot;state&quot;: &quot;A String&quot;, # Output only. The detailed state of the trial.
         &quot;trialId&quot;: &quot;A String&quot;, # The trial id for these results.
-        &quot;webAccessUris&quot;: { # The web URIs for the training job. Currently for debug terminal access to the job. Only set for in-progress hyperparameter tuning trials with web access enabled.
+        &quot;webAccessUris&quot;: { # URIs for accessing [interactive shells](https://cloud.google.com/ai-platform/training/docs/monitor-debug-interactive-shell) (one URI for each training node). Only available if this trial is part of a hyperparameter tuning job and the job&#x27;s training_input.enable_web_access is `true`. The keys are names of each node in the training job; for example, `master-replica-0` for the master node, `worker-replica-0` for the first worker, and `ps-replica-0` for the first parameter server. The values are the URIs for each node&#x27;s interactive shell.
           &quot;a_key&quot;: &quot;A String&quot;,
         },
       },
     ],
-    &quot;webAccessUris&quot;: { # Output only. The web URIs for the training job. Currently for debug terminal access to the job.
+    &quot;webAccessUris&quot;: { # Output only. URIs for accessing [interactive shells](https://cloud.google.com/ai-platform/training/docs/monitor-debug-interactive-shell) (one URI for each training node). Only available if training_input.enable_web_access is `true`. The keys are names of each node in the training job; for example, `master-replica-0` for the master node, `worker-replica-0` for the first worker, and `ps-replica-0` for the first parameter server. The values are the URIs for each node&#x27;s interactive shell.
       &quot;a_key&quot;: &quot;A String&quot;,
     },
   },
diff --git a/docs/dyn/monitoring_v1.locations.global_.metricsScopes.html b/docs/dyn/monitoring_v1.locations.global_.metricsScopes.html
index 8c35e5c..cb835b4 100644
--- a/docs/dyn/monitoring_v1.locations.global_.metricsScopes.html
+++ b/docs/dyn/monitoring_v1.locations.global_.metricsScopes.html
@@ -86,7 +86,7 @@
   <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
 <p class="firstline">Returns a specific Metrics Scope.</p>
 <p class="toc_element">
-  <code><a href="#listMetricScopesByMonitoredProject">listMetricScopesByMonitoredProject(monitoredResourceContainer=None, x__xgafv=None)</a></code></p>
+  <code><a href="#listMetricsScopesByMonitoredProject">listMetricsScopesByMonitoredProject(monitoredResourceContainer=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Returns a list of every Metrics Scope that a specific MonitoredProject has been added to. The metrics scope representing the specified monitored project will always be the first entry in the response.</p>
 <h3>Method Details</h3>
 <div class="method">
@@ -122,7 +122,7 @@
 </div>
 
 <div class="method">
-    <code class="details" id="listMetricScopesByMonitoredProject">listMetricScopesByMonitoredProject(monitoredResourceContainer=None, x__xgafv=None)</code>
+    <code class="details" id="listMetricsScopesByMonitoredProject">listMetricsScopesByMonitoredProject(monitoredResourceContainer=None, x__xgafv=None)</code>
   <pre>Returns a list of every Metrics Scope that a specific MonitoredProject has been added to. The metrics scope representing the specified monitored project will always be the first entry in the response.
 
 Args:
diff --git a/docs/dyn/networkservices_v1.html b/docs/dyn/networkservices_v1.html
new file mode 100644
index 0000000..7f0d132
--- /dev/null
+++ b/docs/dyn/networkservices_v1.html
@@ -0,0 +1,111 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="networkservices_v1.html">Network Services API</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="networkservices_v1.projects.html">projects()</a></code>
+</p>
+<p class="firstline">Returns the projects Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#new_batch_http_request">new_batch_http_request()</a></code></p>
+<p class="firstline">Create a BatchHttpRequest object based on the discovery document.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="new_batch_http_request">new_batch_http_request()</code>
+  <pre>Create a BatchHttpRequest object based on the discovery document.
+
+        Args:
+          callback: callable, A callback to be called for each response, of the
+            form callback(id, response, exception). The first parameter is the
+            request id, and the second is the deserialized response object. The
+            third is an apiclient.errors.HttpError exception object if an HTTP
+            error occurred while processing the request, or None if no error
+            occurred.
+
+        Returns:
+          A BatchHttpRequest object based on the discovery document.
+        </pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/networkservices_v1.projects.html b/docs/dyn/networkservices_v1.projects.html
new file mode 100644
index 0000000..dea4eed
--- /dev/null
+++ b/docs/dyn/networkservices_v1.projects.html
@@ -0,0 +1,91 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="networkservices_v1.html">Network Services API</a> . <a href="networkservices_v1.projects.html">projects</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="networkservices_v1.projects.locations.html">locations()</a></code>
+</p>
+<p class="firstline">Returns the locations Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/networkservices_v1.projects.locations.edgeCacheKeysets.html b/docs/dyn/networkservices_v1.projects.locations.edgeCacheKeysets.html
new file mode 100644
index 0000000..c09e59f
--- /dev/null
+++ b/docs/dyn/networkservices_v1.projects.locations.edgeCacheKeysets.html
@@ -0,0 +1,258 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="networkservices_v1.html">Network Services API</a> . <a href="networkservices_v1.projects.html">projects</a> . <a href="networkservices_v1.projects.locations.html">locations</a> . <a href="networkservices_v1.projects.locations.edgeCacheKeysets.html">edgeCacheKeysets</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.</p>
+<p class="toc_element">
+  <code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.</p>
+<p class="toc_element">
+  <code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may "fail open" without warning.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</code>
+  <pre>Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy is being requested. See the operation documentation for the appropriate value for this field. (required)
+  options_requestedPolicyVersion: integer, Optional. The policy format version to be returned. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Requests for policies with any conditional bindings must specify version 3. Policies without any conditional bindings may specify any valid value or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+  &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+    { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+      &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+        { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+          &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+            &quot;A String&quot;,
+          ],
+          &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+        },
+      ],
+      &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+    },
+  ],
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+    { # Associates `members` with a `role`.
+      &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+        &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+        &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+        &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+        &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+      },
+      &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+        &quot;A String&quot;,
+      ],
+      &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+    },
+  ],
+  &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+  &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>
+  <pre>Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy is being specified. See the operation documentation for the appropriate value for this field. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request message for `SetIamPolicy` method.
+  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+    &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+      { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+        &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+          { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+            &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+              &quot;A String&quot;,
+            ],
+            &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+          },
+        ],
+        &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+      },
+    ],
+    &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+      { # Associates `members` with a `role`.
+        &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+          &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+          &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+          &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+          &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+        },
+        &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+          &quot;A String&quot;,
+        ],
+        &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+      },
+    ],
+    &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+    &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+  },
+  &quot;updateMask&quot;: &quot;A String&quot;, # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only the fields in the mask will be modified. If no mask is provided, the following default mask is used: `paths: &quot;bindings, etag&quot;`
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+  &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+    { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+      &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+        { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+          &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+            &quot;A String&quot;,
+          ],
+          &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+        },
+      ],
+      &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+    },
+  ],
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+    { # Associates `members` with a `role`.
+      &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+        &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+        &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+        &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+        &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+      },
+      &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+        &quot;A String&quot;,
+      ],
+      &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+    },
+  ],
+  &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+  &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>
+  <pre>Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may &quot;fail open&quot; without warning.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy detail is being requested. See the operation documentation for the appropriate value for this field. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request message for `TestIamPermissions` method.
+  &quot;permissions&quot;: [ # The set of permissions to check for the `resource`. Permissions with wildcards (such as &#x27;*&#x27; or &#x27;storage.*&#x27;) are not allowed. For more information see [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
+    &quot;A String&quot;,
+  ],
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response message for `TestIamPermissions` method.
+  &quot;permissions&quot;: [ # A subset of `TestPermissionsRequest.permissions` that the caller is allowed.
+    &quot;A String&quot;,
+  ],
+}</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/networkservices_v1.projects.locations.edgeCacheOrigins.html b/docs/dyn/networkservices_v1.projects.locations.edgeCacheOrigins.html
new file mode 100644
index 0000000..27c9c57
--- /dev/null
+++ b/docs/dyn/networkservices_v1.projects.locations.edgeCacheOrigins.html
@@ -0,0 +1,258 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="networkservices_v1.html">Network Services API</a> . <a href="networkservices_v1.projects.html">projects</a> . <a href="networkservices_v1.projects.locations.html">locations</a> . <a href="networkservices_v1.projects.locations.edgeCacheOrigins.html">edgeCacheOrigins</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.</p>
+<p class="toc_element">
+  <code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.</p>
+<p class="toc_element">
+  <code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may "fail open" without warning.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</code>
+  <pre>Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy is being requested. See the operation documentation for the appropriate value for this field. (required)
+  options_requestedPolicyVersion: integer, Optional. The policy format version to be returned. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Requests for policies with any conditional bindings must specify version 3. Policies without any conditional bindings may specify any valid value or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+  &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+    { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+      &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+        { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+          &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+            &quot;A String&quot;,
+          ],
+          &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+        },
+      ],
+      &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+    },
+  ],
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+    { # Associates `members` with a `role`.
+      &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+        &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+        &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+        &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+        &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+      },
+      &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+        &quot;A String&quot;,
+      ],
+      &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+    },
+  ],
+  &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+  &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>
+  <pre>Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy is being specified. See the operation documentation for the appropriate value for this field. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request message for `SetIamPolicy` method.
+  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+    &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+      { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+        &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+          { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+            &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+              &quot;A String&quot;,
+            ],
+            &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+          },
+        ],
+        &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+      },
+    ],
+    &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+      { # Associates `members` with a `role`.
+        &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+          &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+          &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+          &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+          &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+        },
+        &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+          &quot;A String&quot;,
+        ],
+        &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+      },
+    ],
+    &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+    &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+  },
+  &quot;updateMask&quot;: &quot;A String&quot;, # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only the fields in the mask will be modified. If no mask is provided, the following default mask is used: `paths: &quot;bindings, etag&quot;`
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+  &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+    { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+      &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+        { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+          &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+            &quot;A String&quot;,
+          ],
+          &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+        },
+      ],
+      &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+    },
+  ],
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+    { # Associates `members` with a `role`.
+      &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+        &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+        &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+        &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+        &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+      },
+      &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+        &quot;A String&quot;,
+      ],
+      &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+    },
+  ],
+  &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+  &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>
+  <pre>Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may &quot;fail open&quot; without warning.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy detail is being requested. See the operation documentation for the appropriate value for this field. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request message for `TestIamPermissions` method.
+  &quot;permissions&quot;: [ # The set of permissions to check for the `resource`. Permissions with wildcards (such as &#x27;*&#x27; or &#x27;storage.*&#x27;) are not allowed. For more information see [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
+    &quot;A String&quot;,
+  ],
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response message for `TestIamPermissions` method.
+  &quot;permissions&quot;: [ # A subset of `TestPermissionsRequest.permissions` that the caller is allowed.
+    &quot;A String&quot;,
+  ],
+}</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/networkservices_v1.projects.locations.edgeCacheServices.html b/docs/dyn/networkservices_v1.projects.locations.edgeCacheServices.html
new file mode 100644
index 0000000..b6d86f1
--- /dev/null
+++ b/docs/dyn/networkservices_v1.projects.locations.edgeCacheServices.html
@@ -0,0 +1,258 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="networkservices_v1.html">Network Services API</a> . <a href="networkservices_v1.projects.html">projects</a> . <a href="networkservices_v1.projects.locations.html">locations</a> . <a href="networkservices_v1.projects.locations.edgeCacheServices.html">edgeCacheServices</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.</p>
+<p class="toc_element">
+  <code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.</p>
+<p class="toc_element">
+  <code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may "fail open" without warning.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</code>
+  <pre>Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy is being requested. See the operation documentation for the appropriate value for this field. (required)
+  options_requestedPolicyVersion: integer, Optional. The policy format version to be returned. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Requests for policies with any conditional bindings must specify version 3. Policies without any conditional bindings may specify any valid value or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+  &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+    { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+      &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+        { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+          &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+            &quot;A String&quot;,
+          ],
+          &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+        },
+      ],
+      &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+    },
+  ],
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+    { # Associates `members` with a `role`.
+      &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+        &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+        &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+        &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+        &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+      },
+      &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+        &quot;A String&quot;,
+      ],
+      &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+    },
+  ],
+  &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+  &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>
+  <pre>Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy is being specified. See the operation documentation for the appropriate value for this field. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request message for `SetIamPolicy` method.
+  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+    &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+      { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+        &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+          { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+            &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+              &quot;A String&quot;,
+            ],
+            &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+          },
+        ],
+        &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+      },
+    ],
+    &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+      { # Associates `members` with a `role`.
+        &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+          &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+          &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+          &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+          &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+        },
+        &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+          &quot;A String&quot;,
+        ],
+        &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+      },
+    ],
+    &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+    &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+  },
+  &quot;updateMask&quot;: &quot;A String&quot;, # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only the fields in the mask will be modified. If no mask is provided, the following default mask is used: `paths: &quot;bindings, etag&quot;`
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+  &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+    { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+      &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+        { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+          &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+            &quot;A String&quot;,
+          ],
+          &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+        },
+      ],
+      &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+    },
+  ],
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+    { # Associates `members` with a `role`.
+      &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+        &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+        &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+        &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+        &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+      },
+      &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+        &quot;A String&quot;,
+      ],
+      &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+    },
+  ],
+  &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+  &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>
+  <pre>Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may &quot;fail open&quot; without warning.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy detail is being requested. See the operation documentation for the appropriate value for this field. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request message for `TestIamPermissions` method.
+  &quot;permissions&quot;: [ # The set of permissions to check for the `resource`. Permissions with wildcards (such as &#x27;*&#x27; or &#x27;storage.*&#x27;) are not allowed. For more information see [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
+    &quot;A String&quot;,
+  ],
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response message for `TestIamPermissions` method.
+  &quot;permissions&quot;: [ # A subset of `TestPermissionsRequest.permissions` that the caller is allowed.
+    &quot;A String&quot;,
+  ],
+}</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/networkservices_v1.projects.locations.html b/docs/dyn/networkservices_v1.projects.locations.html
new file mode 100644
index 0000000..669495e
--- /dev/null
+++ b/docs/dyn/networkservices_v1.projects.locations.html
@@ -0,0 +1,191 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="networkservices_v1.html">Network Services API</a> . <a href="networkservices_v1.projects.html">projects</a> . <a href="networkservices_v1.projects.locations.html">locations</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="networkservices_v1.projects.locations.edgeCacheKeysets.html">edgeCacheKeysets()</a></code>
+</p>
+<p class="firstline">Returns the edgeCacheKeysets Resource.</p>
+
+<p class="toc_element">
+  <code><a href="networkservices_v1.projects.locations.edgeCacheOrigins.html">edgeCacheOrigins()</a></code>
+</p>
+<p class="firstline">Returns the edgeCacheOrigins Resource.</p>
+
+<p class="toc_element">
+  <code><a href="networkservices_v1.projects.locations.edgeCacheServices.html">edgeCacheServices()</a></code>
+</p>
+<p class="firstline">Returns the edgeCacheServices Resource.</p>
+
+<p class="toc_element">
+  <code><a href="networkservices_v1.projects.locations.operations.html">operations()</a></code>
+</p>
+<p class="firstline">Returns the operations Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets information about a location.</p>
+<p class="toc_element">
+  <code><a href="#list">list(name, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Lists information about the supported locations for this service.</p>
+<p class="toc_element">
+  <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
+<p class="firstline">Retrieves the next page of results.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="get">get(name, x__xgafv=None)</code>
+  <pre>Gets information about a location.
+
+Args:
+  name: string, Resource name for the location. (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # A resource that represents Google Cloud Platform location.
+  &quot;displayName&quot;: &quot;A String&quot;, # The friendly name for this location, typically a nearby city name. For example, &quot;Tokyo&quot;.
+  &quot;labels&quot;: { # Cross-service attributes for the location. For example {&quot;cloud.googleapis.com/region&quot;: &quot;us-east1&quot;}
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;locationId&quot;: &quot;A String&quot;, # The canonical id for this location. For example: `&quot;us-east1&quot;`.
+  &quot;metadata&quot;: { # Service-specific metadata. For example the available capacity at the given location.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # Resource name for the location, which may vary between implementations. For example: `&quot;projects/example-project/locations/us-east1&quot;`
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list">list(name, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</code>
+  <pre>Lists information about the supported locations for this service.
+
+Args:
+  name: string, The resource that owns the locations collection, if applicable. (required)
+  filter: string, A filter to narrow down results to a preferred subset. The filtering language accepts strings like &quot;displayName=tokyo&quot;, and is documented in more detail in [AIP-160](https://google.aip.dev/160).
+  pageSize: integer, The maximum number of results to return. If not set, the service selects a default.
+  pageToken: string, A page token received from the `next_page_token` field in the response. Send that page token to receive the subsequent page.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # The response message for Locations.ListLocations.
+  &quot;locations&quot;: [ # A list of locations that matches the specified filter in the request.
+    { # A resource that represents Google Cloud Platform location.
+      &quot;displayName&quot;: &quot;A String&quot;, # The friendly name for this location, typically a nearby city name. For example, &quot;Tokyo&quot;.
+      &quot;labels&quot;: { # Cross-service attributes for the location. For example {&quot;cloud.googleapis.com/region&quot;: &quot;us-east1&quot;}
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+      &quot;locationId&quot;: &quot;A String&quot;, # The canonical id for this location. For example: `&quot;us-east1&quot;`.
+      &quot;metadata&quot;: { # Service-specific metadata. For example the available capacity at the given location.
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+      &quot;name&quot;: &quot;A String&quot;, # Resource name for the location, which may vary between implementations. For example: `&quot;projects/example-project/locations/us-east1&quot;`
+    },
+  ],
+  &quot;nextPageToken&quot;: &quot;A String&quot;, # The standard List next-page token.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
+  <pre>Retrieves the next page of results.
+
+Args:
+  previous_request: The request for the previous page. (required)
+  previous_response: The response from the request for the previous page. (required)
+
+Returns:
+  A request object that you can call &#x27;execute()&#x27; on to request the next
+  page. Returns None if there are no more items in the collection.
+    </pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/networkservices_v1.projects.locations.operations.html b/docs/dyn/networkservices_v1.projects.locations.operations.html
new file mode 100644
index 0000000..800bf6a
--- /dev/null
+++ b/docs/dyn/networkservices_v1.projects.locations.operations.html
@@ -0,0 +1,235 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="networkservices_v1.html">Network Services API</a> . <a href="networkservices_v1.projects.html">projects</a> . <a href="networkservices_v1.projects.locations.html">locations</a> . <a href="networkservices_v1.projects.locations.operations.html">operations</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#cancel">cancel(name, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Starts asynchronous cancellation on a long-running operation. The server makes a best effort to cancel the operation, but success is not guaranteed. If the server doesn't support this method, it returns `google.rpc.Code.UNIMPLEMENTED`. Clients can use Operations.GetOperation or other methods to check whether the cancellation succeeded or whether the operation completed despite cancellation. On successful cancellation, the operation is not deleted; instead, it becomes an operation with an Operation.error value with a google.rpc.Status.code of 1, corresponding to `Code.CANCELLED`.</p>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Deletes a long-running operation. This method indicates that the client is no longer interested in the operation result. It does not cancel the operation. If the server doesn't support this method, it returns `google.rpc.Code.UNIMPLEMENTED`.</p>
+<p class="toc_element">
+  <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets the latest state of a long-running operation. Clients can use this method to poll the operation result at intervals as recommended by the API service.</p>
+<p class="toc_element">
+  <code><a href="#list">list(name, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Lists operations that match the specified filter in the request. If the server doesn't support this method, it returns `UNIMPLEMENTED`. NOTE: the `name` binding allows API services to override the binding to use different resource name schemes, such as `users/*/operations`. To override the binding, API services can add a binding such as `"/v1/{name=users/*}/operations"` to their service configuration. For backwards compatibility, the default name includes the operations collection id, however overriding users must ensure the name binding is the parent resource, without the operations collection id.</p>
+<p class="toc_element">
+  <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
+<p class="firstline">Retrieves the next page of results.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="cancel">cancel(name, body=None, x__xgafv=None)</code>
+  <pre>Starts asynchronous cancellation on a long-running operation. The server makes a best effort to cancel the operation, but success is not guaranteed. If the server doesn&#x27;t support this method, it returns `google.rpc.Code.UNIMPLEMENTED`. Clients can use Operations.GetOperation or other methods to check whether the cancellation succeeded or whether the operation completed despite cancellation. On successful cancellation, the operation is not deleted; instead, it becomes an operation with an Operation.error value with a google.rpc.Status.code of 1, corresponding to `Code.CANCELLED`.
+
+Args:
+  name: string, The name of the operation resource to be cancelled. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # The request message for Operations.CancelOperation.
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); } The JSON representation for `Empty` is empty JSON object `{}`.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="delete">delete(name, x__xgafv=None)</code>
+  <pre>Deletes a long-running operation. This method indicates that the client is no longer interested in the operation result. It does not cancel the operation. If the server doesn&#x27;t support this method, it returns `google.rpc.Code.UNIMPLEMENTED`.
+
+Args:
+  name: string, The name of the operation resource to be deleted. (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); } The JSON representation for `Empty` is empty JSON object `{}`.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="get">get(name, x__xgafv=None)</code>
+  <pre>Gets the latest state of a long-running operation. Clients can use this method to poll the operation result at intervals as recommended by the API service.
+
+Args:
+  name: string, The name of the operation resource. (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list">list(name, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</code>
+  <pre>Lists operations that match the specified filter in the request. If the server doesn&#x27;t support this method, it returns `UNIMPLEMENTED`. NOTE: the `name` binding allows API services to override the binding to use different resource name schemes, such as `users/*/operations`. To override the binding, API services can add a binding such as `&quot;/v1/{name=users/*}/operations&quot;` to their service configuration. For backwards compatibility, the default name includes the operations collection id, however overriding users must ensure the name binding is the parent resource, without the operations collection id.
+
+Args:
+  name: string, The name of the operation&#x27;s parent resource. (required)
+  filter: string, The standard list filter.
+  pageSize: integer, The standard list page size.
+  pageToken: string, The standard list page token.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # The response message for Operations.ListOperations.
+  &quot;nextPageToken&quot;: &quot;A String&quot;, # The standard List next-page token.
+  &quot;operations&quot;: [ # A list of operations that matches the specified filter in the request.
+    { # This resource represents a long-running operation that is the result of a network API call.
+      &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+      &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+        &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+        &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+          {
+            &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+          },
+        ],
+        &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+      },
+      &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+      &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+      &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    },
+  ],
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
+  <pre>Retrieves the next page of results.
+
+Args:
+  previous_request: The request for the previous page. (required)
+  previous_response: The response from the request for the previous page. (required)
+
+Returns:
+  A request object that you can call &#x27;execute()&#x27; on to request the next
+  page. Returns None if there are no more items in the collection.
+    </pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/networkservices_v1beta1.html b/docs/dyn/networkservices_v1beta1.html
new file mode 100644
index 0000000..8aab358
--- /dev/null
+++ b/docs/dyn/networkservices_v1beta1.html
@@ -0,0 +1,111 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="networkservices_v1beta1.html">Network Services API</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="networkservices_v1beta1.projects.html">projects()</a></code>
+</p>
+<p class="firstline">Returns the projects Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#new_batch_http_request">new_batch_http_request()</a></code></p>
+<p class="firstline">Create a BatchHttpRequest object based on the discovery document.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="new_batch_http_request">new_batch_http_request()</code>
+  <pre>Create a BatchHttpRequest object based on the discovery document.
+
+        Args:
+          callback: callable, A callback to be called for each response, of the
+            form callback(id, response, exception). The first parameter is the
+            request id, and the second is the deserialized response object. The
+            third is an apiclient.errors.HttpError exception object if an HTTP
+            error occurred while processing the request, or None if no error
+            occurred.
+
+        Returns:
+          A BatchHttpRequest object based on the discovery document.
+        </pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/networkservices_v1beta1.projects.html b/docs/dyn/networkservices_v1beta1.projects.html
new file mode 100644
index 0000000..4391ddc
--- /dev/null
+++ b/docs/dyn/networkservices_v1beta1.projects.html
@@ -0,0 +1,91 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="networkservices_v1beta1.html">Network Services API</a> . <a href="networkservices_v1beta1.projects.html">projects</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="networkservices_v1beta1.projects.locations.html">locations()</a></code>
+</p>
+<p class="firstline">Returns the locations Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/networkservices_v1beta1.projects.locations.endpointPolicies.html b/docs/dyn/networkservices_v1beta1.projects.locations.endpointPolicies.html
new file mode 100644
index 0000000..e63537a
--- /dev/null
+++ b/docs/dyn/networkservices_v1beta1.projects.locations.endpointPolicies.html
@@ -0,0 +1,560 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="networkservices_v1beta1.html">Network Services API</a> . <a href="networkservices_v1beta1.projects.html">projects</a> . <a href="networkservices_v1beta1.projects.locations.html">locations</a> . <a href="networkservices_v1beta1.projects.locations.endpointPolicies.html">endpointPolicies</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#create">create(parent, body=None, endpointPolicyId=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Creates a new EndpointPolicy in a given project and location.</p>
+<p class="toc_element">
+  <code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Deletes a single EndpointPolicy.</p>
+<p class="toc_element">
+  <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets details of a single EndpointPolicy.</p>
+<p class="toc_element">
+  <code><a href="#getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.</p>
+<p class="toc_element">
+  <code><a href="#list">list(parent, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Lists EndpointPolicies in a given project and location.</p>
+<p class="toc_element">
+  <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
+<p class="firstline">Retrieves the next page of results.</p>
+<p class="toc_element">
+  <code><a href="#patch">patch(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Updates the parameters of a single EndpointPolicy.</p>
+<p class="toc_element">
+  <code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.</p>
+<p class="toc_element">
+  <code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may "fail open" without warning.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="create">create(parent, body=None, endpointPolicyId=None, x__xgafv=None)</code>
+  <pre>Creates a new EndpointPolicy in a given project and location.
+
+Args:
+  parent: string, Required. The parent resource of the EndpointPolicy. Must be in the format `projects/*/locations/global`. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # EndpointPolicy is a resource that helps apply desired configuration on the endpoints that match specific criteria. For example, this resource can be used to apply &quot;authentication config&quot; an all endpoints that serve on port 8080.
+  &quot;authorizationPolicy&quot;: &quot;A String&quot;, # Optional. This field specifies the URL of AuthorizationPolicy resource that applies authorization policies to the inbound traffic at the matched endpoints. Refer to Authorization. If this field is not specified, authorization is disabled(no authz checks) for this endpoint. Applicable only when EndpointPolicyType is SIDECAR_PROXY.
+  &quot;clientTlsPolicy&quot;: &quot;A String&quot;, # Optional. A URL referring to a ClientTlsPolicy resource. ClientTlsPolicy can be set to specify the authentication for traffic from the proxy to the actual endpoints. More specifically, it is applied to the outgoing traffic from the proxy to the endpoint. This is typically used for sidecar model where the proxy identifies itself as endpoint to the control plane, with the connection between sidecar and endpoint requiring authentication. If this field is not set, authentication is disabled(open). Applicable only when EndpointPolicyType is SIDECAR_PROXY.
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. The timestamp when the resource was created.
+  &quot;description&quot;: &quot;A String&quot;, # Optional. A free-text description of the resource. Max length 1024 characters.
+  &quot;endpointMatcher&quot;: { # A definition of a matcher that selects endpoints to which the policies should be applied. # Required. A matcher that selects endpoints to which the policies should be applied.
+    &quot;metadataLabelMatcher&quot;: { # The matcher that is based on node metadata presented by xDS clients. # The matcher is based on node metadata presented by xDS clients.
+      &quot;metadataLabelMatchCriteria&quot;: &quot;A String&quot;, # Specifies how matching should be done. Supported values are: MATCH_ANY: At least one of the Labels specified in the matcher should match the metadata presented by xDS client. MATCH_ALL: The metadata presented by the xDS client should contain all of the labels specified here. The selection is determined based on the best match. For example, suppose there are three EndpointPolicy resources P1, P2 and P3 and if P1 has a the matcher as MATCH_ANY , P2 has MATCH_ALL , and P3 has MATCH_ALL . If a client with label connects, the config from P1 will be selected. If a client with label connects, the config from P2 will be selected. If a client with label connects, the config from P3 will be selected. If there is more than one best match, (for example, if a config P4 with selector exists and if a client with label connects), an error will be thrown.
+      &quot;metadataLabels&quot;: [ # The list of label value pairs that must match labels in the provided metadata based on filterMatchCriteria This list can have at most 64 entries. The list can be empty if the match criteria is MATCH_ANY, to specify a wildcard match (i.e this matches any client).
+        { # Defines a name-pair value for a single label.
+          &quot;labelName&quot;: &quot;A String&quot;, # Required. Label name presented as key in xDS Node Metadata.
+          &quot;labelValue&quot;: &quot;A String&quot;, # Required. Label value presented as value corresponding to the above key, in xDS Node Metadata.
+        },
+      ],
+    },
+  },
+  &quot;labels&quot;: { # Optional. Set of label tags associated with the EndpointPolicy resource.
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;name&quot;: &quot;A String&quot;, # Required. Name of the EndpointPolicy resource. It matches pattern `projects/*/locations/global/endpointPolicies/`.
+  &quot;serverTlsPolicy&quot;: &quot;A String&quot;, # Optional. A URL referring to ServerTlsPolicy resource. ServerTlsPolicy is used to determine the authentication policy to be applied to terminate the inbound traffic at the identified backends. If this field is not set, authentication is disabled(open) for this endpoint.
+  &quot;trafficPortSelector&quot;: { # Specification of a port-based selector. # Optional. Port selector for the (matched) endpoints. If no port selector is provided, the matched config is applied to all ports.
+    &quot;ports&quot;: [ # Optional. A list of ports. Can be port numbers or port range (example, [80-90] specifies all ports from 80 to 90, including 80 and 90) or named ports or * to specify all ports. If the list is empty, all ports are selected.
+      &quot;A String&quot;,
+    ],
+  },
+  &quot;type&quot;: &quot;A String&quot;, # Required. The type of endpoint policy. This is primarily used to validate the configuration.
+  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The timestamp when the resource was updated.
+}
+
+  endpointPolicyId: string, Required. Short name of the EndpointPolicy resource to be created. E.g. &quot;CustomECS&quot;.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="delete">delete(name, x__xgafv=None)</code>
+  <pre>Deletes a single EndpointPolicy.
+
+Args:
+  name: string, Required. A name of the EndpointPolicy to delete. Must be in the format `projects/*/locations/global/endpointPolicies/*`. (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="get">get(name, x__xgafv=None)</code>
+  <pre>Gets details of a single EndpointPolicy.
+
+Args:
+  name: string, Required. A name of the EndpointPolicy to get. Must be in the format `projects/*/locations/global/endpointPolicies/*`. (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # EndpointPolicy is a resource that helps apply desired configuration on the endpoints that match specific criteria. For example, this resource can be used to apply &quot;authentication config&quot; an all endpoints that serve on port 8080.
+  &quot;authorizationPolicy&quot;: &quot;A String&quot;, # Optional. This field specifies the URL of AuthorizationPolicy resource that applies authorization policies to the inbound traffic at the matched endpoints. Refer to Authorization. If this field is not specified, authorization is disabled(no authz checks) for this endpoint. Applicable only when EndpointPolicyType is SIDECAR_PROXY.
+  &quot;clientTlsPolicy&quot;: &quot;A String&quot;, # Optional. A URL referring to a ClientTlsPolicy resource. ClientTlsPolicy can be set to specify the authentication for traffic from the proxy to the actual endpoints. More specifically, it is applied to the outgoing traffic from the proxy to the endpoint. This is typically used for sidecar model where the proxy identifies itself as endpoint to the control plane, with the connection between sidecar and endpoint requiring authentication. If this field is not set, authentication is disabled(open). Applicable only when EndpointPolicyType is SIDECAR_PROXY.
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. The timestamp when the resource was created.
+  &quot;description&quot;: &quot;A String&quot;, # Optional. A free-text description of the resource. Max length 1024 characters.
+  &quot;endpointMatcher&quot;: { # A definition of a matcher that selects endpoints to which the policies should be applied. # Required. A matcher that selects endpoints to which the policies should be applied.
+    &quot;metadataLabelMatcher&quot;: { # The matcher that is based on node metadata presented by xDS clients. # The matcher is based on node metadata presented by xDS clients.
+      &quot;metadataLabelMatchCriteria&quot;: &quot;A String&quot;, # Specifies how matching should be done. Supported values are: MATCH_ANY: At least one of the Labels specified in the matcher should match the metadata presented by xDS client. MATCH_ALL: The metadata presented by the xDS client should contain all of the labels specified here. The selection is determined based on the best match. For example, suppose there are three EndpointPolicy resources P1, P2 and P3 and if P1 has a the matcher as MATCH_ANY , P2 has MATCH_ALL , and P3 has MATCH_ALL . If a client with label connects, the config from P1 will be selected. If a client with label connects, the config from P2 will be selected. If a client with label connects, the config from P3 will be selected. If there is more than one best match, (for example, if a config P4 with selector exists and if a client with label connects), an error will be thrown.
+      &quot;metadataLabels&quot;: [ # The list of label value pairs that must match labels in the provided metadata based on filterMatchCriteria This list can have at most 64 entries. The list can be empty if the match criteria is MATCH_ANY, to specify a wildcard match (i.e this matches any client).
+        { # Defines a name-pair value for a single label.
+          &quot;labelName&quot;: &quot;A String&quot;, # Required. Label name presented as key in xDS Node Metadata.
+          &quot;labelValue&quot;: &quot;A String&quot;, # Required. Label value presented as value corresponding to the above key, in xDS Node Metadata.
+        },
+      ],
+    },
+  },
+  &quot;labels&quot;: { # Optional. Set of label tags associated with the EndpointPolicy resource.
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;name&quot;: &quot;A String&quot;, # Required. Name of the EndpointPolicy resource. It matches pattern `projects/*/locations/global/endpointPolicies/`.
+  &quot;serverTlsPolicy&quot;: &quot;A String&quot;, # Optional. A URL referring to ServerTlsPolicy resource. ServerTlsPolicy is used to determine the authentication policy to be applied to terminate the inbound traffic at the identified backends. If this field is not set, authentication is disabled(open) for this endpoint.
+  &quot;trafficPortSelector&quot;: { # Specification of a port-based selector. # Optional. Port selector for the (matched) endpoints. If no port selector is provided, the matched config is applied to all ports.
+    &quot;ports&quot;: [ # Optional. A list of ports. Can be port numbers or port range (example, [80-90] specifies all ports from 80 to 90, including 80 and 90) or named ports or * to specify all ports. If the list is empty, all ports are selected.
+      &quot;A String&quot;,
+    ],
+  },
+  &quot;type&quot;: &quot;A String&quot;, # Required. The type of endpoint policy. This is primarily used to validate the configuration.
+  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The timestamp when the resource was updated.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</code>
+  <pre>Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy is being requested. See the operation documentation for the appropriate value for this field. (required)
+  options_requestedPolicyVersion: integer, Optional. The policy format version to be returned. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Requests for policies with any conditional bindings must specify version 3. Policies without any conditional bindings may specify any valid value or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+  &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+    { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+      &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+        { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+          &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+            &quot;A String&quot;,
+          ],
+          &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+        },
+      ],
+      &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+    },
+  ],
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+    { # Associates `members` with a `role`.
+      &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+        &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+        &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+        &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+        &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+      },
+      &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+        &quot;A String&quot;,
+      ],
+      &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+    },
+  ],
+  &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+  &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list">list(parent, pageSize=None, pageToken=None, x__xgafv=None)</code>
+  <pre>Lists EndpointPolicies in a given project and location.
+
+Args:
+  parent: string, Required. The project and location from which the EndpointPolicies should be listed, specified in the format `projects/*/locations/global`. (required)
+  pageSize: integer, Maximum number of EndpointPolicies to return per call.
+  pageToken: string, The value returned by the last `ListEndpointPoliciesResponse` Indicates that this is a continuation of a prior `ListEndpointPolicies` call, and that the system should return the next page of data.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response returned by the ListEndpointPolicies method.
+  &quot;endpointPolicies&quot;: [ # List of EndpointPolicy resources.
+    { # EndpointPolicy is a resource that helps apply desired configuration on the endpoints that match specific criteria. For example, this resource can be used to apply &quot;authentication config&quot; an all endpoints that serve on port 8080.
+      &quot;authorizationPolicy&quot;: &quot;A String&quot;, # Optional. This field specifies the URL of AuthorizationPolicy resource that applies authorization policies to the inbound traffic at the matched endpoints. Refer to Authorization. If this field is not specified, authorization is disabled(no authz checks) for this endpoint. Applicable only when EndpointPolicyType is SIDECAR_PROXY.
+      &quot;clientTlsPolicy&quot;: &quot;A String&quot;, # Optional. A URL referring to a ClientTlsPolicy resource. ClientTlsPolicy can be set to specify the authentication for traffic from the proxy to the actual endpoints. More specifically, it is applied to the outgoing traffic from the proxy to the endpoint. This is typically used for sidecar model where the proxy identifies itself as endpoint to the control plane, with the connection between sidecar and endpoint requiring authentication. If this field is not set, authentication is disabled(open). Applicable only when EndpointPolicyType is SIDECAR_PROXY.
+      &quot;createTime&quot;: &quot;A String&quot;, # Output only. The timestamp when the resource was created.
+      &quot;description&quot;: &quot;A String&quot;, # Optional. A free-text description of the resource. Max length 1024 characters.
+      &quot;endpointMatcher&quot;: { # A definition of a matcher that selects endpoints to which the policies should be applied. # Required. A matcher that selects endpoints to which the policies should be applied.
+        &quot;metadataLabelMatcher&quot;: { # The matcher that is based on node metadata presented by xDS clients. # The matcher is based on node metadata presented by xDS clients.
+          &quot;metadataLabelMatchCriteria&quot;: &quot;A String&quot;, # Specifies how matching should be done. Supported values are: MATCH_ANY: At least one of the Labels specified in the matcher should match the metadata presented by xDS client. MATCH_ALL: The metadata presented by the xDS client should contain all of the labels specified here. The selection is determined based on the best match. For example, suppose there are three EndpointPolicy resources P1, P2 and P3 and if P1 has a the matcher as MATCH_ANY , P2 has MATCH_ALL , and P3 has MATCH_ALL . If a client with label connects, the config from P1 will be selected. If a client with label connects, the config from P2 will be selected. If a client with label connects, the config from P3 will be selected. If there is more than one best match, (for example, if a config P4 with selector exists and if a client with label connects), an error will be thrown.
+          &quot;metadataLabels&quot;: [ # The list of label value pairs that must match labels in the provided metadata based on filterMatchCriteria This list can have at most 64 entries. The list can be empty if the match criteria is MATCH_ANY, to specify a wildcard match (i.e this matches any client).
+            { # Defines a name-pair value for a single label.
+              &quot;labelName&quot;: &quot;A String&quot;, # Required. Label name presented as key in xDS Node Metadata.
+              &quot;labelValue&quot;: &quot;A String&quot;, # Required. Label value presented as value corresponding to the above key, in xDS Node Metadata.
+            },
+          ],
+        },
+      },
+      &quot;labels&quot;: { # Optional. Set of label tags associated with the EndpointPolicy resource.
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+      &quot;name&quot;: &quot;A String&quot;, # Required. Name of the EndpointPolicy resource. It matches pattern `projects/*/locations/global/endpointPolicies/`.
+      &quot;serverTlsPolicy&quot;: &quot;A String&quot;, # Optional. A URL referring to ServerTlsPolicy resource. ServerTlsPolicy is used to determine the authentication policy to be applied to terminate the inbound traffic at the identified backends. If this field is not set, authentication is disabled(open) for this endpoint.
+      &quot;trafficPortSelector&quot;: { # Specification of a port-based selector. # Optional. Port selector for the (matched) endpoints. If no port selector is provided, the matched config is applied to all ports.
+        &quot;ports&quot;: [ # Optional. A list of ports. Can be port numbers or port range (example, [80-90] specifies all ports from 80 to 90, including 80 and 90) or named ports or * to specify all ports. If the list is empty, all ports are selected.
+          &quot;A String&quot;,
+        ],
+      },
+      &quot;type&quot;: &quot;A String&quot;, # Required. The type of endpoint policy. This is primarily used to validate the configuration.
+      &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The timestamp when the resource was updated.
+    },
+  ],
+  &quot;nextPageToken&quot;: &quot;A String&quot;, # If there might be more results than those appearing in this response, then `next_page_token` is included. To get the next set of results, call this method again using the value of `next_page_token` as `page_token`.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
+  <pre>Retrieves the next page of results.
+
+Args:
+  previous_request: The request for the previous page. (required)
+  previous_response: The response from the request for the previous page. (required)
+
+Returns:
+  A request object that you can call &#x27;execute()&#x27; on to request the next
+  page. Returns None if there are no more items in the collection.
+    </pre>
+</div>
+
+<div class="method">
+    <code class="details" id="patch">patch(name, body=None, updateMask=None, x__xgafv=None)</code>
+  <pre>Updates the parameters of a single EndpointPolicy.
+
+Args:
+  name: string, Required. Name of the EndpointPolicy resource. It matches pattern `projects/*/locations/global/endpointPolicies/`. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # EndpointPolicy is a resource that helps apply desired configuration on the endpoints that match specific criteria. For example, this resource can be used to apply &quot;authentication config&quot; an all endpoints that serve on port 8080.
+  &quot;authorizationPolicy&quot;: &quot;A String&quot;, # Optional. This field specifies the URL of AuthorizationPolicy resource that applies authorization policies to the inbound traffic at the matched endpoints. Refer to Authorization. If this field is not specified, authorization is disabled(no authz checks) for this endpoint. Applicable only when EndpointPolicyType is SIDECAR_PROXY.
+  &quot;clientTlsPolicy&quot;: &quot;A String&quot;, # Optional. A URL referring to a ClientTlsPolicy resource. ClientTlsPolicy can be set to specify the authentication for traffic from the proxy to the actual endpoints. More specifically, it is applied to the outgoing traffic from the proxy to the endpoint. This is typically used for sidecar model where the proxy identifies itself as endpoint to the control plane, with the connection between sidecar and endpoint requiring authentication. If this field is not set, authentication is disabled(open). Applicable only when EndpointPolicyType is SIDECAR_PROXY.
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. The timestamp when the resource was created.
+  &quot;description&quot;: &quot;A String&quot;, # Optional. A free-text description of the resource. Max length 1024 characters.
+  &quot;endpointMatcher&quot;: { # A definition of a matcher that selects endpoints to which the policies should be applied. # Required. A matcher that selects endpoints to which the policies should be applied.
+    &quot;metadataLabelMatcher&quot;: { # The matcher that is based on node metadata presented by xDS clients. # The matcher is based on node metadata presented by xDS clients.
+      &quot;metadataLabelMatchCriteria&quot;: &quot;A String&quot;, # Specifies how matching should be done. Supported values are: MATCH_ANY: At least one of the Labels specified in the matcher should match the metadata presented by xDS client. MATCH_ALL: The metadata presented by the xDS client should contain all of the labels specified here. The selection is determined based on the best match. For example, suppose there are three EndpointPolicy resources P1, P2 and P3 and if P1 has a the matcher as MATCH_ANY , P2 has MATCH_ALL , and P3 has MATCH_ALL . If a client with label connects, the config from P1 will be selected. If a client with label connects, the config from P2 will be selected. If a client with label connects, the config from P3 will be selected. If there is more than one best match, (for example, if a config P4 with selector exists and if a client with label connects), an error will be thrown.
+      &quot;metadataLabels&quot;: [ # The list of label value pairs that must match labels in the provided metadata based on filterMatchCriteria This list can have at most 64 entries. The list can be empty if the match criteria is MATCH_ANY, to specify a wildcard match (i.e this matches any client).
+        { # Defines a name-pair value for a single label.
+          &quot;labelName&quot;: &quot;A String&quot;, # Required. Label name presented as key in xDS Node Metadata.
+          &quot;labelValue&quot;: &quot;A String&quot;, # Required. Label value presented as value corresponding to the above key, in xDS Node Metadata.
+        },
+      ],
+    },
+  },
+  &quot;labels&quot;: { # Optional. Set of label tags associated with the EndpointPolicy resource.
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;name&quot;: &quot;A String&quot;, # Required. Name of the EndpointPolicy resource. It matches pattern `projects/*/locations/global/endpointPolicies/`.
+  &quot;serverTlsPolicy&quot;: &quot;A String&quot;, # Optional. A URL referring to ServerTlsPolicy resource. ServerTlsPolicy is used to determine the authentication policy to be applied to terminate the inbound traffic at the identified backends. If this field is not set, authentication is disabled(open) for this endpoint.
+  &quot;trafficPortSelector&quot;: { # Specification of a port-based selector. # Optional. Port selector for the (matched) endpoints. If no port selector is provided, the matched config is applied to all ports.
+    &quot;ports&quot;: [ # Optional. A list of ports. Can be port numbers or port range (example, [80-90] specifies all ports from 80 to 90, including 80 and 90) or named ports or * to specify all ports. If the list is empty, all ports are selected.
+      &quot;A String&quot;,
+    ],
+  },
+  &quot;type&quot;: &quot;A String&quot;, # Required. The type of endpoint policy. This is primarily used to validate the configuration.
+  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The timestamp when the resource was updated.
+}
+
+  updateMask: string, Optional. Field mask is used to specify the fields to be overwritten in the EndpointPolicy resource by the update. The fields specified in the update_mask are relative to the resource, not the full request. A field will be overwritten if it is in the mask. If the user does not provide a mask then all fields will be overwritten.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>
+  <pre>Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy is being specified. See the operation documentation for the appropriate value for this field. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request message for `SetIamPolicy` method.
+  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+    &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+      { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+        &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+          { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+            &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+              &quot;A String&quot;,
+            ],
+            &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+          },
+        ],
+        &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+      },
+    ],
+    &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+      { # Associates `members` with a `role`.
+        &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+          &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+          &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+          &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+          &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+        },
+        &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+          &quot;A String&quot;,
+        ],
+        &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+      },
+    ],
+    &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+    &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+  },
+  &quot;updateMask&quot;: &quot;A String&quot;, # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only the fields in the mask will be modified. If no mask is provided, the following default mask is used: `paths: &quot;bindings, etag&quot;`
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+  &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+    { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+      &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+        { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+          &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+            &quot;A String&quot;,
+          ],
+          &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+        },
+      ],
+      &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+    },
+  ],
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+    { # Associates `members` with a `role`.
+      &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+        &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+        &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+        &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+        &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+      },
+      &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+        &quot;A String&quot;,
+      ],
+      &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+    },
+  ],
+  &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+  &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>
+  <pre>Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may &quot;fail open&quot; without warning.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy detail is being requested. See the operation documentation for the appropriate value for this field. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request message for `TestIamPermissions` method.
+  &quot;permissions&quot;: [ # The set of permissions to check for the `resource`. Permissions with wildcards (such as &#x27;*&#x27; or &#x27;storage.*&#x27;) are not allowed. For more information see [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
+    &quot;A String&quot;,
+  ],
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response message for `TestIamPermissions` method.
+  &quot;permissions&quot;: [ # A subset of `TestPermissionsRequest.permissions` that the caller is allowed.
+    &quot;A String&quot;,
+  ],
+}</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/networkservices_v1beta1.projects.locations.html b/docs/dyn/networkservices_v1beta1.projects.locations.html
new file mode 100644
index 0000000..93086a6
--- /dev/null
+++ b/docs/dyn/networkservices_v1beta1.projects.locations.html
@@ -0,0 +1,181 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="networkservices_v1beta1.html">Network Services API</a> . <a href="networkservices_v1beta1.projects.html">projects</a> . <a href="networkservices_v1beta1.projects.locations.html">locations</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="networkservices_v1beta1.projects.locations.endpointPolicies.html">endpointPolicies()</a></code>
+</p>
+<p class="firstline">Returns the endpointPolicies Resource.</p>
+
+<p class="toc_element">
+  <code><a href="networkservices_v1beta1.projects.locations.operations.html">operations()</a></code>
+</p>
+<p class="firstline">Returns the operations Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets information about a location.</p>
+<p class="toc_element">
+  <code><a href="#list">list(name, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Lists information about the supported locations for this service.</p>
+<p class="toc_element">
+  <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
+<p class="firstline">Retrieves the next page of results.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="get">get(name, x__xgafv=None)</code>
+  <pre>Gets information about a location.
+
+Args:
+  name: string, Resource name for the location. (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # A resource that represents Google Cloud Platform location.
+  &quot;displayName&quot;: &quot;A String&quot;, # The friendly name for this location, typically a nearby city name. For example, &quot;Tokyo&quot;.
+  &quot;labels&quot;: { # Cross-service attributes for the location. For example {&quot;cloud.googleapis.com/region&quot;: &quot;us-east1&quot;}
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;locationId&quot;: &quot;A String&quot;, # The canonical id for this location. For example: `&quot;us-east1&quot;`.
+  &quot;metadata&quot;: { # Service-specific metadata. For example the available capacity at the given location.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # Resource name for the location, which may vary between implementations. For example: `&quot;projects/example-project/locations/us-east1&quot;`
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list">list(name, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</code>
+  <pre>Lists information about the supported locations for this service.
+
+Args:
+  name: string, The resource that owns the locations collection, if applicable. (required)
+  filter: string, A filter to narrow down results to a preferred subset. The filtering language accepts strings like &quot;displayName=tokyo&quot;, and is documented in more detail in [AIP-160](https://google.aip.dev/160).
+  pageSize: integer, The maximum number of results to return. If not set, the service selects a default.
+  pageToken: string, A page token received from the `next_page_token` field in the response. Send that page token to receive the subsequent page.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # The response message for Locations.ListLocations.
+  &quot;locations&quot;: [ # A list of locations that matches the specified filter in the request.
+    { # A resource that represents Google Cloud Platform location.
+      &quot;displayName&quot;: &quot;A String&quot;, # The friendly name for this location, typically a nearby city name. For example, &quot;Tokyo&quot;.
+      &quot;labels&quot;: { # Cross-service attributes for the location. For example {&quot;cloud.googleapis.com/region&quot;: &quot;us-east1&quot;}
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+      &quot;locationId&quot;: &quot;A String&quot;, # The canonical id for this location. For example: `&quot;us-east1&quot;`.
+      &quot;metadata&quot;: { # Service-specific metadata. For example the available capacity at the given location.
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+      &quot;name&quot;: &quot;A String&quot;, # Resource name for the location, which may vary between implementations. For example: `&quot;projects/example-project/locations/us-east1&quot;`
+    },
+  ],
+  &quot;nextPageToken&quot;: &quot;A String&quot;, # The standard List next-page token.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
+  <pre>Retrieves the next page of results.
+
+Args:
+  previous_request: The request for the previous page. (required)
+  previous_response: The response from the request for the previous page. (required)
+
+Returns:
+  A request object that you can call &#x27;execute()&#x27; on to request the next
+  page. Returns None if there are no more items in the collection.
+    </pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/networkservices_v1beta1.projects.locations.operations.html b/docs/dyn/networkservices_v1beta1.projects.locations.operations.html
new file mode 100644
index 0000000..a9c4de8
--- /dev/null
+++ b/docs/dyn/networkservices_v1beta1.projects.locations.operations.html
@@ -0,0 +1,235 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="networkservices_v1beta1.html">Network Services API</a> . <a href="networkservices_v1beta1.projects.html">projects</a> . <a href="networkservices_v1beta1.projects.locations.html">locations</a> . <a href="networkservices_v1beta1.projects.locations.operations.html">operations</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#cancel">cancel(name, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Starts asynchronous cancellation on a long-running operation. The server makes a best effort to cancel the operation, but success is not guaranteed. If the server doesn't support this method, it returns `google.rpc.Code.UNIMPLEMENTED`. Clients can use Operations.GetOperation or other methods to check whether the cancellation succeeded or whether the operation completed despite cancellation. On successful cancellation, the operation is not deleted; instead, it becomes an operation with an Operation.error value with a google.rpc.Status.code of 1, corresponding to `Code.CANCELLED`.</p>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Deletes a long-running operation. This method indicates that the client is no longer interested in the operation result. It does not cancel the operation. If the server doesn't support this method, it returns `google.rpc.Code.UNIMPLEMENTED`.</p>
+<p class="toc_element">
+  <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets the latest state of a long-running operation. Clients can use this method to poll the operation result at intervals as recommended by the API service.</p>
+<p class="toc_element">
+  <code><a href="#list">list(name, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Lists operations that match the specified filter in the request. If the server doesn't support this method, it returns `UNIMPLEMENTED`. NOTE: the `name` binding allows API services to override the binding to use different resource name schemes, such as `users/*/operations`. To override the binding, API services can add a binding such as `"/v1/{name=users/*}/operations"` to their service configuration. For backwards compatibility, the default name includes the operations collection id, however overriding users must ensure the name binding is the parent resource, without the operations collection id.</p>
+<p class="toc_element">
+  <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
+<p class="firstline">Retrieves the next page of results.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="cancel">cancel(name, body=None, x__xgafv=None)</code>
+  <pre>Starts asynchronous cancellation on a long-running operation. The server makes a best effort to cancel the operation, but success is not guaranteed. If the server doesn&#x27;t support this method, it returns `google.rpc.Code.UNIMPLEMENTED`. Clients can use Operations.GetOperation or other methods to check whether the cancellation succeeded or whether the operation completed despite cancellation. On successful cancellation, the operation is not deleted; instead, it becomes an operation with an Operation.error value with a google.rpc.Status.code of 1, corresponding to `Code.CANCELLED`.
+
+Args:
+  name: string, The name of the operation resource to be cancelled. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # The request message for Operations.CancelOperation.
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); } The JSON representation for `Empty` is empty JSON object `{}`.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="delete">delete(name, x__xgafv=None)</code>
+  <pre>Deletes a long-running operation. This method indicates that the client is no longer interested in the operation result. It does not cancel the operation. If the server doesn&#x27;t support this method, it returns `google.rpc.Code.UNIMPLEMENTED`.
+
+Args:
+  name: string, The name of the operation resource to be deleted. (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); } The JSON representation for `Empty` is empty JSON object `{}`.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="get">get(name, x__xgafv=None)</code>
+  <pre>Gets the latest state of a long-running operation. Clients can use this method to poll the operation result at intervals as recommended by the API service.
+
+Args:
+  name: string, The name of the operation resource. (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list">list(name, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</code>
+  <pre>Lists operations that match the specified filter in the request. If the server doesn&#x27;t support this method, it returns `UNIMPLEMENTED`. NOTE: the `name` binding allows API services to override the binding to use different resource name schemes, such as `users/*/operations`. To override the binding, API services can add a binding such as `&quot;/v1/{name=users/*}/operations&quot;` to their service configuration. For backwards compatibility, the default name includes the operations collection id, however overriding users must ensure the name binding is the parent resource, without the operations collection id.
+
+Args:
+  name: string, The name of the operation&#x27;s parent resource. (required)
+  filter: string, The standard list filter.
+  pageSize: integer, The standard list page size.
+  pageToken: string, The standard list page token.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # The response message for Operations.ListOperations.
+  &quot;nextPageToken&quot;: &quot;A String&quot;, # The standard List next-page token.
+  &quot;operations&quot;: [ # A list of operations that matches the specified filter in the request.
+    { # This resource represents a long-running operation that is the result of a network API call.
+      &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+      &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+        &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+        &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+          {
+            &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+          },
+        ],
+        &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+      },
+      &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+      &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+      &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    },
+  ],
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
+  <pre>Retrieves the next page of results.
+
+Args:
+  previous_request: The request for the previous page. (required)
+  previous_response: The response from the request for the previous page. (required)
+
+Returns:
+  A request object that you can call &#x27;execute()&#x27; on to request the next
+  page. Returns None if there are no more items in the collection.
+    </pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/notebooks_v1.projects.locations.executions.html b/docs/dyn/notebooks_v1.projects.locations.executions.html
index a64bf79..5df743e 100644
--- a/docs/dyn/notebooks_v1.projects.locations.executions.html
+++ b/docs/dyn/notebooks_v1.projects.locations.executions.html
@@ -205,7 +205,7 @@
   <pre>Gets details of executions
 
 Args:
-  name: string, Required. Format: `projects/{project_id}/locations/{location}/schedules/{execution_id}` (required)
+  name: string, Required. Format: `projects/{project_id}/locations/{location}/executions/{execution_id}` (required)
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
diff --git a/docs/dyn/osconfig_v1alpha.projects.locations.instances.inventories.html b/docs/dyn/osconfig_v1alpha.projects.locations.instances.inventories.html
index 19398df..e3fc643 100644
--- a/docs/dyn/osconfig_v1alpha.projects.locations.instances.inventories.html
+++ b/docs/dyn/osconfig_v1alpha.projects.locations.instances.inventories.html
@@ -136,6 +136,17 @@
           &quot;hotFixId&quot;: &quot;A String&quot;, # Unique identifier associated with a particular QFE update.
           &quot;installTime&quot;: &quot;A String&quot;, # Date that the QFE update was installed. Mapped from installed_on field.
         },
+        &quot;windowsApplication&quot;: { # Contains information about a Windows application as retrieved from the Windows Registry. For more information about these fields, see [Windows Installer Properties for the Uninstall Registry](https://docs.microsoft.com/en-us/windows/win32/msi/uninstall-registry-key){: class=&quot;external&quot; } # Details of Windows Application.
+          &quot;displayName&quot;: &quot;A String&quot;, # The name of the application or product.
+          &quot;displayVersion&quot;: &quot;A String&quot;, # The version of the product or application in string format.
+          &quot;helpLink&quot;: &quot;A String&quot;, # The internet address for technical support.
+          &quot;installDate&quot;: { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # The last time this product received service. The value of this property is replaced each time a patch is applied or removed from the product or the command-line option is used to repair the product.
+            &quot;day&quot;: 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn&#x27;t significant.
+            &quot;month&quot;: 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.
+            &quot;year&quot;: 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
+          },
+          &quot;publisher&quot;: &quot;A String&quot;, # The name of the manufacturer for the product or application.
+        },
         &quot;wuaPackage&quot;: { # Details related to a Windows Update package. Field data and names are taken from Windows Update API IUpdate Interface: https://docs.microsoft.com/en-us/windows/win32/api/_wua/ Descriptive fields like title, and description are localized based on the locale of the VM being updated. # Details of a Windows Update package. See https://docs.microsoft.com/en-us/windows/win32/api/_wua/ for information about Windows Update.
           &quot;categories&quot;: [ # The categories that are associated with this update package.
             { # Categories specified by the Windows Update.
@@ -197,6 +208,17 @@
           &quot;hotFixId&quot;: &quot;A String&quot;, # Unique identifier associated with a particular QFE update.
           &quot;installTime&quot;: &quot;A String&quot;, # Date that the QFE update was installed. Mapped from installed_on field.
         },
+        &quot;windowsApplication&quot;: { # Contains information about a Windows application as retrieved from the Windows Registry. For more information about these fields, see [Windows Installer Properties for the Uninstall Registry](https://docs.microsoft.com/en-us/windows/win32/msi/uninstall-registry-key){: class=&quot;external&quot; } # Details of Windows Application.
+          &quot;displayName&quot;: &quot;A String&quot;, # The name of the application or product.
+          &quot;displayVersion&quot;: &quot;A String&quot;, # The version of the product or application in string format.
+          &quot;helpLink&quot;: &quot;A String&quot;, # The internet address for technical support.
+          &quot;installDate&quot;: { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # The last time this product received service. The value of this property is replaced each time a patch is applied or removed from the product or the command-line option is used to repair the product.
+            &quot;day&quot;: 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn&#x27;t significant.
+            &quot;month&quot;: 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.
+            &quot;year&quot;: 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
+          },
+          &quot;publisher&quot;: &quot;A String&quot;, # The name of the manufacturer for the product or application.
+        },
         &quot;wuaPackage&quot;: { # Details related to a Windows Update package. Field data and names are taken from Windows Update API IUpdate Interface: https://docs.microsoft.com/en-us/windows/win32/api/_wua/ Descriptive fields like title, and description are localized based on the locale of the VM being updated. # Details of a Windows Update package. See https://docs.microsoft.com/en-us/windows/win32/api/_wua/ for information about Windows Update.
           &quot;categories&quot;: [ # The categories that are associated with this update package.
             { # Categories specified by the Windows Update.
@@ -303,6 +325,17 @@
               &quot;hotFixId&quot;: &quot;A String&quot;, # Unique identifier associated with a particular QFE update.
               &quot;installTime&quot;: &quot;A String&quot;, # Date that the QFE update was installed. Mapped from installed_on field.
             },
+            &quot;windowsApplication&quot;: { # Contains information about a Windows application as retrieved from the Windows Registry. For more information about these fields, see [Windows Installer Properties for the Uninstall Registry](https://docs.microsoft.com/en-us/windows/win32/msi/uninstall-registry-key){: class=&quot;external&quot; } # Details of Windows Application.
+              &quot;displayName&quot;: &quot;A String&quot;, # The name of the application or product.
+              &quot;displayVersion&quot;: &quot;A String&quot;, # The version of the product or application in string format.
+              &quot;helpLink&quot;: &quot;A String&quot;, # The internet address for technical support.
+              &quot;installDate&quot;: { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # The last time this product received service. The value of this property is replaced each time a patch is applied or removed from the product or the command-line option is used to repair the product.
+                &quot;day&quot;: 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn&#x27;t significant.
+                &quot;month&quot;: 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.
+                &quot;year&quot;: 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
+              },
+              &quot;publisher&quot;: &quot;A String&quot;, # The name of the manufacturer for the product or application.
+            },
             &quot;wuaPackage&quot;: { # Details related to a Windows Update package. Field data and names are taken from Windows Update API IUpdate Interface: https://docs.microsoft.com/en-us/windows/win32/api/_wua/ Descriptive fields like title, and description are localized based on the locale of the VM being updated. # Details of a Windows Update package. See https://docs.microsoft.com/en-us/windows/win32/api/_wua/ for information about Windows Update.
               &quot;categories&quot;: [ # The categories that are associated with this update package.
                 { # Categories specified by the Windows Update.
@@ -364,6 +397,17 @@
               &quot;hotFixId&quot;: &quot;A String&quot;, # Unique identifier associated with a particular QFE update.
               &quot;installTime&quot;: &quot;A String&quot;, # Date that the QFE update was installed. Mapped from installed_on field.
             },
+            &quot;windowsApplication&quot;: { # Contains information about a Windows application as retrieved from the Windows Registry. For more information about these fields, see [Windows Installer Properties for the Uninstall Registry](https://docs.microsoft.com/en-us/windows/win32/msi/uninstall-registry-key){: class=&quot;external&quot; } # Details of Windows Application.
+              &quot;displayName&quot;: &quot;A String&quot;, # The name of the application or product.
+              &quot;displayVersion&quot;: &quot;A String&quot;, # The version of the product or application in string format.
+              &quot;helpLink&quot;: &quot;A String&quot;, # The internet address for technical support.
+              &quot;installDate&quot;: { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # The last time this product received service. The value of this property is replaced each time a patch is applied or removed from the product or the command-line option is used to repair the product.
+                &quot;day&quot;: 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn&#x27;t significant.
+                &quot;month&quot;: 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.
+                &quot;year&quot;: 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
+              },
+              &quot;publisher&quot;: &quot;A String&quot;, # The name of the manufacturer for the product or application.
+            },
             &quot;wuaPackage&quot;: { # Details related to a Windows Update package. Field data and names are taken from Windows Update API IUpdate Interface: https://docs.microsoft.com/en-us/windows/win32/api/_wua/ Descriptive fields like title, and description are localized based on the locale of the VM being updated. # Details of a Windows Update package. See https://docs.microsoft.com/en-us/windows/win32/api/_wua/ for information about Windows Update.
               &quot;categories&quot;: [ # The categories that are associated with this update package.
                 { # Categories specified by the Windows Update.
diff --git a/docs/dyn/people_v1.otherContacts.html b/docs/dyn/people_v1.otherContacts.html
index c6c31f8..8354955 100644
--- a/docs/dyn/people_v1.otherContacts.html
+++ b/docs/dyn/people_v1.otherContacts.html
@@ -1007,7 +1007,7 @@
   pageToken: string, Optional. A page token, received from a previous response `next_page_token`. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to `otherContacts.list` must match the first call that provided the page token.
   readMask: string, Required. A field mask to restrict which fields on each person are returned. Multiple fields can be specified by separating them with commas. Valid values are: * emailAddresses * metadata * names * phoneNumbers * photos
   requestSyncToken: boolean, Optional. Whether the response should return `next_sync_token` on the last page of results. It can be used to get incremental changes since the last request by setting it on the request `sync_token`. More details about sync behavior at `otherContacts.list`.
-  sources: string, Optional. A mask of what source types to return. Defaults to READ_SOURCE_TYPE_CONTACT if not set. (repeated)
+  sources: string, Optional. A mask of what source types to return. Defaults to READ_SOURCE_TYPE_CONTACT if not set. If READ_SOURCE_TYPE_CONTACT is used, valid values for the readMask are: * emailAddresses * metadata * names * phoneNumbers * photos If READ_SOURCE_TYPE_PROFILE is used, valid values for the readMask are: * addresses * ageRanges * biographies * birthdays * calendarUrls * clientData * coverPhotos * emailAddresses * events * externalIds * genders * imClients * interests * locales * locations * memberships * metadata * miscKeywords * names * nicknames * occupations * organizations * phoneNumbers * photos * relations * sipAddresses * skills * urls * userDefined (repeated)
     Allowed values
       READ_SOURCE_TYPE_UNSPECIFIED - Unspecified.
       READ_SOURCE_TYPE_PROFILE - Returns SourceType.ACCOUNT, SourceType.DOMAIN_PROFILE, and SourceType.PROFILE.
diff --git a/docs/dyn/policyanalyzer_v1.html b/docs/dyn/policyanalyzer_v1.html
new file mode 100644
index 0000000..7d78e03
--- /dev/null
+++ b/docs/dyn/policyanalyzer_v1.html
@@ -0,0 +1,111 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="policyanalyzer_v1.html">Policy Analyzer API</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="policyanalyzer_v1.projects.html">projects()</a></code>
+</p>
+<p class="firstline">Returns the projects Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#new_batch_http_request">new_batch_http_request()</a></code></p>
+<p class="firstline">Create a BatchHttpRequest object based on the discovery document.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="new_batch_http_request">new_batch_http_request()</code>
+  <pre>Create a BatchHttpRequest object based on the discovery document.
+
+        Args:
+          callback: callable, A callback to be called for each response, of the
+            form callback(id, response, exception). The first parameter is the
+            request id, and the second is the deserialized response object. The
+            third is an apiclient.errors.HttpError exception object if an HTTP
+            error occurred while processing the request, or None if no error
+            occurred.
+
+        Returns:
+          A BatchHttpRequest object based on the discovery document.
+        </pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/policyanalyzer_v1.projects.html b/docs/dyn/policyanalyzer_v1.projects.html
new file mode 100644
index 0000000..d559943
--- /dev/null
+++ b/docs/dyn/policyanalyzer_v1.projects.html
@@ -0,0 +1,91 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="policyanalyzer_v1.html">Policy Analyzer API</a> . <a href="policyanalyzer_v1.projects.html">projects</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="policyanalyzer_v1.projects.locations.html">locations()</a></code>
+</p>
+<p class="firstline">Returns the locations Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/policyanalyzer_v1.projects.locations.activityTypes.activities.html b/docs/dyn/policyanalyzer_v1.projects.locations.activityTypes.activities.html
new file mode 100644
index 0000000..4fe17e5
--- /dev/null
+++ b/docs/dyn/policyanalyzer_v1.projects.locations.activityTypes.activities.html
@@ -0,0 +1,141 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="policyanalyzer_v1.html">Policy Analyzer API</a> . <a href="policyanalyzer_v1.projects.html">projects</a> . <a href="policyanalyzer_v1.projects.locations.html">locations</a> . <a href="policyanalyzer_v1.projects.locations.activityTypes.html">activityTypes</a> . <a href="policyanalyzer_v1.projects.locations.activityTypes.activities.html">activities</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#query">query(parent, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Queries policy activities on GCP resources.</p>
+<p class="toc_element">
+  <code><a href="#query_next">query_next(previous_request, previous_response)</a></code></p>
+<p class="firstline">Retrieves the next page of results.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="query">query(parent, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</code>
+  <pre>Queries policy activities on GCP resources.
+
+Args:
+  parent: string, Required. The container resource on which to execute the request. Acceptable formats: `projects/[PROJECT_ID|PROJECT_NUMBER]/locations/[LOCATION]/activityTypes/[ACTIVITY_TYPE]` LOCATION here refers to GCP Locations: https://cloud.google.com/about/locations/ (required)
+  filter: string, Optional. Optional filter expression to restrict the activities returned. Supported filters are: - service_account_last_authn.full_resource_name {=} - service_account_key_last_authn.full_resource_name {=} 
+  pageSize: integer, Optional. The maximum number of results to return from this request. Max limit is 1000. Non-positive values are ignored. The presence of `nextPageToken` in the response indicates that more results might be available.
+  pageToken: string, Optional. If present, then retrieve the next batch of results from the preceding call to this method. `pageToken` must be the value of `nextPageToken` from the previous response. The values of other method parameters should be identical to those in the previous call.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response to the `QueryActivity` method.
+  &quot;activities&quot;: [ # The set of activities that match the filter included in the request.
+    {
+      &quot;activity&quot;: { # A struct of custom fields to explain the activity.
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object.
+      },
+      &quot;activityType&quot;: &quot;A String&quot;, # The type of the activity.
+      &quot;fullResourceName&quot;: &quot;A String&quot;, # The full resource name that identifies the resource. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names.
+      &quot;observationPeriod&quot;: { # Represents data observation period. # The data observation period to build the activity.
+        &quot;endTime&quot;: &quot;A String&quot;, # The observation end time.
+        &quot;startTime&quot;: &quot;A String&quot;, # The observation start time.
+      },
+    },
+  ],
+  &quot;nextPageToken&quot;: &quot;A String&quot;, # If there might be more results than those appearing in this response, then `nextPageToken` is included. To get the next set of results, call this method again using the value of `nextPageToken` as `pageToken`.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="query_next">query_next(previous_request, previous_response)</code>
+  <pre>Retrieves the next page of results.
+
+Args:
+  previous_request: The request for the previous page. (required)
+  previous_response: The response from the request for the previous page. (required)
+
+Returns:
+  A request object that you can call &#x27;execute()&#x27; on to request the next
+  page. Returns None if there are no more items in the collection.
+    </pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/policyanalyzer_v1.projects.locations.activityTypes.html b/docs/dyn/policyanalyzer_v1.projects.locations.activityTypes.html
new file mode 100644
index 0000000..5d84214
--- /dev/null
+++ b/docs/dyn/policyanalyzer_v1.projects.locations.activityTypes.html
@@ -0,0 +1,91 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="policyanalyzer_v1.html">Policy Analyzer API</a> . <a href="policyanalyzer_v1.projects.html">projects</a> . <a href="policyanalyzer_v1.projects.locations.html">locations</a> . <a href="policyanalyzer_v1.projects.locations.activityTypes.html">activityTypes</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="policyanalyzer_v1.projects.locations.activityTypes.activities.html">activities()</a></code>
+</p>
+<p class="firstline">Returns the activities Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/policyanalyzer_v1.projects.locations.html b/docs/dyn/policyanalyzer_v1.projects.locations.html
new file mode 100644
index 0000000..3bde8b9
--- /dev/null
+++ b/docs/dyn/policyanalyzer_v1.projects.locations.html
@@ -0,0 +1,91 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="policyanalyzer_v1.html">Policy Analyzer API</a> . <a href="policyanalyzer_v1.projects.html">projects</a> . <a href="policyanalyzer_v1.projects.locations.html">locations</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="policyanalyzer_v1.projects.locations.activityTypes.html">activityTypes()</a></code>
+</p>
+<p class="firstline">Returns the activityTypes Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/policyanalyzer_v1beta1.html b/docs/dyn/policyanalyzer_v1beta1.html
new file mode 100644
index 0000000..7eabc19
--- /dev/null
+++ b/docs/dyn/policyanalyzer_v1beta1.html
@@ -0,0 +1,111 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="policyanalyzer_v1beta1.html">Policy Analyzer API</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="policyanalyzer_v1beta1.projects.html">projects()</a></code>
+</p>
+<p class="firstline">Returns the projects Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#new_batch_http_request">new_batch_http_request()</a></code></p>
+<p class="firstline">Create a BatchHttpRequest object based on the discovery document.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="new_batch_http_request">new_batch_http_request()</code>
+  <pre>Create a BatchHttpRequest object based on the discovery document.
+
+        Args:
+          callback: callable, A callback to be called for each response, of the
+            form callback(id, response, exception). The first parameter is the
+            request id, and the second is the deserialized response object. The
+            third is an apiclient.errors.HttpError exception object if an HTTP
+            error occurred while processing the request, or None if no error
+            occurred.
+
+        Returns:
+          A BatchHttpRequest object based on the discovery document.
+        </pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/policyanalyzer_v1beta1.projects.html b/docs/dyn/policyanalyzer_v1beta1.projects.html
new file mode 100644
index 0000000..9fbaba6
--- /dev/null
+++ b/docs/dyn/policyanalyzer_v1beta1.projects.html
@@ -0,0 +1,91 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="policyanalyzer_v1beta1.html">Policy Analyzer API</a> . <a href="policyanalyzer_v1beta1.projects.html">projects</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="policyanalyzer_v1beta1.projects.locations.html">locations()</a></code>
+</p>
+<p class="firstline">Returns the locations Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/policyanalyzer_v1beta1.projects.locations.activityTypes.activities.html b/docs/dyn/policyanalyzer_v1beta1.projects.locations.activityTypes.activities.html
new file mode 100644
index 0000000..383f2c5
--- /dev/null
+++ b/docs/dyn/policyanalyzer_v1beta1.projects.locations.activityTypes.activities.html
@@ -0,0 +1,141 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="policyanalyzer_v1beta1.html">Policy Analyzer API</a> . <a href="policyanalyzer_v1beta1.projects.html">projects</a> . <a href="policyanalyzer_v1beta1.projects.locations.html">locations</a> . <a href="policyanalyzer_v1beta1.projects.locations.activityTypes.html">activityTypes</a> . <a href="policyanalyzer_v1beta1.projects.locations.activityTypes.activities.html">activities</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#query">query(parent, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Queries policy activities on GCP resources.</p>
+<p class="toc_element">
+  <code><a href="#query_next">query_next(previous_request, previous_response)</a></code></p>
+<p class="firstline">Retrieves the next page of results.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="query">query(parent, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</code>
+  <pre>Queries policy activities on GCP resources.
+
+Args:
+  parent: string, Required. The container resource on which to execute the request. Acceptable formats: `projects/[PROJECT_ID|PROJECT_NUMBER]/locations/[LOCATION]/activityTypes/[ACTIVITY_TYPE]` LOCATION here refers to GCP Locations: https://cloud.google.com/about/locations/ (required)
+  filter: string, Optional. Optional filter expression to restrict the activities returned. Supported filters are: - service_account_last_authn.full_resource_name {=} - service_account_key_last_authn.full_resource_name {=} 
+  pageSize: integer, Optional. The maximum number of results to return from this request. Max limit is 1000. Non-positive values are ignored. The presence of `nextPageToken` in the response indicates that more results might be available.
+  pageToken: string, Optional. If present, then retrieve the next batch of results from the preceding call to this method. `pageToken` must be the value of `nextPageToken` from the previous response. The values of other method parameters should be identical to those in the previous call.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response to the `QueryActivity` method.
+  &quot;activities&quot;: [ # The set of activities that match the filter included in the request.
+    {
+      &quot;activity&quot;: { # A struct of custom fields to explain the activity.
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object.
+      },
+      &quot;activityType&quot;: &quot;A String&quot;, # The type of the activity.
+      &quot;fullResourceName&quot;: &quot;A String&quot;, # The full resource name that identifies the resource. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names.
+      &quot;observationPeriod&quot;: { # Represents data observation period. # The data observation period to build the activity.
+        &quot;endTime&quot;: &quot;A String&quot;, # The observation end time.
+        &quot;startTime&quot;: &quot;A String&quot;, # The observation start time.
+      },
+    },
+  ],
+  &quot;nextPageToken&quot;: &quot;A String&quot;, # If there might be more results than those appearing in this response, then `nextPageToken` is included. To get the next set of results, call this method again using the value of `nextPageToken` as `pageToken`.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="query_next">query_next(previous_request, previous_response)</code>
+  <pre>Retrieves the next page of results.
+
+Args:
+  previous_request: The request for the previous page. (required)
+  previous_response: The response from the request for the previous page. (required)
+
+Returns:
+  A request object that you can call &#x27;execute()&#x27; on to request the next
+  page. Returns None if there are no more items in the collection.
+    </pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/policyanalyzer_v1beta1.projects.locations.activityTypes.html b/docs/dyn/policyanalyzer_v1beta1.projects.locations.activityTypes.html
new file mode 100644
index 0000000..f925924
--- /dev/null
+++ b/docs/dyn/policyanalyzer_v1beta1.projects.locations.activityTypes.html
@@ -0,0 +1,91 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="policyanalyzer_v1beta1.html">Policy Analyzer API</a> . <a href="policyanalyzer_v1beta1.projects.html">projects</a> . <a href="policyanalyzer_v1beta1.projects.locations.html">locations</a> . <a href="policyanalyzer_v1beta1.projects.locations.activityTypes.html">activityTypes</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="policyanalyzer_v1beta1.projects.locations.activityTypes.activities.html">activities()</a></code>
+</p>
+<p class="firstline">Returns the activities Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/policyanalyzer_v1beta1.projects.locations.html b/docs/dyn/policyanalyzer_v1beta1.projects.locations.html
new file mode 100644
index 0000000..ad45962
--- /dev/null
+++ b/docs/dyn/policyanalyzer_v1beta1.projects.locations.html
@@ -0,0 +1,91 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="policyanalyzer_v1beta1.html">Policy Analyzer API</a> . <a href="policyanalyzer_v1beta1.projects.html">projects</a> . <a href="policyanalyzer_v1beta1.projects.locations.html">locations</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="policyanalyzer_v1beta1.projects.locations.activityTypes.html">activityTypes()</a></code>
+</p>
+<p class="firstline">Returns the activityTypes Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/privateca_v1.projects.locations.caPools.certificateAuthorities.html b/docs/dyn/privateca_v1.projects.locations.caPools.certificateAuthorities.html
index 8db42ec..5b24daa 100644
--- a/docs/dyn/privateca_v1.projects.locations.caPools.certificateAuthorities.html
+++ b/docs/dyn/privateca_v1.projects.locations.caPools.certificateAuthorities.html
@@ -129,7 +129,7 @@
   &quot;pemCaCertificate&quot;: &quot;A String&quot;, # Required. The signed CA certificate issued from FetchCertificateAuthorityCsrResponse.pem_csr.
   &quot;requestId&quot;: &quot;A String&quot;, # Optional. An ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes since the first request. For example, consider a situation where you make an initial request and t he request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
   &quot;subordinateConfig&quot;: { # Describes a subordinate CA&#x27;s issuers. This is either a resource name to a known issuing CertificateAuthority, or a PEM issuer certificate chain. # Required. Must include information about the issuer of &#x27;pem_ca_certificate&#x27;, and any further issuers until the self-signed CA.
-    &quot;certificateAuthority&quot;: &quot;A String&quot;, # Required. This can refer to a CertificateAuthority in the same project that was used to create a subordinate CertificateAuthority. This field is used for information and usability purposes only. The resource name is in the format `projects/*/locations/*/caPools/*/certificateAuthorities/*`.
+    &quot;certificateAuthority&quot;: &quot;A String&quot;, # Required. This can refer to a CertificateAuthority that was used to create a subordinate CertificateAuthority. This field is used for information and usability purposes only. The resource name is in the format `projects/*/locations/*/caPools/*/certificateAuthorities/*`.
     &quot;pemIssuerChain&quot;: { # This message describes a subordinate CA&#x27;s issuer certificate chain. This wrapper exists for compatibility reasons. # Required. Contains the PEM certificate chain for the issuers of this CertificateAuthority, but not pem certificate for this CA itself.
       &quot;pemCertificates&quot;: [ # Required. Expected to be in leaf-to-root order according to RFC 5246.
         &quot;A String&quot;,
@@ -423,7 +423,7 @@
   ],
   &quot;state&quot;: &quot;A String&quot;, # Output only. The State for this CertificateAuthority.
   &quot;subordinateConfig&quot;: { # Describes a subordinate CA&#x27;s issuers. This is either a resource name to a known issuing CertificateAuthority, or a PEM issuer certificate chain. # Optional. If this is a subordinate CertificateAuthority, this field will be set with the subordinate configuration, which describes its issuers. This may be updated, but this CertificateAuthority must continue to validate.
-    &quot;certificateAuthority&quot;: &quot;A String&quot;, # Required. This can refer to a CertificateAuthority in the same project that was used to create a subordinate CertificateAuthority. This field is used for information and usability purposes only. The resource name is in the format `projects/*/locations/*/caPools/*/certificateAuthorities/*`.
+    &quot;certificateAuthority&quot;: &quot;A String&quot;, # Required. This can refer to a CertificateAuthority that was used to create a subordinate CertificateAuthority. This field is used for information and usability purposes only. The resource name is in the format `projects/*/locations/*/caPools/*/certificateAuthorities/*`.
     &quot;pemIssuerChain&quot;: { # This message describes a subordinate CA&#x27;s issuer certificate chain. This wrapper exists for compatibility reasons. # Required. Contains the PEM certificate chain for the issuers of this CertificateAuthority, but not pem certificate for this CA itself.
       &quot;pemCertificates&quot;: [ # Required. Expected to be in leaf-to-root order according to RFC 5246.
         &quot;A String&quot;,
@@ -862,7 +862,7 @@
   ],
   &quot;state&quot;: &quot;A String&quot;, # Output only. The State for this CertificateAuthority.
   &quot;subordinateConfig&quot;: { # Describes a subordinate CA&#x27;s issuers. This is either a resource name to a known issuing CertificateAuthority, or a PEM issuer certificate chain. # Optional. If this is a subordinate CertificateAuthority, this field will be set with the subordinate configuration, which describes its issuers. This may be updated, but this CertificateAuthority must continue to validate.
-    &quot;certificateAuthority&quot;: &quot;A String&quot;, # Required. This can refer to a CertificateAuthority in the same project that was used to create a subordinate CertificateAuthority. This field is used for information and usability purposes only. The resource name is in the format `projects/*/locations/*/caPools/*/certificateAuthorities/*`.
+    &quot;certificateAuthority&quot;: &quot;A String&quot;, # Required. This can refer to a CertificateAuthority that was used to create a subordinate CertificateAuthority. This field is used for information and usability purposes only. The resource name is in the format `projects/*/locations/*/caPools/*/certificateAuthorities/*`.
     &quot;pemIssuerChain&quot;: { # This message describes a subordinate CA&#x27;s issuer certificate chain. This wrapper exists for compatibility reasons. # Required. Contains the PEM certificate chain for the issuers of this CertificateAuthority, but not pem certificate for this CA itself.
       &quot;pemCertificates&quot;: [ # Required. Expected to be in leaf-to-root order according to RFC 5246.
         &quot;A String&quot;,
@@ -1137,7 +1137,7 @@
       ],
       &quot;state&quot;: &quot;A String&quot;, # Output only. The State for this CertificateAuthority.
       &quot;subordinateConfig&quot;: { # Describes a subordinate CA&#x27;s issuers. This is either a resource name to a known issuing CertificateAuthority, or a PEM issuer certificate chain. # Optional. If this is a subordinate CertificateAuthority, this field will be set with the subordinate configuration, which describes its issuers. This may be updated, but this CertificateAuthority must continue to validate.
-        &quot;certificateAuthority&quot;: &quot;A String&quot;, # Required. This can refer to a CertificateAuthority in the same project that was used to create a subordinate CertificateAuthority. This field is used for information and usability purposes only. The resource name is in the format `projects/*/locations/*/caPools/*/certificateAuthorities/*`.
+        &quot;certificateAuthority&quot;: &quot;A String&quot;, # Required. This can refer to a CertificateAuthority that was used to create a subordinate CertificateAuthority. This field is used for information and usability purposes only. The resource name is in the format `projects/*/locations/*/caPools/*/certificateAuthorities/*`.
         &quot;pemIssuerChain&quot;: { # This message describes a subordinate CA&#x27;s issuer certificate chain. This wrapper exists for compatibility reasons. # Required. Contains the PEM certificate chain for the issuers of this CertificateAuthority, but not pem certificate for this CA itself.
           &quot;pemCertificates&quot;: [ # Required. Expected to be in leaf-to-root order according to RFC 5246.
             &quot;A String&quot;,
@@ -1421,7 +1421,7 @@
   ],
   &quot;state&quot;: &quot;A String&quot;, # Output only. The State for this CertificateAuthority.
   &quot;subordinateConfig&quot;: { # Describes a subordinate CA&#x27;s issuers. This is either a resource name to a known issuing CertificateAuthority, or a PEM issuer certificate chain. # Optional. If this is a subordinate CertificateAuthority, this field will be set with the subordinate configuration, which describes its issuers. This may be updated, but this CertificateAuthority must continue to validate.
-    &quot;certificateAuthority&quot;: &quot;A String&quot;, # Required. This can refer to a CertificateAuthority in the same project that was used to create a subordinate CertificateAuthority. This field is used for information and usability purposes only. The resource name is in the format `projects/*/locations/*/caPools/*/certificateAuthorities/*`.
+    &quot;certificateAuthority&quot;: &quot;A String&quot;, # Required. This can refer to a CertificateAuthority that was used to create a subordinate CertificateAuthority. This field is used for information and usability purposes only. The resource name is in the format `projects/*/locations/*/caPools/*/certificateAuthorities/*`.
     &quot;pemIssuerChain&quot;: { # This message describes a subordinate CA&#x27;s issuer certificate chain. This wrapper exists for compatibility reasons. # Required. Contains the PEM certificate chain for the issuers of this CertificateAuthority, but not pem certificate for this CA itself.
       &quot;pemCertificates&quot;: [ # Required. Expected to be in leaf-to-root order according to RFC 5246.
         &quot;A String&quot;,
diff --git a/docs/dyn/retail_v2.projects.locations.catalogs.branches.products.html b/docs/dyn/retail_v2.projects.locations.catalogs.branches.products.html
index de0c0c8..ace244d 100644
--- a/docs/dyn/retail_v2.projects.locations.catalogs.branches.products.html
+++ b/docs/dyn/retail_v2.projects.locations.catalogs.branches.products.html
@@ -76,7 +76,7 @@
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="#addFulfillmentPlaces">addFulfillmentPlaces(product, body=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Incrementally adds place IDs to Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the added place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.</p>
+<p class="firstline">Incrementally adds place IDs to Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the added place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.</p>
 <p class="toc_element">
   <code><a href="#close">close()</a></code></p>
 <p class="firstline">Close httplib2 connections.</p>
@@ -103,14 +103,14 @@
 <p class="firstline">Updates a Product.</p>
 <p class="toc_element">
   <code><a href="#removeFulfillmentPlaces">removeFulfillmentPlaces(product, body=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Incrementally removes place IDs from a Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the removed place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.</p>
+<p class="firstline">Incrementally removes place IDs from a Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the removed place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.</p>
 <p class="toc_element">
   <code><a href="#setInventory">setInventory(name, body=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Updates inventory information for a Product while respecting the last update timestamps of each inventory field. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, updates are not immediately manifested in the Product queried by GetProduct or ListProducts. When inventory is updated with CreateProduct and UpdateProduct, the specified inventory field value(s) will overwrite any existing value(s) while ignoring the last update time for this field. Furthermore, the last update time for the specified inventory fields will be overwritten to the time of the CreateProduct or UpdateProduct request. If no inventory fields are set in CreateProductRequest.product, then any pre-existing inventory information for this product will be used. If no inventory fields are set in UpdateProductRequest.set_mask, then any existing inventory information will be preserved. Pre-existing inventory information can only be updated with SetInventory, AddFulfillmentPlaces, and RemoveFulfillmentPlaces. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.</p>
+<p class="firstline">Updates inventory information for a Product while respecting the last update timestamps of each inventory field. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, updates are not immediately manifested in the Product queried by GetProduct or ListProducts. When inventory is updated with CreateProduct and UpdateProduct, the specified inventory field value(s) will overwrite any existing value(s) while ignoring the last update time for this field. Furthermore, the last update time for the specified inventory fields will be overwritten to the time of the CreateProduct or UpdateProduct request. If no inventory fields are set in CreateProductRequest.product, then any pre-existing inventory information for this product will be used. If no inventory fields are set in UpdateProductRequest.set_mask, then any existing inventory information will be preserved. Pre-existing inventory information can only be updated with SetInventory, AddFulfillmentPlaces, and RemoveFulfillmentPlaces. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.</p>
 <h3>Method Details</h3>
 <div class="method">
     <code class="details" id="addFulfillmentPlaces">addFulfillmentPlaces(product, body=None, x__xgafv=None)</code>
-  <pre>Incrementally adds place IDs to Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the added place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.
+  <pre>Incrementally adds place IDs to Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the added place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.
 
 Args:
   product: string, Required. Full resource name of Product, such as `projects/*/locations/global/catalogs/default_catalog/branches/default_branch/products/some_product_id`. If the caller does not have permission to access the Product, regardless of whether or not it exists, a PERMISSION_DENIED error is returned. (required)
@@ -276,7 +276,7 @@
       42,
     ],
   },
-  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
   &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
     &quot;A String&quot;,
   ],
@@ -408,7 +408,7 @@
       42,
     ],
   },
-  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
   &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
     &quot;A String&quot;,
   ],
@@ -564,7 +564,7 @@
       42,
     ],
   },
-  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
   &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
     &quot;A String&quot;,
   ],
@@ -722,7 +722,7 @@
               42,
             ],
           },
-          &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+          &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
           &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
             &quot;A String&quot;,
           ],
@@ -903,7 +903,7 @@
           42,
         ],
       },
-      &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+      &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
       &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
         &quot;A String&quot;,
       ],
@@ -1052,7 +1052,7 @@
       42,
     ],
   },
-  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
   &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
     &quot;A String&quot;,
   ],
@@ -1185,7 +1185,7 @@
       42,
     ],
   },
-  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
   &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
     &quot;A String&quot;,
   ],
@@ -1204,7 +1204,7 @@
 
 <div class="method">
     <code class="details" id="removeFulfillmentPlaces">removeFulfillmentPlaces(product, body=None, x__xgafv=None)</code>
-  <pre>Incrementally removes place IDs from a Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the removed place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.
+  <pre>Incrementally removes place IDs from a Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the removed place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.
 
 Args:
   product: string, Required. Full resource name of Product, such as `projects/*/locations/global/catalogs/default_catalog/branches/default_branch/products/some_product_id`. If the caller does not have permission to access the Product, regardless of whether or not it exists, a PERMISSION_DENIED error is returned. (required)
@@ -1251,7 +1251,7 @@
 
 <div class="method">
     <code class="details" id="setInventory">setInventory(name, body=None, x__xgafv=None)</code>
-  <pre>Updates inventory information for a Product while respecting the last update timestamps of each inventory field. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, updates are not immediately manifested in the Product queried by GetProduct or ListProducts. When inventory is updated with CreateProduct and UpdateProduct, the specified inventory field value(s) will overwrite any existing value(s) while ignoring the last update time for this field. Furthermore, the last update time for the specified inventory fields will be overwritten to the time of the CreateProduct or UpdateProduct request. If no inventory fields are set in CreateProductRequest.product, then any pre-existing inventory information for this product will be used. If no inventory fields are set in UpdateProductRequest.set_mask, then any existing inventory information will be preserved. Pre-existing inventory information can only be updated with SetInventory, AddFulfillmentPlaces, and RemoveFulfillmentPlaces. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.
+  <pre>Updates inventory information for a Product while respecting the last update timestamps of each inventory field. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, updates are not immediately manifested in the Product queried by GetProduct or ListProducts. When inventory is updated with CreateProduct and UpdateProduct, the specified inventory field value(s) will overwrite any existing value(s) while ignoring the last update time for this field. Furthermore, the last update time for the specified inventory fields will be overwritten to the time of the CreateProduct or UpdateProduct request. If no inventory fields are set in CreateProductRequest.product, then any pre-existing inventory information for this product will be used. If no inventory fields are set in UpdateProductRequest.set_mask, then any existing inventory information will be preserved. Pre-existing inventory information can only be updated with SetInventory, AddFulfillmentPlaces, and RemoveFulfillmentPlaces. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.
 
 Args:
   name: string, Immutable. Full resource name of the product, such as `projects/*/locations/global/catalogs/default_catalog/branches/default_branch/products/product_id`. The branch ID must be &quot;default_branch&quot;. (required)
@@ -1367,7 +1367,7 @@
         42,
       ],
     },
-    &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+    &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
     &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
       &quot;A String&quot;,
     ],
diff --git a/docs/dyn/retail_v2.projects.locations.catalogs.completionData.html b/docs/dyn/retail_v2.projects.locations.catalogs.completionData.html
index d550097..5ec5263 100644
--- a/docs/dyn/retail_v2.projects.locations.catalogs.completionData.html
+++ b/docs/dyn/retail_v2.projects.locations.catalogs.completionData.html
@@ -79,7 +79,7 @@
 <p class="firstline">Close httplib2 connections.</p>
 <p class="toc_element">
   <code><a href="#import_">import_(parent, body=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Bulk import of processed completion dataset. Request processing may be synchronous. Partial updating is not supported. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.</p>
+<p class="firstline">Bulk import of processed completion dataset. Request processing may be synchronous. Partial updating is not supported. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.</p>
 <h3>Method Details</h3>
 <div class="method">
     <code class="details" id="close">close()</code>
@@ -88,7 +88,7 @@
 
 <div class="method">
     <code class="details" id="import_">import_(parent, body=None, x__xgafv=None)</code>
-  <pre>Bulk import of processed completion dataset. Request processing may be synchronous. Partial updating is not supported. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.
+  <pre>Bulk import of processed completion dataset. Request processing may be synchronous. Partial updating is not supported. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.
 
 Args:
   parent: string, Required. The catalog which the suggestions dataset belongs to. Format: `projects/1234/locations/global/catalogs/default_catalog`. (required)
@@ -97,7 +97,7 @@
 
 { # Request message for ImportCompletionData methods.
   &quot;inputConfig&quot;: { # The input config source for completion data. # Required. The desired input location of the data.
-    &quot;bigQuerySource&quot;: { # BigQuery source import data from. # Required. BigQuery input source. Add the IAM permission “BigQuery Data Viewer” for cloud-retail-customer-data-access@system.gserviceaccount.com before using this feature otherwise an error is thrown.
+    &quot;bigQuerySource&quot;: { # BigQuery source import data from. # Required. BigQuery input source. Add the IAM permission &quot;BigQuery Data Viewer&quot; for cloud-retail-customer-data-access@system.gserviceaccount.com before using this feature otherwise an error is thrown.
       &quot;dataSchema&quot;: &quot;A String&quot;, # The schema to use when parsing the data from the source. Supported values for product imports: * `product` (default): One JSON Product per line. Each product must have a valid Product.id. * `product_merchant_center`: See [Importing catalog data from Merchant Center](https://cloud.google.com/retail/recommendations-ai/docs/upload-catalog#mc). Supported values for user events imports: * `user_event` (default): One JSON UserEvent per line. * `user_event_ga360`: Using https://support.google.com/analytics/answer/3437719.
       &quot;datasetId&quot;: &quot;A String&quot;, # Required. The BigQuery data set to copy the data from with a length limit of 1,024 characters.
       &quot;gcsStagingDir&quot;: &quot;A String&quot;, # Intermediate Cloud Storage directory used for the import with a length limit of 2,000 characters. Can be specified if one wants to have the BigQuery export to a specific Cloud Storage directory.
diff --git a/docs/dyn/retail_v2.projects.locations.catalogs.html b/docs/dyn/retail_v2.projects.locations.catalogs.html
index 5b7a9fe..89c1d0b 100644
--- a/docs/dyn/retail_v2.projects.locations.catalogs.html
+++ b/docs/dyn/retail_v2.projects.locations.catalogs.html
@@ -104,10 +104,10 @@
 <p class="firstline">Close httplib2 connections.</p>
 <p class="toc_element">
   <code><a href="#completeQuery">completeQuery(catalog, dataset=None, deviceType=None, languageCodes=None, maxSuggestions=None, query=None, visitorId=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Completes the specified prefix with keyword suggestions. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.</p>
+<p class="firstline">Completes the specified prefix with keyword suggestions. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.</p>
 <p class="toc_element">
   <code><a href="#getDefaultBranch">getDefaultBranch(catalog, x__xgafv=None)</a></code></p>
-<p class="firstline">Get which branch is currently default branch set by CatalogService.SetDefaultBranch method under a specified parent catalog. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.</p>
+<p class="firstline">Get which branch is currently default branch set by CatalogService.SetDefaultBranch method under a specified parent catalog. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.</p>
 <p class="toc_element">
   <code><a href="#list">list(parent, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Lists all the Catalogs associated with the project.</p>
@@ -119,7 +119,7 @@
 <p class="firstline">Updates the Catalogs.</p>
 <p class="toc_element">
   <code><a href="#setDefaultBranch">setDefaultBranch(catalog, body=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Set a specified branch id as default branch. API methods such as SearchService.Search, ProductService.GetProduct, ProductService.ListProducts will treat requests using "default_branch" to the actual branch id set as default. For example, if `projects/*/locations/*/catalogs/*/branches/1` is set as default, setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/default_branch` is equivalent to setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/1`. Using multiple branches can be useful when developers would like to have a staging branch to test and verify for future usage. When it becomes ready, developers switch on the staging branch using this API while keeping using `projects/*/locations/*/catalogs/*/branches/default_branch` as SearchRequest.branch to route the traffic to this staging branch. CAUTION: If you have live predict/search traffic, switching the default branch could potentially cause outages if the ID space of the new branch is very different from the old one. More specifically: * PredictionService will only return product IDs from branch {newBranch}. * SearchService will only return product IDs from branch {newBranch} (if branch is not explicitly set). * UserEventService will only join events with products from branch {newBranch}. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.</p>
+<p class="firstline">Set a specified branch id as default branch. API methods such as SearchService.Search, ProductService.GetProduct, ProductService.ListProducts will treat requests using "default_branch" to the actual branch id set as default. For example, if `projects/*/locations/*/catalogs/*/branches/1` is set as default, setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/default_branch` is equivalent to setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/1`. Using multiple branches can be useful when developers would like to have a staging branch to test and verify for future usage. When it becomes ready, developers switch on the staging branch using this API while keeping using `projects/*/locations/*/catalogs/*/branches/default_branch` as SearchRequest.branch to route the traffic to this staging branch. CAUTION: If you have live predict/search traffic, switching the default branch could potentially cause outages if the ID space of the new branch is very different from the old one. More specifically: * PredictionService will only return product IDs from branch {newBranch}. * SearchService will only return product IDs from branch {newBranch} (if branch is not explicitly set). * UserEventService will only join events with products from branch {newBranch}. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.</p>
 <h3>Method Details</h3>
 <div class="method">
     <code class="details" id="close">close()</code>
@@ -128,14 +128,14 @@
 
 <div class="method">
     <code class="details" id="completeQuery">completeQuery(catalog, dataset=None, deviceType=None, languageCodes=None, maxSuggestions=None, query=None, visitorId=None, x__xgafv=None)</code>
-  <pre>Completes the specified prefix with keyword suggestions. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.
+  <pre>Completes the specified prefix with keyword suggestions. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.
 
 Args:
   catalog: string, Required. Catalog for which the completion is performed. Full resource name of catalog, such as `projects/*/locations/global/catalogs/default_catalog`. (required)
-  dataset: string, Determines which dataset to use for fetching completion. &quot;user-data&quot; will use the imported dataset through ImportCompletionData. &quot;cloud-retail&quot; will use the dataset generated by cloud retail based on user events. If leave empty, it will use the &quot;user-data&quot;. Current supported values: * user-data * cloud-retail This option is not automatically enabled. Before using cloud-retail, contact retail-search-support@google.com first.
+  dataset: string, Determines which dataset to use for fetching completion. &quot;user-data&quot; will use the imported dataset through CompletionService.ImportCompletionData. &quot;cloud-retail&quot; will use the dataset generated by cloud retail based on user events. If leave empty, it will use the &quot;user-data&quot;. Current supported values: * user-data * cloud-retail This option requires additional allowlisting. Before using cloud-retail, contact Cloud Retail support team first.
   deviceType: string, The device type context for completion suggestions. It is useful to apply different suggestions on different device types, e.g. DESKTOP, MOBILE. If it is empty, the suggestions are across all device types. Supported formats: * UNKNOWN_DEVICE_TYPE * DESKTOP * MOBILE * A customized string starts with OTHER_, e.g. OTHER_IPHONE.
   languageCodes: string, The list of languages of the query. This is the BCP-47 language code, such as &quot;en-US&quot; or &quot;sr-Latn&quot;. For more information, see [Tags for Identifying Languages](https://tools.ietf.org/html/bcp47). The maximum number of allowed characters is 255. Only &quot;en-US&quot; is currently supported. (repeated)
-  maxSuggestions: integer, Completion max suggestions. The maximum allowed max suggestions is 20. The default value is 20.
+  maxSuggestions: integer, Completion max suggestions. If left unset or set to 0, then will fallback to the configured value CompletionConfig.max_suggestions. The maximum allowed max suggestions is 20. If it is set higher, it will be capped by 20.
   query: string, Required. The query used to generate suggestions. The maximum number of allowed characters is 255.
   visitorId: string, A unique identifier for tracking visitors. For example, this could be implemented with an HTTP cookie, which should be able to uniquely identify a visitor on a single device. This unique identifier should not change if the visitor logs in or out of the website. The field must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned.
   x__xgafv: string, V1 error format.
@@ -165,7 +165,7 @@
       &quot;suggestion&quot;: &quot;A String&quot;, # The suggestion for the query.
     },
   ],
-  &quot;recentSearchResults&quot;: [ # Matched recent searches of this user. This field is a restricted feature. Contact Retail Support (retail-search-support@google.com) if you are interested in enabling it. This feature is only available when CompleteQueryRequest.visitor_id field is set and UserEvent is imported. The recent searches satisfy the follow rules: * They are ordered from latest to oldest. * They are matched with CompleteQueryRequest.query case insensitively. * They are transformed to lower cases. * They are UTF-8 safe. Recent searches are deduplicated. More recent searches will be reserved when duplication happens.
+  &quot;recentSearchResults&quot;: [ # Matched recent searches of this user. This field is a restricted feature. Contact Retail Search support team if you are interested in enabling it. This feature is only available when CompleteQueryRequest.visitor_id field is set and UserEvent is imported. The recent searches satisfy the follow rules: * They are ordered from latest to oldest. * They are matched with CompleteQueryRequest.query case insensitively. * They are transformed to lower cases. * They are UTF-8 safe. Recent searches are deduplicated. More recent searches will be reserved when duplication happens.
     { # Recent search of this user.
       &quot;recentSearch&quot;: &quot;A String&quot;, # The recent search query.
     },
@@ -175,7 +175,7 @@
 
 <div class="method">
     <code class="details" id="getDefaultBranch">getDefaultBranch(catalog, x__xgafv=None)</code>
-  <pre>Get which branch is currently default branch set by CatalogService.SetDefaultBranch method under a specified parent catalog. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.
+  <pre>Get which branch is currently default branch set by CatalogService.SetDefaultBranch method under a specified parent catalog. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.
 
 Args:
   catalog: string, The parent catalog resource name, such as `projects/*/locations/global/catalogs/default_catalog`. (required)
@@ -278,7 +278,7 @@
 
 <div class="method">
     <code class="details" id="setDefaultBranch">setDefaultBranch(catalog, body=None, x__xgafv=None)</code>
-  <pre>Set a specified branch id as default branch. API methods such as SearchService.Search, ProductService.GetProduct, ProductService.ListProducts will treat requests using &quot;default_branch&quot; to the actual branch id set as default. For example, if `projects/*/locations/*/catalogs/*/branches/1` is set as default, setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/default_branch` is equivalent to setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/1`. Using multiple branches can be useful when developers would like to have a staging branch to test and verify for future usage. When it becomes ready, developers switch on the staging branch using this API while keeping using `projects/*/locations/*/catalogs/*/branches/default_branch` as SearchRequest.branch to route the traffic to this staging branch. CAUTION: If you have live predict/search traffic, switching the default branch could potentially cause outages if the ID space of the new branch is very different from the old one. More specifically: * PredictionService will only return product IDs from branch {newBranch}. * SearchService will only return product IDs from branch {newBranch} (if branch is not explicitly set). * UserEventService will only join events with products from branch {newBranch}. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.
+  <pre>Set a specified branch id as default branch. API methods such as SearchService.Search, ProductService.GetProduct, ProductService.ListProducts will treat requests using &quot;default_branch&quot; to the actual branch id set as default. For example, if `projects/*/locations/*/catalogs/*/branches/1` is set as default, setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/default_branch` is equivalent to setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/1`. Using multiple branches can be useful when developers would like to have a staging branch to test and verify for future usage. When it becomes ready, developers switch on the staging branch using this API while keeping using `projects/*/locations/*/catalogs/*/branches/default_branch` as SearchRequest.branch to route the traffic to this staging branch. CAUTION: If you have live predict/search traffic, switching the default branch could potentially cause outages if the ID space of the new branch is very different from the old one. More specifically: * PredictionService will only return product IDs from branch {newBranch}. * SearchService will only return product IDs from branch {newBranch} (if branch is not explicitly set). * UserEventService will only join events with products from branch {newBranch}. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.
 
 Args:
   catalog: string, Full resource name of the catalog, such as `projects/*/locations/global/catalogs/default_catalog`. (required)
diff --git a/docs/dyn/retail_v2.projects.locations.catalogs.placements.html b/docs/dyn/retail_v2.projects.locations.catalogs.placements.html
index d9258cd..b5a2d29 100644
--- a/docs/dyn/retail_v2.projects.locations.catalogs.placements.html
+++ b/docs/dyn/retail_v2.projects.locations.catalogs.placements.html
@@ -82,7 +82,7 @@
 <p class="firstline">Makes a recommendation prediction.</p>
 <p class="toc_element">
   <code><a href="#search">search(placement, body=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Performs a search. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.</p>
+<p class="firstline">Performs a search. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.</p>
 <p class="toc_element">
   <code><a href="#search_next">search_next(previous_request, previous_response)</a></code></p>
 <p class="firstline">Retrieves the next page of results.</p>
@@ -145,7 +145,7 @@
     &quot;pageViewId&quot;: &quot;A String&quot;, # A unique id of a web page view. This should be kept the same for all user events triggered from the same pageview. For example, an item detail page view could trigger multiple events as the user is browsing the page. The `pageViewId` property should be kept the same for all these events so that they can be grouped together properly. When using the client side event reporting with JavaScript pixel and Google Tag Manager, this value is filled in automatically.
     &quot;productDetails&quot;: [ # The main product details related to the event. This field is required for the following event types: * `add-to-cart` * `detail-page-view` * `purchase-complete` In a `search` event, this field represents the products returned to the end user on the current page (the end user may have not finished broswing the whole page yet). When a new page is returned to the end user, after pagination/filtering/ordering even for the same query, a new `search` event with different product_details is desired. The end user may have not finished broswing the whole page yet.
       { # Detailed product information associated with a user event.
-        &quot;product&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. Product information. Only Product.id field is used when ingesting an event, all other product fields are ignored as we will look them up from the catalog.
+        &quot;product&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. Product information. Required field(s): * Product.id Optional override field(s): * Product.price_info If any supported optional fields are provided, we will treat them as a full override when looking up product information from the catalog. Thus, it is important to ensure that the overriding fields are accurate and complete. All other product fields are ignored and instead populated via catalog lookup after event ingestion.
           &quot;attributes&quot;: { # Highly encouraged. Extra product attributes to be included. For example, for products, this could include the store name, vendor, style, color, etc. These are very strong signals for recommendation model, thus we highly recommend providing the attributes here. Features that can take on one of a limited number of possible values. Two types of features can be set are: Textual features. some examples would be the brand/maker of a product, or country of a customer. Numerical features. Some examples would be the height/weight of a product, or age of a customer. For example: `{ &quot;vendor&quot;: {&quot;text&quot;: [&quot;vendor123&quot;, &quot;vendor456&quot;]}, &quot;lengths_cm&quot;: {&quot;numbers&quot;:[2.3, 15.4]}, &quot;heights_cm&quot;: {&quot;numbers&quot;:[8.1, 6.4]} }`. This field needs to pass all below criteria, otherwise an INVALID_ARGUMENT error is returned: * Max entries count: 200 by default; 100 for Type.VARIANT. * The key must be a UTF-8 encoded string with a length limit of 128 characters. * Max indexable entries count: 200 by default; 40 for Type.VARIANT. * Max searchable entries count: 30. * For indexable attribute, the key must match the pattern: a-zA-Z0-9*. For example, key0LikeThis or KEY_1_LIKE_THIS.
             &quot;a_key&quot;: { # A custom attribute that is not explicitly modeled in Product.
               &quot;indexable&quot;: True or False, # If true, custom attribute values are indexed, so that it can be filtered, faceted or boosted in SearchService.Search. This field is ignored in a UserEvent. See SearchRequest.filter, SearchRequest.facet_specs and SearchRequest.boost_spec for more details.
@@ -252,7 +252,7 @@
               42,
             ],
           },
-          &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+          &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
           &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
             &quot;A String&quot;,
           ],
@@ -319,7 +319,7 @@
 
 <div class="method">
     <code class="details" id="search">search(placement, body=None, x__xgafv=None)</code>
-  <pre>Performs a search. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.
+  <pre>Performs a search. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.
 
 Args:
   placement: string, Required. The resource name of the search engine placement, such as `projects/*/locations/global/catalogs/default_catalog/placements/default_search`. This field is used to identify the set of models that will be used to make the search. We currently support one placement with the following ID: * `default_search`. (required)
@@ -337,7 +337,7 @@
   },
   &quot;branch&quot;: &quot;A String&quot;, # The branch resource name, such as `projects/*/locations/global/catalogs/default_catalog/branches/0`. Use &quot;default_branch&quot; as the branch ID or leave this field empty, to search products under the default branch.
   &quot;canonicalFilter&quot;: &quot;A String&quot;, # The filter applied to every search request when quality improvement such as query expansion is needed. For example, if a query does not have enough results, an expanded query with SearchRequest.canonical_filter will be returned as a supplement of the original query. This field is strongly recommended to achieve high search quality. See SearchRequest.filter for more details about filter syntax.
-  &quot;dynamicFacetSpec&quot;: { # The specifications of dynamically generated facets. # The specification for dynamically generated facets. Notice that only textual facets can be dynamically generated. This feature requires additional allowlisting. Contact Retail Support (retail-search-support@google.com) if you are interested in using dynamic facet feature.
+  &quot;dynamicFacetSpec&quot;: { # The specifications of dynamically generated facets. # The specification for dynamically generated facets. Notice that only textual facets can be dynamically generated. This feature requires additional allowlisting. Contact Retail Search support team if you are interested in using dynamic facet feature.
     &quot;mode&quot;: &quot;A String&quot;, # Mode of the DynamicFacet feature. Defaults to Mode.DISABLED if it&#x27;s unset.
   },
   &quot;facetSpecs&quot;: [ # Facet specifications for faceted search. If empty, no facets are returned. A maximum of 100 values are allowed. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -358,8 +358,8 @@
             &quot;minimum&quot;: 3.14, # Inclusive lower bound.
           },
         ],
-        &quot;key&quot;: &quot;A String&quot;, # Required. Supported textual and numerical facet keys in Product object, over which the facet values are computed. Facet key is case-sensitive. Allowed facet keys when FacetKey.query is not specified: * textual_field = *# The Product.brands. * &quot;brands&quot;; *# The Product.categories. * &quot;categories&quot;; *# The Audience.genders. * | &quot;genders&quot;; *# The Audience.age_groups. * | &quot;ageGroups&quot;; *# The Product.availability. Value is one of * *# &quot;IN_STOCK&quot;, &quot;OUT_OF_STOCK&quot;, PREORDER&quot;, &quot;BACKORDER&quot;. * | &quot;availability&quot;; *# The ColorInfo.color_families. * | &quot;colorFamilies&quot;; *# The ColorInfo.colors. * | &quot;colors&quot;; *# The Product.sizes. * | &quot;sizes&quot;; *# The Product.materials. * | &quot;materials&quot;; *# The Product.patterns. * | &quot;patterns&quot;; *# The Product.conditions. * | &quot;conditions&quot;; *# The textual custom attribute in Product object. Key can * *# be any key in the Product.attributes map * *# if the attribute values are textual. * *# map. * | &quot;attributes.key&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.PICKUP_IN_STORE. * | &quot;pickupInStore&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.SHIP_TO_STORE. * | &quot;shipToStore&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.SAME_DAY_DELIVERY. * | &quot;sameDayDelivery&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.NEXT_DAY_DELIVERY. * | &quot;nextDayDelivery&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_1. * | &quot;customFulfillment1&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_2. * | &quot;customFulfillment2&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_3. * | &quot;customFulfillment3&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_4. * | &quot;customFulfillment4&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_5. * | &quot;customFulfillment5&quot;; * numerical_field = *# The PriceInfo.price. * &quot;price&quot;; *# The discount. Computed by (original_price-price)/price * &quot;discount&quot;; *# The Rating.average_rating. * &quot;rating&quot;; *# The Rating.rating_count. * &quot;ratingCount&quot;; *# The numerical custom attribute in Product object. Key can * *# be any key in the Product.attributes map * *# if the attribute values are numerical. * | &quot;attributes.key&quot;;
-        &quot;orderBy&quot;: &quot;A String&quot;, # The order in which Facet.values are returned. Allowed values are: * &quot;count desc&quot;, which means order by Facet.FacetValue.count descending. * &quot;value desc&quot;, which means order by Facet.FacetValue.value descending. Only applies to textual facets. If not set, textual values are sorted in [natural order](https://en.wikipedia.org/wiki/Natural_sort_order); numerical intervals are sorted in the order given by FacetSpec.FacetKey.intervals; FulfillmentInfo.ids are sorted in the order given by FacetSpec.FacetKey.restricted_values.
+        &quot;key&quot;: &quot;A String&quot;, # Required. Supported textual and numerical facet keys in Product object, over which the facet values are computed. Facet key is case-sensitive. Allowed facet keys when FacetKey.query is not specified: * textual_field = *# The Product.brands. * | &quot;brands&quot;; *# The Product.categories. * | &quot;categories&quot;; *# The Audience.genders. * | &quot;genders&quot;; *# The Audience.age_groups. * | &quot;ageGroups&quot;; *# The Product.availability. Value is one of * *# &quot;IN_STOCK&quot;, &quot;OUT_OF_STOCK&quot;, PREORDER&quot;, &quot;BACKORDER&quot;. * | &quot;availability&quot;; *# The ColorInfo.color_families. * | &quot;colorFamilies&quot;; *# The ColorInfo.colors. * | &quot;colors&quot;; *# The Product.sizes. * | &quot;sizes&quot;; *# The Product.materials. * | &quot;materials&quot;; *# The Product.patterns. * | &quot;patterns&quot;; *# The Product.conditions. * | &quot;conditions&quot;; *# The textual custom attribute in Product object. Key can * *# be any key in the Product.attributes map * *# if the attribute values are textual. * | &quot;attributes.key&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;pickup-in-store&quot;. * | &quot;pickupInStore&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;ship-to-store&quot;. * | &quot;shipToStore&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;same-day-delivery&quot;. * | &quot;sameDayDelivery&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;next-day-delivery&quot;. * | &quot;nextDayDelivery&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;custom-type-1&quot;. * | &quot;customFulfillment1&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;custom-type-2&quot;. * | &quot;customFulfillment2&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;custom-type-3&quot;. * | &quot;customFulfillment3&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;custom-type-4&quot;. * | &quot;customFulfillment4&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;custom-type-5&quot;. * | &quot;customFulfillment5&quot;; * numerical_field = *# The PriceInfo.price. * | &quot;price&quot;; *# The discount. Computed by (original_price-price)/price * | &quot;discount&quot;; *# The Rating.average_rating. * | &quot;rating&quot;; *# The Rating.rating_count. * | &quot;ratingCount&quot;; *# The numerical custom attribute in Product object. Key can * *# be any key in the Product.attributes map * *# if the attribute values are numerical. * | &quot;attributes.key&quot;;
+        &quot;orderBy&quot;: &quot;A String&quot;, # The order in which Facet.values are returned. Allowed values are: * &quot;count desc&quot;, which means order by Facet.FacetValue.count descending. * &quot;value desc&quot;, which means order by Facet.FacetValue.value descending. Only applies to textual facets. If not set, textual values are sorted in [natural order](https://en.wikipedia.org/wiki/Natural_sort_order); numerical intervals are sorted in the order given by FacetSpec.FacetKey.intervals; FulfillmentInfo.place_ids are sorted in the order given by FacetSpec.FacetKey.restricted_values.
         &quot;prefixes&quot;: [ # Only get facet values that start with the given string prefix. For example, suppose &quot;categories&quot; has three values &quot;Women &gt; Shoe&quot;, &quot;Women &gt; Dress&quot; and &quot;Men &gt; Shoe&quot;. If set &quot;prefixes&quot; to &quot;Women&quot;, the &quot;categories&quot; facet will give only &quot;Women &gt; Shoe&quot; and &quot;Women &gt; Dress&quot;. Only supported on textual fields. Maximum is 10.
           &quot;A String&quot;,
         ],
@@ -389,7 +389,7 @@
     &quot;userAgent&quot;: &quot;A String&quot;, # User agent as included in the HTTP header. Required for getting SearchResponse.sponsored_results. The field must be a UTF-8 encoded string with a length limit of 1,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. This should not be set when using the client side event reporting with GTM or JavaScript tag in UserEventService.CollectUserEvent or if direct_user_request is set.
     &quot;userId&quot;: &quot;A String&quot;, # Highly recommended for logged-in users. Unique identifier for logged-in user, such as a user name. The field must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned.
   },
-  &quot;variantRollupKeys&quot;: [ # The keys to fetch and rollup the matching variant Products attributes. The attributes from all the matching variant Products are merged and de-duplicated. Notice that rollup variant Products attributes will lead to extra query latency. Maximum number of keys is 10. For Product.fulfillment_info, a fulfillment type and a fulfillment ID must be provided in the format of &quot;fulfillmentType.filfillmentId&quot;. E.g., in &quot;pickupInStore.store123&quot;, &quot;pickupInStore&quot; is fulfillment type and &quot;store123&quot; is the store ID. Supported keys are: * colorFamilies * price * originalPrice * discount * attributes.key, where key is any key in the Product.attributes map. * pickupInStore.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.PICKUP_IN_STORE. * shipToStore.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.SHIP_TO_STORE. * sameDayDelivery.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.SAME_DAY_DELIVERY. * nextDayDelivery.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.NEXT_DAY_DELIVERY. * customFulfillment1.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_1. * customFulfillment2.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_2. * customFulfillment3.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_3. * customFulfillment4.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_4. * customFulfillment5.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_5. If this field is set to an invalid value other than these, an INVALID_ARGUMENT error is returned.
+  &quot;variantRollupKeys&quot;: [ # The keys to fetch and rollup the matching variant Products attributes. The attributes from all the matching variant Products are merged and de-duplicated. Notice that rollup variant Products attributes will lead to extra query latency. Maximum number of keys is 10. For FulfillmentInfo, a fulfillment type and a fulfillment ID must be provided in the format of &quot;fulfillmentType.fulfillmentId&quot;. E.g., in &quot;pickupInStore.store123&quot;, &quot;pickupInStore&quot; is fulfillment type and &quot;store123&quot; is the store ID. Supported keys are: * colorFamilies * price * originalPrice * discount * attributes.key, where key is any key in the Product.attributes map. * pickupInStore.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;pickup-in-store&quot;. * shipToStore.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;ship-to-store&quot;. * sameDayDelivery.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;same-day-delivery&quot;. * nextDayDelivery.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;next-day-delivery&quot;. * customFulfillment1.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;custom-type-1&quot;. * customFulfillment2.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;custom-type-2&quot;. * customFulfillment3.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;custom-type-3&quot;. * customFulfillment4.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;custom-type-4&quot;. * customFulfillment5.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;custom-type-5&quot;. If this field is set to an invalid value other than these, an INVALID_ARGUMENT error is returned.
     &quot;A String&quot;,
   ],
   &quot;visitorId&quot;: &quot;A String&quot;, # Required. A unique identifier for tracking visitors. For example, this could be implemented with an HTTP cookie, which should be able to uniquely identify a visitor on a single device. This unique identifier should not change if the visitor logs in or out of the website. The field must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -543,7 +543,7 @@
             42,
           ],
         },
-        &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+        &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
         &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
           &quot;A String&quot;,
         ],
@@ -558,7 +558,7 @@
           # Object with schema name: GoogleCloudRetailV2Product
         ],
       },
-      &quot;variantRollupValues&quot;: { # The rollup matching variant Product attributes. The key is one of the SearchRequest.variant_rollup_keys. The values are the merged and de-duplicated Product attributes. Notice that the rollup values are respect filter. For example, when filtering by &quot;colorFamilies:ANY(\&quot;red\&quot;)&quot; and rollup &quot;colorFamilies&quot;, only &quot;red&quot; is returned. For textual and numerical attributes, the rollup values is a list of string or double values with type google.protobuf.ListValue. For example, if there are two variants with colors &quot;red&quot; and &quot;blue&quot;, the rollup values are { key: &quot;colorFamilies&quot; value { list_value { values { string_value: &quot;red&quot; } values { string_value: &quot;blue&quot; } } } } For Product.fulfillment_info, the rollup values is a double value with type google.protobuf.Value. For example, {key: &quot;pickupInStore.store1&quot; value { number_value: 10 }} means a there are 10 variants in this product are available in the store &quot;store1&quot;.
+      &quot;variantRollupValues&quot;: { # The rollup matching variant Product attributes. The key is one of the SearchRequest.variant_rollup_keys. The values are the merged and de-duplicated Product attributes. Notice that the rollup values are respect filter. For example, when filtering by &quot;colorFamilies:ANY(\&quot;red\&quot;)&quot; and rollup &quot;colorFamilies&quot;, only &quot;red&quot; is returned. For textual and numerical attributes, the rollup values is a list of string or double values with type google.protobuf.ListValue. For example, if there are two variants with colors &quot;red&quot; and &quot;blue&quot;, the rollup values are { key: &quot;colorFamilies&quot; value { list_value { values { string_value: &quot;red&quot; } values { string_value: &quot;blue&quot; } } } } For FulfillmentInfo, the rollup values is a double value with type google.protobuf.Value. For example, {key: &quot;pickupInStore.store1&quot; value { number_value: 10 }} means a there are 10 variants in this product are available in the store &quot;store1&quot;.
         &quot;a_key&quot;: &quot;&quot;,
       },
     },
diff --git a/docs/dyn/retail_v2.projects.locations.catalogs.userEvents.html b/docs/dyn/retail_v2.projects.locations.catalogs.userEvents.html
index 7322345..8fcf354 100644
--- a/docs/dyn/retail_v2.projects.locations.catalogs.userEvents.html
+++ b/docs/dyn/retail_v2.projects.locations.catalogs.userEvents.html
@@ -194,7 +194,7 @@
           &quot;pageViewId&quot;: &quot;A String&quot;, # A unique id of a web page view. This should be kept the same for all user events triggered from the same pageview. For example, an item detail page view could trigger multiple events as the user is browsing the page. The `pageViewId` property should be kept the same for all these events so that they can be grouped together properly. When using the client side event reporting with JavaScript pixel and Google Tag Manager, this value is filled in automatically.
           &quot;productDetails&quot;: [ # The main product details related to the event. This field is required for the following event types: * `add-to-cart` * `detail-page-view` * `purchase-complete` In a `search` event, this field represents the products returned to the end user on the current page (the end user may have not finished broswing the whole page yet). When a new page is returned to the end user, after pagination/filtering/ordering even for the same query, a new `search` event with different product_details is desired. The end user may have not finished broswing the whole page yet.
             { # Detailed product information associated with a user event.
-              &quot;product&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. Product information. Only Product.id field is used when ingesting an event, all other product fields are ignored as we will look them up from the catalog.
+              &quot;product&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. Product information. Required field(s): * Product.id Optional override field(s): * Product.price_info If any supported optional fields are provided, we will treat them as a full override when looking up product information from the catalog. Thus, it is important to ensure that the overriding fields are accurate and complete. All other product fields are ignored and instead populated via catalog lookup after event ingestion.
                 &quot;attributes&quot;: { # Highly encouraged. Extra product attributes to be included. For example, for products, this could include the store name, vendor, style, color, etc. These are very strong signals for recommendation model, thus we highly recommend providing the attributes here. Features that can take on one of a limited number of possible values. Two types of features can be set are: Textual features. some examples would be the brand/maker of a product, or country of a customer. Numerical features. Some examples would be the height/weight of a product, or age of a customer. For example: `{ &quot;vendor&quot;: {&quot;text&quot;: [&quot;vendor123&quot;, &quot;vendor456&quot;]}, &quot;lengths_cm&quot;: {&quot;numbers&quot;:[2.3, 15.4]}, &quot;heights_cm&quot;: {&quot;numbers&quot;:[8.1, 6.4]} }`. This field needs to pass all below criteria, otherwise an INVALID_ARGUMENT error is returned: * Max entries count: 200 by default; 100 for Type.VARIANT. * The key must be a UTF-8 encoded string with a length limit of 128 characters. * Max indexable entries count: 200 by default; 40 for Type.VARIANT. * Max searchable entries count: 30. * For indexable attribute, the key must match the pattern: a-zA-Z0-9*. For example, key0LikeThis or KEY_1_LIKE_THIS.
                   &quot;a_key&quot;: { # A custom attribute that is not explicitly modeled in Product.
                     &quot;indexable&quot;: True or False, # If true, custom attribute values are indexed, so that it can be filtered, faceted or boosted in SearchService.Search. This field is ignored in a UserEvent. See SearchRequest.filter, SearchRequest.facet_specs and SearchRequest.boost_spec for more details.
@@ -301,7 +301,7 @@
                     42,
                   ],
                 },
-                &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+                &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
                 &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
                   &quot;A String&quot;,
                 ],
@@ -500,7 +500,7 @@
   &quot;pageViewId&quot;: &quot;A String&quot;, # A unique id of a web page view. This should be kept the same for all user events triggered from the same pageview. For example, an item detail page view could trigger multiple events as the user is browsing the page. The `pageViewId` property should be kept the same for all these events so that they can be grouped together properly. When using the client side event reporting with JavaScript pixel and Google Tag Manager, this value is filled in automatically.
   &quot;productDetails&quot;: [ # The main product details related to the event. This field is required for the following event types: * `add-to-cart` * `detail-page-view` * `purchase-complete` In a `search` event, this field represents the products returned to the end user on the current page (the end user may have not finished broswing the whole page yet). When a new page is returned to the end user, after pagination/filtering/ordering even for the same query, a new `search` event with different product_details is desired. The end user may have not finished broswing the whole page yet.
     { # Detailed product information associated with a user event.
-      &quot;product&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. Product information. Only Product.id field is used when ingesting an event, all other product fields are ignored as we will look them up from the catalog.
+      &quot;product&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. Product information. Required field(s): * Product.id Optional override field(s): * Product.price_info If any supported optional fields are provided, we will treat them as a full override when looking up product information from the catalog. Thus, it is important to ensure that the overriding fields are accurate and complete. All other product fields are ignored and instead populated via catalog lookup after event ingestion.
         &quot;attributes&quot;: { # Highly encouraged. Extra product attributes to be included. For example, for products, this could include the store name, vendor, style, color, etc. These are very strong signals for recommendation model, thus we highly recommend providing the attributes here. Features that can take on one of a limited number of possible values. Two types of features can be set are: Textual features. some examples would be the brand/maker of a product, or country of a customer. Numerical features. Some examples would be the height/weight of a product, or age of a customer. For example: `{ &quot;vendor&quot;: {&quot;text&quot;: [&quot;vendor123&quot;, &quot;vendor456&quot;]}, &quot;lengths_cm&quot;: {&quot;numbers&quot;:[2.3, 15.4]}, &quot;heights_cm&quot;: {&quot;numbers&quot;:[8.1, 6.4]} }`. This field needs to pass all below criteria, otherwise an INVALID_ARGUMENT error is returned: * Max entries count: 200 by default; 100 for Type.VARIANT. * The key must be a UTF-8 encoded string with a length limit of 128 characters. * Max indexable entries count: 200 by default; 40 for Type.VARIANT. * Max searchable entries count: 30. * For indexable attribute, the key must match the pattern: a-zA-Z0-9*. For example, key0LikeThis or KEY_1_LIKE_THIS.
           &quot;a_key&quot;: { # A custom attribute that is not explicitly modeled in Product.
             &quot;indexable&quot;: True or False, # If true, custom attribute values are indexed, so that it can be filtered, faceted or boosted in SearchService.Search. This field is ignored in a UserEvent. See SearchRequest.filter, SearchRequest.facet_specs and SearchRequest.boost_spec for more details.
@@ -607,7 +607,7 @@
             42,
           ],
         },
-        &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+        &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
         &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
           &quot;A String&quot;,
         ],
@@ -687,7 +687,7 @@
   &quot;pageViewId&quot;: &quot;A String&quot;, # A unique id of a web page view. This should be kept the same for all user events triggered from the same pageview. For example, an item detail page view could trigger multiple events as the user is browsing the page. The `pageViewId` property should be kept the same for all these events so that they can be grouped together properly. When using the client side event reporting with JavaScript pixel and Google Tag Manager, this value is filled in automatically.
   &quot;productDetails&quot;: [ # The main product details related to the event. This field is required for the following event types: * `add-to-cart` * `detail-page-view` * `purchase-complete` In a `search` event, this field represents the products returned to the end user on the current page (the end user may have not finished broswing the whole page yet). When a new page is returned to the end user, after pagination/filtering/ordering even for the same query, a new `search` event with different product_details is desired. The end user may have not finished broswing the whole page yet.
     { # Detailed product information associated with a user event.
-      &quot;product&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. Product information. Only Product.id field is used when ingesting an event, all other product fields are ignored as we will look them up from the catalog.
+      &quot;product&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. Product information. Required field(s): * Product.id Optional override field(s): * Product.price_info If any supported optional fields are provided, we will treat them as a full override when looking up product information from the catalog. Thus, it is important to ensure that the overriding fields are accurate and complete. All other product fields are ignored and instead populated via catalog lookup after event ingestion.
         &quot;attributes&quot;: { # Highly encouraged. Extra product attributes to be included. For example, for products, this could include the store name, vendor, style, color, etc. These are very strong signals for recommendation model, thus we highly recommend providing the attributes here. Features that can take on one of a limited number of possible values. Two types of features can be set are: Textual features. some examples would be the brand/maker of a product, or country of a customer. Numerical features. Some examples would be the height/weight of a product, or age of a customer. For example: `{ &quot;vendor&quot;: {&quot;text&quot;: [&quot;vendor123&quot;, &quot;vendor456&quot;]}, &quot;lengths_cm&quot;: {&quot;numbers&quot;:[2.3, 15.4]}, &quot;heights_cm&quot;: {&quot;numbers&quot;:[8.1, 6.4]} }`. This field needs to pass all below criteria, otherwise an INVALID_ARGUMENT error is returned: * Max entries count: 200 by default; 100 for Type.VARIANT. * The key must be a UTF-8 encoded string with a length limit of 128 characters. * Max indexable entries count: 200 by default; 40 for Type.VARIANT. * Max searchable entries count: 30. * For indexable attribute, the key must match the pattern: a-zA-Z0-9*. For example, key0LikeThis or KEY_1_LIKE_THIS.
           &quot;a_key&quot;: { # A custom attribute that is not explicitly modeled in Product.
             &quot;indexable&quot;: True or False, # If true, custom attribute values are indexed, so that it can be filtered, faceted or boosted in SearchService.Search. This field is ignored in a UserEvent. See SearchRequest.filter, SearchRequest.facet_specs and SearchRequest.boost_spec for more details.
@@ -794,7 +794,7 @@
             42,
           ],
         },
-        &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+        &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
         &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
           &quot;A String&quot;,
         ],
diff --git a/docs/dyn/retail_v2alpha.projects.locations.catalogs.branches.products.html b/docs/dyn/retail_v2alpha.projects.locations.catalogs.branches.products.html
index 8729e1c..e4c6910 100644
--- a/docs/dyn/retail_v2alpha.projects.locations.catalogs.branches.products.html
+++ b/docs/dyn/retail_v2alpha.projects.locations.catalogs.branches.products.html
@@ -76,7 +76,7 @@
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="#addFulfillmentPlaces">addFulfillmentPlaces(product, body=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Incrementally adds place IDs to Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the added place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.</p>
+<p class="firstline">Incrementally adds place IDs to Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the added place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.</p>
 <p class="toc_element">
   <code><a href="#close">close()</a></code></p>
 <p class="firstline">Close httplib2 connections.</p>
@@ -103,14 +103,14 @@
 <p class="firstline">Updates a Product.</p>
 <p class="toc_element">
   <code><a href="#removeFulfillmentPlaces">removeFulfillmentPlaces(product, body=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Incrementally removes place IDs from a Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the removed place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.</p>
+<p class="firstline">Incrementally removes place IDs from a Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the removed place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.</p>
 <p class="toc_element">
   <code><a href="#setInventory">setInventory(name, body=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Updates inventory information for a Product while respecting the last update timestamps of each inventory field. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, updates are not immediately manifested in the Product queried by GetProduct or ListProducts. When inventory is updated with CreateProduct and UpdateProduct, the specified inventory field value(s) will overwrite any existing value(s) while ignoring the last update time for this field. Furthermore, the last update time for the specified inventory fields will be overwritten to the time of the CreateProduct or UpdateProduct request. If no inventory fields are set in CreateProductRequest.product, then any pre-existing inventory information for this product will be used. If no inventory fields are set in UpdateProductRequest.set_mask, then any existing inventory information will be preserved. Pre-existing inventory information can only be updated with SetInventory, AddFulfillmentPlaces, and RemoveFulfillmentPlaces. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.</p>
+<p class="firstline">Updates inventory information for a Product while respecting the last update timestamps of each inventory field. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, updates are not immediately manifested in the Product queried by GetProduct or ListProducts. When inventory is updated with CreateProduct and UpdateProduct, the specified inventory field value(s) will overwrite any existing value(s) while ignoring the last update time for this field. Furthermore, the last update time for the specified inventory fields will be overwritten to the time of the CreateProduct or UpdateProduct request. If no inventory fields are set in CreateProductRequest.product, then any pre-existing inventory information for this product will be used. If no inventory fields are set in UpdateProductRequest.set_mask, then any existing inventory information will be preserved. Pre-existing inventory information can only be updated with SetInventory, AddFulfillmentPlaces, and RemoveFulfillmentPlaces. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.</p>
 <h3>Method Details</h3>
 <div class="method">
     <code class="details" id="addFulfillmentPlaces">addFulfillmentPlaces(product, body=None, x__xgafv=None)</code>
-  <pre>Incrementally adds place IDs to Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the added place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.
+  <pre>Incrementally adds place IDs to Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the added place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.
 
 Args:
   product: string, Required. Full resource name of Product, such as `projects/*/locations/global/catalogs/default_catalog/branches/default_branch/products/some_product_id`. If the caller does not have permission to access the Product, regardless of whether or not it exists, a PERMISSION_DENIED error is returned. (required)
@@ -276,7 +276,7 @@
       42,
     ],
   },
-  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
   &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
     &quot;A String&quot;,
   ],
@@ -408,7 +408,7 @@
       42,
     ],
   },
-  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
   &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
     &quot;A String&quot;,
   ],
@@ -564,7 +564,7 @@
       42,
     ],
   },
-  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
   &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
     &quot;A String&quot;,
   ],
@@ -722,7 +722,7 @@
               42,
             ],
           },
-          &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+          &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
           &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
             &quot;A String&quot;,
           ],
@@ -904,7 +904,7 @@
           42,
         ],
       },
-      &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+      &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
       &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
         &quot;A String&quot;,
       ],
@@ -1054,7 +1054,7 @@
       42,
     ],
   },
-  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
   &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
     &quot;A String&quot;,
   ],
@@ -1187,7 +1187,7 @@
       42,
     ],
   },
-  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
   &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
     &quot;A String&quot;,
   ],
@@ -1206,7 +1206,7 @@
 
 <div class="method">
     <code class="details" id="removeFulfillmentPlaces">removeFulfillmentPlaces(product, body=None, x__xgafv=None)</code>
-  <pre>Incrementally removes place IDs from a Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the removed place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.
+  <pre>Incrementally removes place IDs from a Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the removed place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.
 
 Args:
   product: string, Required. Full resource name of Product, such as `projects/*/locations/global/catalogs/default_catalog/branches/default_branch/products/some_product_id`. If the caller does not have permission to access the Product, regardless of whether or not it exists, a PERMISSION_DENIED error is returned. (required)
@@ -1253,7 +1253,7 @@
 
 <div class="method">
     <code class="details" id="setInventory">setInventory(name, body=None, x__xgafv=None)</code>
-  <pre>Updates inventory information for a Product while respecting the last update timestamps of each inventory field. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, updates are not immediately manifested in the Product queried by GetProduct or ListProducts. When inventory is updated with CreateProduct and UpdateProduct, the specified inventory field value(s) will overwrite any existing value(s) while ignoring the last update time for this field. Furthermore, the last update time for the specified inventory fields will be overwritten to the time of the CreateProduct or UpdateProduct request. If no inventory fields are set in CreateProductRequest.product, then any pre-existing inventory information for this product will be used. If no inventory fields are set in UpdateProductRequest.set_mask, then any existing inventory information will be preserved. Pre-existing inventory information can only be updated with SetInventory, AddFulfillmentPlaces, and RemoveFulfillmentPlaces. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.
+  <pre>Updates inventory information for a Product while respecting the last update timestamps of each inventory field. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, updates are not immediately manifested in the Product queried by GetProduct or ListProducts. When inventory is updated with CreateProduct and UpdateProduct, the specified inventory field value(s) will overwrite any existing value(s) while ignoring the last update time for this field. Furthermore, the last update time for the specified inventory fields will be overwritten to the time of the CreateProduct or UpdateProduct request. If no inventory fields are set in CreateProductRequest.product, then any pre-existing inventory information for this product will be used. If no inventory fields are set in UpdateProductRequest.set_mask, then any existing inventory information will be preserved. Pre-existing inventory information can only be updated with SetInventory, AddFulfillmentPlaces, and RemoveFulfillmentPlaces. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.
 
 Args:
   name: string, Immutable. Full resource name of the product, such as `projects/*/locations/global/catalogs/default_catalog/branches/default_branch/products/product_id`. The branch ID must be &quot;default_branch&quot;. (required)
@@ -1369,7 +1369,7 @@
         42,
       ],
     },
-    &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+    &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
     &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
       &quot;A String&quot;,
     ],
diff --git a/docs/dyn/retail_v2alpha.projects.locations.catalogs.completionData.html b/docs/dyn/retail_v2alpha.projects.locations.catalogs.completionData.html
index 0ddac69..b39b0b5 100644
--- a/docs/dyn/retail_v2alpha.projects.locations.catalogs.completionData.html
+++ b/docs/dyn/retail_v2alpha.projects.locations.catalogs.completionData.html
@@ -79,7 +79,7 @@
 <p class="firstline">Close httplib2 connections.</p>
 <p class="toc_element">
   <code><a href="#import_">import_(parent, body=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Bulk import of processed completion dataset. Request processing may be synchronous. Partial updating is not supported. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.</p>
+<p class="firstline">Bulk import of processed completion dataset. Request processing may be synchronous. Partial updating is not supported. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.</p>
 <h3>Method Details</h3>
 <div class="method">
     <code class="details" id="close">close()</code>
@@ -88,7 +88,7 @@
 
 <div class="method">
     <code class="details" id="import_">import_(parent, body=None, x__xgafv=None)</code>
-  <pre>Bulk import of processed completion dataset. Request processing may be synchronous. Partial updating is not supported. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.
+  <pre>Bulk import of processed completion dataset. Request processing may be synchronous. Partial updating is not supported. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.
 
 Args:
   parent: string, Required. The catalog which the suggestions dataset belongs to. Format: `projects/1234/locations/global/catalogs/default_catalog`. (required)
@@ -97,7 +97,7 @@
 
 { # Request message for ImportCompletionData methods.
   &quot;inputConfig&quot;: { # The input config source for completion data. # Required. The desired input location of the data.
-    &quot;bigQuerySource&quot;: { # BigQuery source import data from. # Required. BigQuery input source. Add the IAM permission “BigQuery Data Viewer” for cloud-retail-customer-data-access@system.gserviceaccount.com before using this feature otherwise an error is thrown.
+    &quot;bigQuerySource&quot;: { # BigQuery source import data from. # Required. BigQuery input source. Add the IAM permission &quot;BigQuery Data Viewer&quot; for cloud-retail-customer-data-access@system.gserviceaccount.com before using this feature otherwise an error is thrown.
       &quot;dataSchema&quot;: &quot;A String&quot;, # The schema to use when parsing the data from the source. Supported values for product imports: * `product` (default): One JSON Product per line. Each product must have a valid Product.id. * `product_merchant_center`: See [Importing catalog data from Merchant Center](https://cloud.google.com/retail/recommendations-ai/docs/upload-catalog#mc). Supported values for user events imports: * `user_event` (default): One JSON UserEvent per line. * `user_event_ga360`: Using https://support.google.com/analytics/answer/3437719.
       &quot;datasetId&quot;: &quot;A String&quot;, # Required. The BigQuery data set to copy the data from with a length limit of 1,024 characters.
       &quot;gcsStagingDir&quot;: &quot;A String&quot;, # Intermediate Cloud Storage directory used for the import with a length limit of 2,000 characters. Can be specified if one wants to have the BigQuery export to a specific Cloud Storage directory.
diff --git a/docs/dyn/retail_v2alpha.projects.locations.catalogs.html b/docs/dyn/retail_v2alpha.projects.locations.catalogs.html
index 26245e3..5284c16 100644
--- a/docs/dyn/retail_v2alpha.projects.locations.catalogs.html
+++ b/docs/dyn/retail_v2alpha.projects.locations.catalogs.html
@@ -104,10 +104,10 @@
 <p class="firstline">Close httplib2 connections.</p>
 <p class="toc_element">
   <code><a href="#completeQuery">completeQuery(catalog, dataset=None, deviceType=None, languageCodes=None, maxSuggestions=None, query=None, visitorId=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Completes the specified prefix with keyword suggestions. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.</p>
+<p class="firstline">Completes the specified prefix with keyword suggestions. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.</p>
 <p class="toc_element">
   <code><a href="#getDefaultBranch">getDefaultBranch(catalog, x__xgafv=None)</a></code></p>
-<p class="firstline">Get which branch is currently default branch set by CatalogService.SetDefaultBranch method under a specified parent catalog. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.</p>
+<p class="firstline">Get which branch is currently default branch set by CatalogService.SetDefaultBranch method under a specified parent catalog. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.</p>
 <p class="toc_element">
   <code><a href="#list">list(parent, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Lists all the Catalogs associated with the project.</p>
@@ -119,7 +119,7 @@
 <p class="firstline">Updates the Catalogs.</p>
 <p class="toc_element">
   <code><a href="#setDefaultBranch">setDefaultBranch(catalog, body=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Set a specified branch id as default branch. API methods such as SearchService.Search, ProductService.GetProduct, ProductService.ListProducts will treat requests using "default_branch" to the actual branch id set as default. For example, if `projects/*/locations/*/catalogs/*/branches/1` is set as default, setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/default_branch` is equivalent to setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/1`. Using multiple branches can be useful when developers would like to have a staging branch to test and verify for future usage. When it becomes ready, developers switch on the staging branch using this API while keeping using `projects/*/locations/*/catalogs/*/branches/default_branch` as SearchRequest.branch to route the traffic to this staging branch. CAUTION: If you have live predict/search traffic, switching the default branch could potentially cause outages if the ID space of the new branch is very different from the old one. More specifically: * PredictionService will only return product IDs from branch {newBranch}. * SearchService will only return product IDs from branch {newBranch} (if branch is not explicitly set). * UserEventService will only join events with products from branch {newBranch}. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.</p>
+<p class="firstline">Set a specified branch id as default branch. API methods such as SearchService.Search, ProductService.GetProduct, ProductService.ListProducts will treat requests using "default_branch" to the actual branch id set as default. For example, if `projects/*/locations/*/catalogs/*/branches/1` is set as default, setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/default_branch` is equivalent to setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/1`. Using multiple branches can be useful when developers would like to have a staging branch to test and verify for future usage. When it becomes ready, developers switch on the staging branch using this API while keeping using `projects/*/locations/*/catalogs/*/branches/default_branch` as SearchRequest.branch to route the traffic to this staging branch. CAUTION: If you have live predict/search traffic, switching the default branch could potentially cause outages if the ID space of the new branch is very different from the old one. More specifically: * PredictionService will only return product IDs from branch {newBranch}. * SearchService will only return product IDs from branch {newBranch} (if branch is not explicitly set). * UserEventService will only join events with products from branch {newBranch}. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.</p>
 <h3>Method Details</h3>
 <div class="method">
     <code class="details" id="close">close()</code>
@@ -128,14 +128,14 @@
 
 <div class="method">
     <code class="details" id="completeQuery">completeQuery(catalog, dataset=None, deviceType=None, languageCodes=None, maxSuggestions=None, query=None, visitorId=None, x__xgafv=None)</code>
-  <pre>Completes the specified prefix with keyword suggestions. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.
+  <pre>Completes the specified prefix with keyword suggestions. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.
 
 Args:
   catalog: string, Required. Catalog for which the completion is performed. Full resource name of catalog, such as `projects/*/locations/global/catalogs/default_catalog`. (required)
-  dataset: string, Determines which dataset to use for fetching completion. &quot;user-data&quot; will use the imported dataset through ImportCompletionData. &quot;cloud-retail&quot; will use the dataset generated by cloud retail based on user events. If leave empty, it will use the &quot;user-data&quot;. Current supported values: * user-data * cloud-retail This option is not automatically enabled. Before using cloud-retail, contact retail-search-support@google.com first.
+  dataset: string, Determines which dataset to use for fetching completion. &quot;user-data&quot; will use the imported dataset through CompletionService.ImportCompletionData. &quot;cloud-retail&quot; will use the dataset generated by cloud retail based on user events. If leave empty, it will use the &quot;user-data&quot;. Current supported values: * user-data * cloud-retail This option requires additional allowlisting. Before using cloud-retail, contact Cloud Retail support team first.
   deviceType: string, The device type context for completion suggestions. It is useful to apply different suggestions on different device types, e.g. DESKTOP, MOBILE. If it is empty, the suggestions are across all device types. Supported formats: * UNKNOWN_DEVICE_TYPE * DESKTOP * MOBILE * A customized string starts with OTHER_, e.g. OTHER_IPHONE.
   languageCodes: string, The list of languages of the query. This is the BCP-47 language code, such as &quot;en-US&quot; or &quot;sr-Latn&quot;. For more information, see [Tags for Identifying Languages](https://tools.ietf.org/html/bcp47). The maximum number of allowed characters is 255. Only &quot;en-US&quot; is currently supported. (repeated)
-  maxSuggestions: integer, Completion max suggestions. The maximum allowed max suggestions is 20. The default value is 20.
+  maxSuggestions: integer, Completion max suggestions. If left unset or set to 0, then will fallback to the configured value CompletionConfig.max_suggestions. The maximum allowed max suggestions is 20. If it is set higher, it will be capped by 20.
   query: string, Required. The query used to generate suggestions. The maximum number of allowed characters is 255.
   visitorId: string, A unique identifier for tracking visitors. For example, this could be implemented with an HTTP cookie, which should be able to uniquely identify a visitor on a single device. This unique identifier should not change if the visitor logs in or out of the website. The field must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned.
   x__xgafv: string, V1 error format.
@@ -165,7 +165,7 @@
       &quot;suggestion&quot;: &quot;A String&quot;, # The suggestion for the query.
     },
   ],
-  &quot;recentSearchResults&quot;: [ # Matched recent searches of this user. This field is a restricted feature. Contact Retail Support (retail-search-support@google.com) if you are interested in enabling it. This feature is only available when CompleteQueryRequest.visitor_id field is set and UserEvent is imported. The recent searches satisfy the follow rules: * They are ordered from latest to oldest. * They are matched with CompleteQueryRequest.query case insensitively. * They are transformed to lower cases. * They are UTF-8 safe. Recent searches are deduplicated. More recent searches will be reserved when duplication happens.
+  &quot;recentSearchResults&quot;: [ # Matched recent searches of this user. This field is a restricted feature. Contact Retail Search support team if you are interested in enabling it. This feature is only available when CompleteQueryRequest.visitor_id field is set and UserEvent is imported. The recent searches satisfy the follow rules: * They are ordered from latest to oldest. * They are matched with CompleteQueryRequest.query case insensitively. * They are transformed to lower cases. * They are UTF-8 safe. Recent searches are deduplicated. More recent searches will be reserved when duplication happens.
     { # Recent search of this user.
       &quot;recentSearch&quot;: &quot;A String&quot;, # The recent search query.
     },
@@ -175,7 +175,7 @@
 
 <div class="method">
     <code class="details" id="getDefaultBranch">getDefaultBranch(catalog, x__xgafv=None)</code>
-  <pre>Get which branch is currently default branch set by CatalogService.SetDefaultBranch method under a specified parent catalog. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.
+  <pre>Get which branch is currently default branch set by CatalogService.SetDefaultBranch method under a specified parent catalog. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.
 
 Args:
   catalog: string, The parent catalog resource name, such as `projects/*/locations/global/catalogs/default_catalog`. (required)
@@ -218,7 +218,7 @@
         &quot;links&quot;: [ # Links between Merchant Center accounts and branches.
           { # Represents a link between a Merchant Center account and a branch. Once a link is established, products from the linked merchant center account will be streamed to the linked branch.
             &quot;branchId&quot;: &quot;A String&quot;, # The branch id (e.g. 0/1/2) within this catalog that products from merchant_center_account_id are streamed to. When updating this field, an empty value will use the currently configured default branch. However, changing the default branch later on won&#x27;t change the linked branch here. A single branch id can only have one linked merchant center account id.
-            &quot;destinations&quot;: [ # String representing the destination to import for, all if left empty. List of possible values can be found here. [https://support.google.com/merchants/answer/7501026?hl=en] List of allowed string values: &quot;shopping-ads&quot;, &quot;buy-on-google-listings&quot;, &quot;display-ads&quot;, &quot;local-inventory -ads&quot;, &quot;free-listings&quot;, &quot;free-local-listings&quot; NOTE: The string values are case sensitive.
+            &quot;destinations&quot;: [ # String representing the destination to import for, all if left empty. List of possible values can be found here. [https://support.google.com/merchants/answer/7501026] List of allowed string values: &quot;shopping-ads&quot;, &quot;buy-on-google-listings&quot;, &quot;display-ads&quot;, &quot;local-inventory -ads&quot;, &quot;free-listings&quot;, &quot;free-local-listings&quot; NOTE: The string values are case sensitive.
               &quot;A String&quot;,
             ],
             &quot;merchantCenterAccountId&quot;: &quot;A String&quot;, # Required. The linked [Merchant center account id](https://developers.google.com/shopping-content/guides/accountstatuses). The account must be a standalone account or a sub-account of a MCA.
@@ -265,7 +265,7 @@
     &quot;links&quot;: [ # Links between Merchant Center accounts and branches.
       { # Represents a link between a Merchant Center account and a branch. Once a link is established, products from the linked merchant center account will be streamed to the linked branch.
         &quot;branchId&quot;: &quot;A String&quot;, # The branch id (e.g. 0/1/2) within this catalog that products from merchant_center_account_id are streamed to. When updating this field, an empty value will use the currently configured default branch. However, changing the default branch later on won&#x27;t change the linked branch here. A single branch id can only have one linked merchant center account id.
-        &quot;destinations&quot;: [ # String representing the destination to import for, all if left empty. List of possible values can be found here. [https://support.google.com/merchants/answer/7501026?hl=en] List of allowed string values: &quot;shopping-ads&quot;, &quot;buy-on-google-listings&quot;, &quot;display-ads&quot;, &quot;local-inventory -ads&quot;, &quot;free-listings&quot;, &quot;free-local-listings&quot; NOTE: The string values are case sensitive.
+        &quot;destinations&quot;: [ # String representing the destination to import for, all if left empty. List of possible values can be found here. [https://support.google.com/merchants/answer/7501026] List of allowed string values: &quot;shopping-ads&quot;, &quot;buy-on-google-listings&quot;, &quot;display-ads&quot;, &quot;local-inventory -ads&quot;, &quot;free-listings&quot;, &quot;free-local-listings&quot; NOTE: The string values are case sensitive.
           &quot;A String&quot;,
         ],
         &quot;merchantCenterAccountId&quot;: &quot;A String&quot;, # Required. The linked [Merchant center account id](https://developers.google.com/shopping-content/guides/accountstatuses). The account must be a standalone account or a sub-account of a MCA.
@@ -294,7 +294,7 @@
     &quot;links&quot;: [ # Links between Merchant Center accounts and branches.
       { # Represents a link between a Merchant Center account and a branch. Once a link is established, products from the linked merchant center account will be streamed to the linked branch.
         &quot;branchId&quot;: &quot;A String&quot;, # The branch id (e.g. 0/1/2) within this catalog that products from merchant_center_account_id are streamed to. When updating this field, an empty value will use the currently configured default branch. However, changing the default branch later on won&#x27;t change the linked branch here. A single branch id can only have one linked merchant center account id.
-        &quot;destinations&quot;: [ # String representing the destination to import for, all if left empty. List of possible values can be found here. [https://support.google.com/merchants/answer/7501026?hl=en] List of allowed string values: &quot;shopping-ads&quot;, &quot;buy-on-google-listings&quot;, &quot;display-ads&quot;, &quot;local-inventory -ads&quot;, &quot;free-listings&quot;, &quot;free-local-listings&quot; NOTE: The string values are case sensitive.
+        &quot;destinations&quot;: [ # String representing the destination to import for, all if left empty. List of possible values can be found here. [https://support.google.com/merchants/answer/7501026] List of allowed string values: &quot;shopping-ads&quot;, &quot;buy-on-google-listings&quot;, &quot;display-ads&quot;, &quot;local-inventory -ads&quot;, &quot;free-listings&quot;, &quot;free-local-listings&quot; NOTE: The string values are case sensitive.
           &quot;A String&quot;,
         ],
         &quot;merchantCenterAccountId&quot;: &quot;A String&quot;, # Required. The linked [Merchant center account id](https://developers.google.com/shopping-content/guides/accountstatuses). The account must be a standalone account or a sub-account of a MCA.
@@ -311,7 +311,7 @@
 
 <div class="method">
     <code class="details" id="setDefaultBranch">setDefaultBranch(catalog, body=None, x__xgafv=None)</code>
-  <pre>Set a specified branch id as default branch. API methods such as SearchService.Search, ProductService.GetProduct, ProductService.ListProducts will treat requests using &quot;default_branch&quot; to the actual branch id set as default. For example, if `projects/*/locations/*/catalogs/*/branches/1` is set as default, setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/default_branch` is equivalent to setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/1`. Using multiple branches can be useful when developers would like to have a staging branch to test and verify for future usage. When it becomes ready, developers switch on the staging branch using this API while keeping using `projects/*/locations/*/catalogs/*/branches/default_branch` as SearchRequest.branch to route the traffic to this staging branch. CAUTION: If you have live predict/search traffic, switching the default branch could potentially cause outages if the ID space of the new branch is very different from the old one. More specifically: * PredictionService will only return product IDs from branch {newBranch}. * SearchService will only return product IDs from branch {newBranch} (if branch is not explicitly set). * UserEventService will only join events with products from branch {newBranch}. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.
+  <pre>Set a specified branch id as default branch. API methods such as SearchService.Search, ProductService.GetProduct, ProductService.ListProducts will treat requests using &quot;default_branch&quot; to the actual branch id set as default. For example, if `projects/*/locations/*/catalogs/*/branches/1` is set as default, setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/default_branch` is equivalent to setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/1`. Using multiple branches can be useful when developers would like to have a staging branch to test and verify for future usage. When it becomes ready, developers switch on the staging branch using this API while keeping using `projects/*/locations/*/catalogs/*/branches/default_branch` as SearchRequest.branch to route the traffic to this staging branch. CAUTION: If you have live predict/search traffic, switching the default branch could potentially cause outages if the ID space of the new branch is very different from the old one. More specifically: * PredictionService will only return product IDs from branch {newBranch}. * SearchService will only return product IDs from branch {newBranch} (if branch is not explicitly set). * UserEventService will only join events with products from branch {newBranch}. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.
 
 Args:
   catalog: string, Full resource name of the catalog, such as `projects/*/locations/global/catalogs/default_catalog`. (required)
diff --git a/docs/dyn/retail_v2alpha.projects.locations.catalogs.placements.html b/docs/dyn/retail_v2alpha.projects.locations.catalogs.placements.html
index 2ad160d..eab4a44 100644
--- a/docs/dyn/retail_v2alpha.projects.locations.catalogs.placements.html
+++ b/docs/dyn/retail_v2alpha.projects.locations.catalogs.placements.html
@@ -82,7 +82,7 @@
 <p class="firstline">Makes a recommendation prediction.</p>
 <p class="toc_element">
   <code><a href="#search">search(placement, body=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Performs a search. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.</p>
+<p class="firstline">Performs a search. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.</p>
 <p class="toc_element">
   <code><a href="#search_next">search_next(previous_request, previous_response)</a></code></p>
 <p class="firstline">Retrieves the next page of results.</p>
@@ -145,7 +145,7 @@
     &quot;pageViewId&quot;: &quot;A String&quot;, # A unique id of a web page view. This should be kept the same for all user events triggered from the same pageview. For example, an item detail page view could trigger multiple events as the user is browsing the page. The `pageViewId` property should be kept the same for all these events so that they can be grouped together properly. When using the client side event reporting with JavaScript pixel and Google Tag Manager, this value is filled in automatically.
     &quot;productDetails&quot;: [ # The main product details related to the event. This field is required for the following event types: * `add-to-cart` * `detail-page-view` * `purchase-complete` In a `search` event, this field represents the products returned to the end user on the current page (the end user may have not finished broswing the whole page yet). When a new page is returned to the end user, after pagination/filtering/ordering even for the same query, a new `search` event with different product_details is desired. The end user may have not finished broswing the whole page yet.
       { # Detailed product information associated with a user event.
-        &quot;product&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. Product information. Only Product.id field is used when ingesting an event, all other product fields are ignored as we will look them up from the catalog.
+        &quot;product&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. Product information. Required field(s): * Product.id Optional override field(s): * Product.price_info If any supported optional fields are provided, we will treat them as a full override when looking up product information from the catalog. Thus, it is important to ensure that the overriding fields are accurate and complete. All other product fields are ignored and instead populated via catalog lookup after event ingestion.
           &quot;attributes&quot;: { # Highly encouraged. Extra product attributes to be included. For example, for products, this could include the store name, vendor, style, color, etc. These are very strong signals for recommendation model, thus we highly recommend providing the attributes here. Features that can take on one of a limited number of possible values. Two types of features can be set are: Textual features. some examples would be the brand/maker of a product, or country of a customer. Numerical features. Some examples would be the height/weight of a product, or age of a customer. For example: `{ &quot;vendor&quot;: {&quot;text&quot;: [&quot;vendor123&quot;, &quot;vendor456&quot;]}, &quot;lengths_cm&quot;: {&quot;numbers&quot;:[2.3, 15.4]}, &quot;heights_cm&quot;: {&quot;numbers&quot;:[8.1, 6.4]} }`. This field needs to pass all below criteria, otherwise an INVALID_ARGUMENT error is returned: * Max entries count: 200 by default; 100 for Type.VARIANT. * The key must be a UTF-8 encoded string with a length limit of 128 characters. * Max indexable entries count: 200 by default; 40 for Type.VARIANT. * Max searchable entries count: 30. * For indexable attribute, the key must match the pattern: a-zA-Z0-9*. For example, key0LikeThis or KEY_1_LIKE_THIS.
             &quot;a_key&quot;: { # A custom attribute that is not explicitly modeled in Product.
               &quot;indexable&quot;: True or False, # If true, custom attribute values are indexed, so that it can be filtered, faceted or boosted in SearchService.Search. This field is ignored in a UserEvent. See SearchRequest.filter, SearchRequest.facet_specs and SearchRequest.boost_spec for more details.
@@ -252,7 +252,7 @@
               42,
             ],
           },
-          &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+          &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
           &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
             &quot;A String&quot;,
           ],
@@ -319,7 +319,7 @@
 
 <div class="method">
     <code class="details" id="search">search(placement, body=None, x__xgafv=None)</code>
-  <pre>Performs a search. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.
+  <pre>Performs a search. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.
 
 Args:
   placement: string, Required. The resource name of the search engine placement, such as `projects/*/locations/global/catalogs/default_catalog/placements/default_search`. This field is used to identify the set of models that will be used to make the search. We currently support one placement with the following ID: * `default_search`. (required)
@@ -337,7 +337,7 @@
   },
   &quot;branch&quot;: &quot;A String&quot;, # The branch resource name, such as `projects/*/locations/global/catalogs/default_catalog/branches/0`. Use &quot;default_branch&quot; as the branch ID or leave this field empty, to search products under the default branch.
   &quot;canonicalFilter&quot;: &quot;A String&quot;, # The filter applied to every search request when quality improvement such as query expansion is needed. For example, if a query does not have enough results, an expanded query with SearchRequest.canonical_filter will be returned as a supplement of the original query. This field is strongly recommended to achieve high search quality. See SearchRequest.filter for more details about filter syntax.
-  &quot;dynamicFacetSpec&quot;: { # The specifications of dynamically generated facets. # The specification for dynamically generated facets. Notice that only textual facets can be dynamically generated. This feature requires additional allowlisting. Contact Retail Support (retail-search-support@google.com) if you are interested in using dynamic facet feature.
+  &quot;dynamicFacetSpec&quot;: { # The specifications of dynamically generated facets. # The specification for dynamically generated facets. Notice that only textual facets can be dynamically generated. This feature requires additional allowlisting. Contact Retail Search support team if you are interested in using dynamic facet feature.
     &quot;mode&quot;: &quot;A String&quot;, # Mode of the DynamicFacet feature. Defaults to Mode.DISABLED if it&#x27;s unset.
   },
   &quot;facetSpecs&quot;: [ # Facet specifications for faceted search. If empty, no facets are returned. A maximum of 100 values are allowed. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -358,8 +358,8 @@
             &quot;minimum&quot;: 3.14, # Inclusive lower bound.
           },
         ],
-        &quot;key&quot;: &quot;A String&quot;, # Required. Supported textual and numerical facet keys in Product object, over which the facet values are computed. Facet key is case-sensitive. Allowed facet keys when FacetKey.query is not specified: * textual_field = *# The Product.brands. * &quot;brands&quot;; *# The Product.categories. * &quot;categories&quot;; *# The Audience.genders. * | &quot;genders&quot;; *# The Audience.age_groups. * | &quot;ageGroups&quot;; *# The Product.availability. Value is one of * *# &quot;IN_STOCK&quot;, &quot;OUT_OF_STOCK&quot;, PREORDER&quot;, &quot;BACKORDER&quot;. * | &quot;availability&quot;; *# The ColorInfo.color_families. * | &quot;colorFamilies&quot;; *# The ColorInfo.colors. * | &quot;colors&quot;; *# The Product.sizes. * | &quot;sizes&quot;; *# The Product.materials. * | &quot;materials&quot;; *# The Product.patterns. * | &quot;patterns&quot;; *# The Product.conditions. * | &quot;conditions&quot;; *# The textual custom attribute in Product object. Key can * *# be any key in the Product.attributes map * *# if the attribute values are textual. * *# map. * | &quot;attributes.key&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.PICKUP_IN_STORE. * | &quot;pickupInStore&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.SHIP_TO_STORE. * | &quot;shipToStore&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.SAME_DAY_DELIVERY. * | &quot;sameDayDelivery&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.NEXT_DAY_DELIVERY. * | &quot;nextDayDelivery&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_1. * | &quot;customFulfillment1&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_2. * | &quot;customFulfillment2&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_3. * | &quot;customFulfillment3&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_4. * | &quot;customFulfillment4&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_5. * | &quot;customFulfillment5&quot;; * numerical_field = *# The PriceInfo.price. * &quot;price&quot;; *# The discount. Computed by (original_price-price)/price * &quot;discount&quot;; *# The Rating.average_rating. * &quot;rating&quot;; *# The Rating.rating_count. * &quot;ratingCount&quot;; *# The numerical custom attribute in Product object. Key can * *# be any key in the Product.attributes map * *# if the attribute values are numerical. * | &quot;attributes.key&quot;;
-        &quot;orderBy&quot;: &quot;A String&quot;, # The order in which Facet.values are returned. Allowed values are: * &quot;count desc&quot;, which means order by Facet.FacetValue.count descending. * &quot;value desc&quot;, which means order by Facet.FacetValue.value descending. Only applies to textual facets. If not set, textual values are sorted in [natural order](https://en.wikipedia.org/wiki/Natural_sort_order); numerical intervals are sorted in the order given by FacetSpec.FacetKey.intervals; FulfillmentInfo.ids are sorted in the order given by FacetSpec.FacetKey.restricted_values.
+        &quot;key&quot;: &quot;A String&quot;, # Required. Supported textual and numerical facet keys in Product object, over which the facet values are computed. Facet key is case-sensitive. Allowed facet keys when FacetKey.query is not specified: * textual_field = *# The Product.brands. * | &quot;brands&quot;; *# The Product.categories. * | &quot;categories&quot;; *# The Audience.genders. * | &quot;genders&quot;; *# The Audience.age_groups. * | &quot;ageGroups&quot;; *# The Product.availability. Value is one of * *# &quot;IN_STOCK&quot;, &quot;OUT_OF_STOCK&quot;, PREORDER&quot;, &quot;BACKORDER&quot;. * | &quot;availability&quot;; *# The ColorInfo.color_families. * | &quot;colorFamilies&quot;; *# The ColorInfo.colors. * | &quot;colors&quot;; *# The Product.sizes. * | &quot;sizes&quot;; *# The Product.materials. * | &quot;materials&quot;; *# The Product.patterns. * | &quot;patterns&quot;; *# The Product.conditions. * | &quot;conditions&quot;; *# The textual custom attribute in Product object. Key can * *# be any key in the Product.attributes map * *# if the attribute values are textual. * | &quot;attributes.key&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;pickup-in-store&quot;. * | &quot;pickupInStore&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;ship-to-store&quot;. * | &quot;shipToStore&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;same-day-delivery&quot;. * | &quot;sameDayDelivery&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;next-day-delivery&quot;. * | &quot;nextDayDelivery&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;custom-type-1&quot;. * | &quot;customFulfillment1&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;custom-type-2&quot;. * | &quot;customFulfillment2&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;custom-type-3&quot;. * | &quot;customFulfillment3&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;custom-type-4&quot;. * | &quot;customFulfillment4&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;custom-type-5&quot;. * | &quot;customFulfillment5&quot;; * numerical_field = *# The PriceInfo.price. * | &quot;price&quot;; *# The discount. Computed by (original_price-price)/price * | &quot;discount&quot;; *# The Rating.average_rating. * | &quot;rating&quot;; *# The Rating.rating_count. * | &quot;ratingCount&quot;; *# The numerical custom attribute in Product object. Key can * *# be any key in the Product.attributes map * *# if the attribute values are numerical. * | &quot;attributes.key&quot;;
+        &quot;orderBy&quot;: &quot;A String&quot;, # The order in which Facet.values are returned. Allowed values are: * &quot;count desc&quot;, which means order by Facet.FacetValue.count descending. * &quot;value desc&quot;, which means order by Facet.FacetValue.value descending. Only applies to textual facets. If not set, textual values are sorted in [natural order](https://en.wikipedia.org/wiki/Natural_sort_order); numerical intervals are sorted in the order given by FacetSpec.FacetKey.intervals; FulfillmentInfo.place_ids are sorted in the order given by FacetSpec.FacetKey.restricted_values.
         &quot;prefixes&quot;: [ # Only get facet values that start with the given string prefix. For example, suppose &quot;categories&quot; has three values &quot;Women &gt; Shoe&quot;, &quot;Women &gt; Dress&quot; and &quot;Men &gt; Shoe&quot;. If set &quot;prefixes&quot; to &quot;Women&quot;, the &quot;categories&quot; facet will give only &quot;Women &gt; Shoe&quot; and &quot;Women &gt; Dress&quot;. Only supported on textual fields. Maximum is 10.
           &quot;A String&quot;,
         ],
@@ -390,7 +390,7 @@
     &quot;userAgent&quot;: &quot;A String&quot;, # User agent as included in the HTTP header. Required for getting SearchResponse.sponsored_results. The field must be a UTF-8 encoded string with a length limit of 1,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. This should not be set when using the client side event reporting with GTM or JavaScript tag in UserEventService.CollectUserEvent or if direct_user_request is set.
     &quot;userId&quot;: &quot;A String&quot;, # Highly recommended for logged-in users. Unique identifier for logged-in user, such as a user name. The field must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned.
   },
-  &quot;variantRollupKeys&quot;: [ # The keys to fetch and rollup the matching variant Products attributes. The attributes from all the matching variant Products are merged and de-duplicated. Notice that rollup variant Products attributes will lead to extra query latency. Maximum number of keys is 10. For Product.fulfillment_info, a fulfillment type and a fulfillment ID must be provided in the format of &quot;fulfillmentType.filfillmentId&quot;. E.g., in &quot;pickupInStore.store123&quot;, &quot;pickupInStore&quot; is fulfillment type and &quot;store123&quot; is the store ID. Supported keys are: * colorFamilies * price * originalPrice * discount * attributes.key, where key is any key in the Product.attributes map. * pickupInStore.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.PICKUP_IN_STORE. * shipToStore.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.SHIP_TO_STORE. * sameDayDelivery.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.SAME_DAY_DELIVERY. * nextDayDelivery.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.NEXT_DAY_DELIVERY. * customFulfillment1.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_1. * customFulfillment2.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_2. * customFulfillment3.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_3. * customFulfillment4.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_4. * customFulfillment5.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_5. If this field is set to an invalid value other than these, an INVALID_ARGUMENT error is returned.
+  &quot;variantRollupKeys&quot;: [ # The keys to fetch and rollup the matching variant Products attributes. The attributes from all the matching variant Products are merged and de-duplicated. Notice that rollup variant Products attributes will lead to extra query latency. Maximum number of keys is 10. For FulfillmentInfo, a fulfillment type and a fulfillment ID must be provided in the format of &quot;fulfillmentType.fulfillmentId&quot;. E.g., in &quot;pickupInStore.store123&quot;, &quot;pickupInStore&quot; is fulfillment type and &quot;store123&quot; is the store ID. Supported keys are: * colorFamilies * price * originalPrice * discount * attributes.key, where key is any key in the Product.attributes map. * pickupInStore.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;pickup-in-store&quot;. * shipToStore.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;ship-to-store&quot;. * sameDayDelivery.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;same-day-delivery&quot;. * nextDayDelivery.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;next-day-delivery&quot;. * customFulfillment1.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;custom-type-1&quot;. * customFulfillment2.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;custom-type-2&quot;. * customFulfillment3.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;custom-type-3&quot;. * customFulfillment4.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;custom-type-4&quot;. * customFulfillment5.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;custom-type-5&quot;. If this field is set to an invalid value other than these, an INVALID_ARGUMENT error is returned.
     &quot;A String&quot;,
   ],
   &quot;visitorId&quot;: &quot;A String&quot;, # Required. A unique identifier for tracking visitors. For example, this could be implemented with an HTTP cookie, which should be able to uniquely identify a visitor on a single device. This unique identifier should not change if the visitor logs in or out of the website. The field must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -544,7 +544,7 @@
             42,
           ],
         },
-        &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+        &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
         &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
           &quot;A String&quot;,
         ],
@@ -559,7 +559,7 @@
           # Object with schema name: GoogleCloudRetailV2alphaProduct
         ],
       },
-      &quot;variantRollupValues&quot;: { # The rollup matching variant Product attributes. The key is one of the SearchRequest.variant_rollup_keys. The values are the merged and de-duplicated Product attributes. Notice that the rollup values are respect filter. For example, when filtering by &quot;colorFamilies:ANY(\&quot;red\&quot;)&quot; and rollup &quot;colorFamilies&quot;, only &quot;red&quot; is returned. For textual and numerical attributes, the rollup values is a list of string or double values with type google.protobuf.ListValue. For example, if there are two variants with colors &quot;red&quot; and &quot;blue&quot;, the rollup values are { key: &quot;colorFamilies&quot; value { list_value { values { string_value: &quot;red&quot; } values { string_value: &quot;blue&quot; } } } } For Product.fulfillment_info, the rollup values is a double value with type google.protobuf.Value. For example, {key: &quot;pickupInStore.store1&quot; value { number_value: 10 }} means a there are 10 variants in this product are available in the store &quot;store1&quot;.
+      &quot;variantRollupValues&quot;: { # The rollup matching variant Product attributes. The key is one of the SearchRequest.variant_rollup_keys. The values are the merged and de-duplicated Product attributes. Notice that the rollup values are respect filter. For example, when filtering by &quot;colorFamilies:ANY(\&quot;red\&quot;)&quot; and rollup &quot;colorFamilies&quot;, only &quot;red&quot; is returned. For textual and numerical attributes, the rollup values is a list of string or double values with type google.protobuf.ListValue. For example, if there are two variants with colors &quot;red&quot; and &quot;blue&quot;, the rollup values are { key: &quot;colorFamilies&quot; value { list_value { values { string_value: &quot;red&quot; } values { string_value: &quot;blue&quot; } } } } For FulfillmentInfo, the rollup values is a double value with type google.protobuf.Value. For example, {key: &quot;pickupInStore.store1&quot; value { number_value: 10 }} means a there are 10 variants in this product are available in the store &quot;store1&quot;.
         &quot;a_key&quot;: &quot;&quot;,
       },
     },
diff --git a/docs/dyn/retail_v2alpha.projects.locations.catalogs.userEvents.html b/docs/dyn/retail_v2alpha.projects.locations.catalogs.userEvents.html
index 9114003..0c66990 100644
--- a/docs/dyn/retail_v2alpha.projects.locations.catalogs.userEvents.html
+++ b/docs/dyn/retail_v2alpha.projects.locations.catalogs.userEvents.html
@@ -194,7 +194,7 @@
           &quot;pageViewId&quot;: &quot;A String&quot;, # A unique id of a web page view. This should be kept the same for all user events triggered from the same pageview. For example, an item detail page view could trigger multiple events as the user is browsing the page. The `pageViewId` property should be kept the same for all these events so that they can be grouped together properly. When using the client side event reporting with JavaScript pixel and Google Tag Manager, this value is filled in automatically.
           &quot;productDetails&quot;: [ # The main product details related to the event. This field is required for the following event types: * `add-to-cart` * `detail-page-view` * `purchase-complete` In a `search` event, this field represents the products returned to the end user on the current page (the end user may have not finished broswing the whole page yet). When a new page is returned to the end user, after pagination/filtering/ordering even for the same query, a new `search` event with different product_details is desired. The end user may have not finished broswing the whole page yet.
             { # Detailed product information associated with a user event.
-              &quot;product&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. Product information. Only Product.id field is used when ingesting an event, all other product fields are ignored as we will look them up from the catalog.
+              &quot;product&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. Product information. Required field(s): * Product.id Optional override field(s): * Product.price_info If any supported optional fields are provided, we will treat them as a full override when looking up product information from the catalog. Thus, it is important to ensure that the overriding fields are accurate and complete. All other product fields are ignored and instead populated via catalog lookup after event ingestion.
                 &quot;attributes&quot;: { # Highly encouraged. Extra product attributes to be included. For example, for products, this could include the store name, vendor, style, color, etc. These are very strong signals for recommendation model, thus we highly recommend providing the attributes here. Features that can take on one of a limited number of possible values. Two types of features can be set are: Textual features. some examples would be the brand/maker of a product, or country of a customer. Numerical features. Some examples would be the height/weight of a product, or age of a customer. For example: `{ &quot;vendor&quot;: {&quot;text&quot;: [&quot;vendor123&quot;, &quot;vendor456&quot;]}, &quot;lengths_cm&quot;: {&quot;numbers&quot;:[2.3, 15.4]}, &quot;heights_cm&quot;: {&quot;numbers&quot;:[8.1, 6.4]} }`. This field needs to pass all below criteria, otherwise an INVALID_ARGUMENT error is returned: * Max entries count: 200 by default; 100 for Type.VARIANT. * The key must be a UTF-8 encoded string with a length limit of 128 characters. * Max indexable entries count: 200 by default; 40 for Type.VARIANT. * Max searchable entries count: 30. * For indexable attribute, the key must match the pattern: a-zA-Z0-9*. For example, key0LikeThis or KEY_1_LIKE_THIS.
                   &quot;a_key&quot;: { # A custom attribute that is not explicitly modeled in Product.
                     &quot;indexable&quot;: True or False, # If true, custom attribute values are indexed, so that it can be filtered, faceted or boosted in SearchService.Search. This field is ignored in a UserEvent. See SearchRequest.filter, SearchRequest.facet_specs and SearchRequest.boost_spec for more details.
@@ -301,7 +301,7 @@
                     42,
                   ],
                 },
-                &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+                &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
                 &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
                   &quot;A String&quot;,
                 ],
@@ -500,7 +500,7 @@
   &quot;pageViewId&quot;: &quot;A String&quot;, # A unique id of a web page view. This should be kept the same for all user events triggered from the same pageview. For example, an item detail page view could trigger multiple events as the user is browsing the page. The `pageViewId` property should be kept the same for all these events so that they can be grouped together properly. When using the client side event reporting with JavaScript pixel and Google Tag Manager, this value is filled in automatically.
   &quot;productDetails&quot;: [ # The main product details related to the event. This field is required for the following event types: * `add-to-cart` * `detail-page-view` * `purchase-complete` In a `search` event, this field represents the products returned to the end user on the current page (the end user may have not finished broswing the whole page yet). When a new page is returned to the end user, after pagination/filtering/ordering even for the same query, a new `search` event with different product_details is desired. The end user may have not finished broswing the whole page yet.
     { # Detailed product information associated with a user event.
-      &quot;product&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. Product information. Only Product.id field is used when ingesting an event, all other product fields are ignored as we will look them up from the catalog.
+      &quot;product&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. Product information. Required field(s): * Product.id Optional override field(s): * Product.price_info If any supported optional fields are provided, we will treat them as a full override when looking up product information from the catalog. Thus, it is important to ensure that the overriding fields are accurate and complete. All other product fields are ignored and instead populated via catalog lookup after event ingestion.
         &quot;attributes&quot;: { # Highly encouraged. Extra product attributes to be included. For example, for products, this could include the store name, vendor, style, color, etc. These are very strong signals for recommendation model, thus we highly recommend providing the attributes here. Features that can take on one of a limited number of possible values. Two types of features can be set are: Textual features. some examples would be the brand/maker of a product, or country of a customer. Numerical features. Some examples would be the height/weight of a product, or age of a customer. For example: `{ &quot;vendor&quot;: {&quot;text&quot;: [&quot;vendor123&quot;, &quot;vendor456&quot;]}, &quot;lengths_cm&quot;: {&quot;numbers&quot;:[2.3, 15.4]}, &quot;heights_cm&quot;: {&quot;numbers&quot;:[8.1, 6.4]} }`. This field needs to pass all below criteria, otherwise an INVALID_ARGUMENT error is returned: * Max entries count: 200 by default; 100 for Type.VARIANT. * The key must be a UTF-8 encoded string with a length limit of 128 characters. * Max indexable entries count: 200 by default; 40 for Type.VARIANT. * Max searchable entries count: 30. * For indexable attribute, the key must match the pattern: a-zA-Z0-9*. For example, key0LikeThis or KEY_1_LIKE_THIS.
           &quot;a_key&quot;: { # A custom attribute that is not explicitly modeled in Product.
             &quot;indexable&quot;: True or False, # If true, custom attribute values are indexed, so that it can be filtered, faceted or boosted in SearchService.Search. This field is ignored in a UserEvent. See SearchRequest.filter, SearchRequest.facet_specs and SearchRequest.boost_spec for more details.
@@ -607,7 +607,7 @@
             42,
           ],
         },
-        &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+        &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
         &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
           &quot;A String&quot;,
         ],
@@ -687,7 +687,7 @@
   &quot;pageViewId&quot;: &quot;A String&quot;, # A unique id of a web page view. This should be kept the same for all user events triggered from the same pageview. For example, an item detail page view could trigger multiple events as the user is browsing the page. The `pageViewId` property should be kept the same for all these events so that they can be grouped together properly. When using the client side event reporting with JavaScript pixel and Google Tag Manager, this value is filled in automatically.
   &quot;productDetails&quot;: [ # The main product details related to the event. This field is required for the following event types: * `add-to-cart` * `detail-page-view` * `purchase-complete` In a `search` event, this field represents the products returned to the end user on the current page (the end user may have not finished broswing the whole page yet). When a new page is returned to the end user, after pagination/filtering/ordering even for the same query, a new `search` event with different product_details is desired. The end user may have not finished broswing the whole page yet.
     { # Detailed product information associated with a user event.
-      &quot;product&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. Product information. Only Product.id field is used when ingesting an event, all other product fields are ignored as we will look them up from the catalog.
+      &quot;product&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. Product information. Required field(s): * Product.id Optional override field(s): * Product.price_info If any supported optional fields are provided, we will treat them as a full override when looking up product information from the catalog. Thus, it is important to ensure that the overriding fields are accurate and complete. All other product fields are ignored and instead populated via catalog lookup after event ingestion.
         &quot;attributes&quot;: { # Highly encouraged. Extra product attributes to be included. For example, for products, this could include the store name, vendor, style, color, etc. These are very strong signals for recommendation model, thus we highly recommend providing the attributes here. Features that can take on one of a limited number of possible values. Two types of features can be set are: Textual features. some examples would be the brand/maker of a product, or country of a customer. Numerical features. Some examples would be the height/weight of a product, or age of a customer. For example: `{ &quot;vendor&quot;: {&quot;text&quot;: [&quot;vendor123&quot;, &quot;vendor456&quot;]}, &quot;lengths_cm&quot;: {&quot;numbers&quot;:[2.3, 15.4]}, &quot;heights_cm&quot;: {&quot;numbers&quot;:[8.1, 6.4]} }`. This field needs to pass all below criteria, otherwise an INVALID_ARGUMENT error is returned: * Max entries count: 200 by default; 100 for Type.VARIANT. * The key must be a UTF-8 encoded string with a length limit of 128 characters. * Max indexable entries count: 200 by default; 40 for Type.VARIANT. * Max searchable entries count: 30. * For indexable attribute, the key must match the pattern: a-zA-Z0-9*. For example, key0LikeThis or KEY_1_LIKE_THIS.
           &quot;a_key&quot;: { # A custom attribute that is not explicitly modeled in Product.
             &quot;indexable&quot;: True or False, # If true, custom attribute values are indexed, so that it can be filtered, faceted or boosted in SearchService.Search. This field is ignored in a UserEvent. See SearchRequest.filter, SearchRequest.facet_specs and SearchRequest.boost_spec for more details.
@@ -794,7 +794,7 @@
             42,
           ],
         },
-        &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+        &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
         &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
           &quot;A String&quot;,
         ],
diff --git a/docs/dyn/retail_v2beta.projects.locations.catalogs.branches.products.html b/docs/dyn/retail_v2beta.projects.locations.catalogs.branches.products.html
index 07554c5..d8233b6 100644
--- a/docs/dyn/retail_v2beta.projects.locations.catalogs.branches.products.html
+++ b/docs/dyn/retail_v2beta.projects.locations.catalogs.branches.products.html
@@ -76,7 +76,7 @@
 <h2>Instance Methods</h2>
 <p class="toc_element">
   <code><a href="#addFulfillmentPlaces">addFulfillmentPlaces(product, body=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Incrementally adds place IDs to Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the added place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.</p>
+<p class="firstline">Incrementally adds place IDs to Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the added place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.</p>
 <p class="toc_element">
   <code><a href="#close">close()</a></code></p>
 <p class="firstline">Close httplib2 connections.</p>
@@ -103,14 +103,14 @@
 <p class="firstline">Updates a Product.</p>
 <p class="toc_element">
   <code><a href="#removeFulfillmentPlaces">removeFulfillmentPlaces(product, body=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Incrementally removes place IDs from a Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the removed place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.</p>
+<p class="firstline">Incrementally removes place IDs from a Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the removed place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.</p>
 <p class="toc_element">
   <code><a href="#setInventory">setInventory(name, body=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Updates inventory information for a Product while respecting the last update timestamps of each inventory field. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, updates are not immediately manifested in the Product queried by GetProduct or ListProducts. When inventory is updated with CreateProduct and UpdateProduct, the specified inventory field value(s) will overwrite any existing value(s) while ignoring the last update time for this field. Furthermore, the last update time for the specified inventory fields will be overwritten to the time of the CreateProduct or UpdateProduct request. If no inventory fields are set in CreateProductRequest.product, then any pre-existing inventory information for this product will be used. If no inventory fields are set in UpdateProductRequest.set_mask, then any existing inventory information will be preserved. Pre-existing inventory information can only be updated with SetInventory, AddFulfillmentPlaces, and RemoveFulfillmentPlaces. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.</p>
+<p class="firstline">Updates inventory information for a Product while respecting the last update timestamps of each inventory field. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, updates are not immediately manifested in the Product queried by GetProduct or ListProducts. When inventory is updated with CreateProduct and UpdateProduct, the specified inventory field value(s) will overwrite any existing value(s) while ignoring the last update time for this field. Furthermore, the last update time for the specified inventory fields will be overwritten to the time of the CreateProduct or UpdateProduct request. If no inventory fields are set in CreateProductRequest.product, then any pre-existing inventory information for this product will be used. If no inventory fields are set in UpdateProductRequest.set_mask, then any existing inventory information will be preserved. Pre-existing inventory information can only be updated with SetInventory, AddFulfillmentPlaces, and RemoveFulfillmentPlaces. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.</p>
 <h3>Method Details</h3>
 <div class="method">
     <code class="details" id="addFulfillmentPlaces">addFulfillmentPlaces(product, body=None, x__xgafv=None)</code>
-  <pre>Incrementally adds place IDs to Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the added place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.
+  <pre>Incrementally adds place IDs to Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the added place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.
 
 Args:
   product: string, Required. Full resource name of Product, such as `projects/*/locations/global/catalogs/default_catalog/branches/default_branch/products/some_product_id`. If the caller does not have permission to access the Product, regardless of whether or not it exists, a PERMISSION_DENIED error is returned. (required)
@@ -276,7 +276,7 @@
       42,
     ],
   },
-  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
   &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
     &quot;A String&quot;,
   ],
@@ -408,7 +408,7 @@
       42,
     ],
   },
-  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
   &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
     &quot;A String&quot;,
   ],
@@ -564,7 +564,7 @@
       42,
     ],
   },
-  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
   &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
     &quot;A String&quot;,
   ],
@@ -722,7 +722,7 @@
               42,
             ],
           },
-          &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+          &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
           &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
             &quot;A String&quot;,
           ],
@@ -903,7 +903,7 @@
           42,
         ],
       },
-      &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+      &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
       &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
         &quot;A String&quot;,
       ],
@@ -1052,7 +1052,7 @@
       42,
     ],
   },
-  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
   &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
     &quot;A String&quot;,
   ],
@@ -1185,7 +1185,7 @@
       42,
     ],
   },
-  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+  &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
   &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
     &quot;A String&quot;,
   ],
@@ -1204,7 +1204,7 @@
 
 <div class="method">
     <code class="details" id="removeFulfillmentPlaces">removeFulfillmentPlaces(product, body=None, x__xgafv=None)</code>
-  <pre>Incrementally removes place IDs from a Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the removed place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.
+  <pre>Incrementally removes place IDs from a Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the removed place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.
 
 Args:
   product: string, Required. Full resource name of Product, such as `projects/*/locations/global/catalogs/default_catalog/branches/default_branch/products/some_product_id`. If the caller does not have permission to access the Product, regardless of whether or not it exists, a PERMISSION_DENIED error is returned. (required)
@@ -1251,7 +1251,7 @@
 
 <div class="method">
     <code class="details" id="setInventory">setInventory(name, body=None, x__xgafv=None)</code>
-  <pre>Updates inventory information for a Product while respecting the last update timestamps of each inventory field. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, updates are not immediately manifested in the Product queried by GetProduct or ListProducts. When inventory is updated with CreateProduct and UpdateProduct, the specified inventory field value(s) will overwrite any existing value(s) while ignoring the last update time for this field. Furthermore, the last update time for the specified inventory fields will be overwritten to the time of the CreateProduct or UpdateProduct request. If no inventory fields are set in CreateProductRequest.product, then any pre-existing inventory information for this product will be used. If no inventory fields are set in UpdateProductRequest.set_mask, then any existing inventory information will be preserved. Pre-existing inventory information can only be updated with SetInventory, AddFulfillmentPlaces, and RemoveFulfillmentPlaces. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.
+  <pre>Updates inventory information for a Product while respecting the last update timestamps of each inventory field. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, updates are not immediately manifested in the Product queried by GetProduct or ListProducts. When inventory is updated with CreateProduct and UpdateProduct, the specified inventory field value(s) will overwrite any existing value(s) while ignoring the last update time for this field. Furthermore, the last update time for the specified inventory fields will be overwritten to the time of the CreateProduct or UpdateProduct request. If no inventory fields are set in CreateProductRequest.product, then any pre-existing inventory information for this product will be used. If no inventory fields are set in UpdateProductRequest.set_mask, then any existing inventory information will be preserved. Pre-existing inventory information can only be updated with SetInventory, AddFulfillmentPlaces, and RemoveFulfillmentPlaces. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.
 
 Args:
   name: string, Immutable. Full resource name of the product, such as `projects/*/locations/global/catalogs/default_catalog/branches/default_branch/products/product_id`. The branch ID must be &quot;default_branch&quot;. (required)
@@ -1367,7 +1367,7 @@
         42,
       ],
     },
-    &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+    &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
     &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
       &quot;A String&quot;,
     ],
diff --git a/docs/dyn/retail_v2beta.projects.locations.catalogs.completionData.html b/docs/dyn/retail_v2beta.projects.locations.catalogs.completionData.html
index c1341ed..f01e1bf 100644
--- a/docs/dyn/retail_v2beta.projects.locations.catalogs.completionData.html
+++ b/docs/dyn/retail_v2beta.projects.locations.catalogs.completionData.html
@@ -79,7 +79,7 @@
 <p class="firstline">Close httplib2 connections.</p>
 <p class="toc_element">
   <code><a href="#import_">import_(parent, body=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Bulk import of processed completion dataset. Request processing may be synchronous. Partial updating is not supported. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.</p>
+<p class="firstline">Bulk import of processed completion dataset. Request processing may be synchronous. Partial updating is not supported. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.</p>
 <h3>Method Details</h3>
 <div class="method">
     <code class="details" id="close">close()</code>
@@ -88,7 +88,7 @@
 
 <div class="method">
     <code class="details" id="import_">import_(parent, body=None, x__xgafv=None)</code>
-  <pre>Bulk import of processed completion dataset. Request processing may be synchronous. Partial updating is not supported. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.
+  <pre>Bulk import of processed completion dataset. Request processing may be synchronous. Partial updating is not supported. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.
 
 Args:
   parent: string, Required. The catalog which the suggestions dataset belongs to. Format: `projects/1234/locations/global/catalogs/default_catalog`. (required)
@@ -97,7 +97,7 @@
 
 { # Request message for ImportCompletionData methods.
   &quot;inputConfig&quot;: { # The input config source for completion data. # Required. The desired input location of the data.
-    &quot;bigQuerySource&quot;: { # BigQuery source import data from. # Required. BigQuery input source. Add the IAM permission “BigQuery Data Viewer” for cloud-retail-customer-data-access@system.gserviceaccount.com before using this feature otherwise an error is thrown.
+    &quot;bigQuerySource&quot;: { # BigQuery source import data from. # Required. BigQuery input source. Add the IAM permission &quot;BigQuery Data Viewer&quot; for cloud-retail-customer-data-access@system.gserviceaccount.com before using this feature otherwise an error is thrown.
       &quot;dataSchema&quot;: &quot;A String&quot;, # The schema to use when parsing the data from the source. Supported values for product imports: * `product` (default): One JSON Product per line. Each product must have a valid Product.id. * `product_merchant_center`: See [Importing catalog data from Merchant Center](https://cloud.google.com/retail/recommendations-ai/docs/upload-catalog#mc). Supported values for user events imports: * `user_event` (default): One JSON UserEvent per line. * `user_event_ga360`: Using https://support.google.com/analytics/answer/3437719.
       &quot;datasetId&quot;: &quot;A String&quot;, # Required. The BigQuery data set to copy the data from with a length limit of 1,024 characters.
       &quot;gcsStagingDir&quot;: &quot;A String&quot;, # Intermediate Cloud Storage directory used for the import with a length limit of 2,000 characters. Can be specified if one wants to have the BigQuery export to a specific Cloud Storage directory.
diff --git a/docs/dyn/retail_v2beta.projects.locations.catalogs.html b/docs/dyn/retail_v2beta.projects.locations.catalogs.html
index b060f4f..f074058 100644
--- a/docs/dyn/retail_v2beta.projects.locations.catalogs.html
+++ b/docs/dyn/retail_v2beta.projects.locations.catalogs.html
@@ -104,10 +104,10 @@
 <p class="firstline">Close httplib2 connections.</p>
 <p class="toc_element">
   <code><a href="#completeQuery">completeQuery(catalog, dataset=None, deviceType=None, languageCodes=None, maxSuggestions=None, query=None, visitorId=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Completes the specified prefix with keyword suggestions. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.</p>
+<p class="firstline">Completes the specified prefix with keyword suggestions. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.</p>
 <p class="toc_element">
   <code><a href="#getDefaultBranch">getDefaultBranch(catalog, x__xgafv=None)</a></code></p>
-<p class="firstline">Get which branch is currently default branch set by CatalogService.SetDefaultBranch method under a specified parent catalog. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.</p>
+<p class="firstline">Get which branch is currently default branch set by CatalogService.SetDefaultBranch method under a specified parent catalog. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.</p>
 <p class="toc_element">
   <code><a href="#list">list(parent, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Lists all the Catalogs associated with the project.</p>
@@ -119,7 +119,7 @@
 <p class="firstline">Updates the Catalogs.</p>
 <p class="toc_element">
   <code><a href="#setDefaultBranch">setDefaultBranch(catalog, body=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Set a specified branch id as default branch. API methods such as SearchService.Search, ProductService.GetProduct, ProductService.ListProducts will treat requests using "default_branch" to the actual branch id set as default. For example, if `projects/*/locations/*/catalogs/*/branches/1` is set as default, setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/default_branch` is equivalent to setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/1`. Using multiple branches can be useful when developers would like to have a staging branch to test and verify for future usage. When it becomes ready, developers switch on the staging branch using this API while keeping using `projects/*/locations/*/catalogs/*/branches/default_branch` as SearchRequest.branch to route the traffic to this staging branch. CAUTION: If you have live predict/search traffic, switching the default branch could potentially cause outages if the ID space of the new branch is very different from the old one. More specifically: * PredictionService will only return product IDs from branch {newBranch}. * SearchService will only return product IDs from branch {newBranch} (if branch is not explicitly set). * UserEventService will only join events with products from branch {newBranch}. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.</p>
+<p class="firstline">Set a specified branch id as default branch. API methods such as SearchService.Search, ProductService.GetProduct, ProductService.ListProducts will treat requests using "default_branch" to the actual branch id set as default. For example, if `projects/*/locations/*/catalogs/*/branches/1` is set as default, setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/default_branch` is equivalent to setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/1`. Using multiple branches can be useful when developers would like to have a staging branch to test and verify for future usage. When it becomes ready, developers switch on the staging branch using this API while keeping using `projects/*/locations/*/catalogs/*/branches/default_branch` as SearchRequest.branch to route the traffic to this staging branch. CAUTION: If you have live predict/search traffic, switching the default branch could potentially cause outages if the ID space of the new branch is very different from the old one. More specifically: * PredictionService will only return product IDs from branch {newBranch}. * SearchService will only return product IDs from branch {newBranch} (if branch is not explicitly set). * UserEventService will only join events with products from branch {newBranch}. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.</p>
 <h3>Method Details</h3>
 <div class="method">
     <code class="details" id="close">close()</code>
@@ -128,14 +128,14 @@
 
 <div class="method">
     <code class="details" id="completeQuery">completeQuery(catalog, dataset=None, deviceType=None, languageCodes=None, maxSuggestions=None, query=None, visitorId=None, x__xgafv=None)</code>
-  <pre>Completes the specified prefix with keyword suggestions. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.
+  <pre>Completes the specified prefix with keyword suggestions. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.
 
 Args:
   catalog: string, Required. Catalog for which the completion is performed. Full resource name of catalog, such as `projects/*/locations/global/catalogs/default_catalog`. (required)
-  dataset: string, Determines which dataset to use for fetching completion. &quot;user-data&quot; will use the imported dataset through ImportCompletionData. &quot;cloud-retail&quot; will use the dataset generated by cloud retail based on user events. If leave empty, it will use the &quot;user-data&quot;. Current supported values: * user-data * cloud-retail This option is not automatically enabled. Before using cloud-retail, contact retail-search-support@google.com first.
+  dataset: string, Determines which dataset to use for fetching completion. &quot;user-data&quot; will use the imported dataset through CompletionService.ImportCompletionData. &quot;cloud-retail&quot; will use the dataset generated by cloud retail based on user events. If leave empty, it will use the &quot;user-data&quot;. Current supported values: * user-data * cloud-retail This option requires additional allowlisting. Before using cloud-retail, contact Cloud Retail support team first.
   deviceType: string, The device type context for completion suggestions. It is useful to apply different suggestions on different device types, e.g. DESKTOP, MOBILE. If it is empty, the suggestions are across all device types. Supported formats: * UNKNOWN_DEVICE_TYPE * DESKTOP * MOBILE * A customized string starts with OTHER_, e.g. OTHER_IPHONE.
   languageCodes: string, The list of languages of the query. This is the BCP-47 language code, such as &quot;en-US&quot; or &quot;sr-Latn&quot;. For more information, see [Tags for Identifying Languages](https://tools.ietf.org/html/bcp47). The maximum number of allowed characters is 255. Only &quot;en-US&quot; is currently supported. (repeated)
-  maxSuggestions: integer, Completion max suggestions. The maximum allowed max suggestions is 20. The default value is 20.
+  maxSuggestions: integer, Completion max suggestions. If left unset or set to 0, then will fallback to the configured value CompletionConfig.max_suggestions. The maximum allowed max suggestions is 20. If it is set higher, it will be capped by 20.
   query: string, Required. The query used to generate suggestions. The maximum number of allowed characters is 255.
   visitorId: string, A unique identifier for tracking visitors. For example, this could be implemented with an HTTP cookie, which should be able to uniquely identify a visitor on a single device. This unique identifier should not change if the visitor logs in or out of the website. The field must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned.
   x__xgafv: string, V1 error format.
@@ -165,7 +165,7 @@
       &quot;suggestion&quot;: &quot;A String&quot;, # The suggestion for the query.
     },
   ],
-  &quot;recentSearchResults&quot;: [ # Matched recent searches of this user. This field is a restricted feature. Contact Retail Support (retail-search-support@google.com) if you are interested in enabling it. This feature is only available when CompleteQueryRequest.visitor_id field is set and UserEvent is imported. The recent searches satisfy the follow rules: * They are ordered from latest to oldest. * They are matched with CompleteQueryRequest.query case insensitively. * They are transformed to lower cases. * They are UTF-8 safe. Recent searches are deduplicated. More recent searches will be reserved when duplication happens.
+  &quot;recentSearchResults&quot;: [ # Matched recent searches of this user. This field is a restricted feature. Contact Retail Search support team if you are interested in enabling it. This feature is only available when CompleteQueryRequest.visitor_id field is set and UserEvent is imported. The recent searches satisfy the follow rules: * They are ordered from latest to oldest. * They are matched with CompleteQueryRequest.query case insensitively. * They are transformed to lower cases. * They are UTF-8 safe. Recent searches are deduplicated. More recent searches will be reserved when duplication happens.
     { # Recent search of this user.
       &quot;recentSearch&quot;: &quot;A String&quot;, # The recent search query.
     },
@@ -175,7 +175,7 @@
 
 <div class="method">
     <code class="details" id="getDefaultBranch">getDefaultBranch(catalog, x__xgafv=None)</code>
-  <pre>Get which branch is currently default branch set by CatalogService.SetDefaultBranch method under a specified parent catalog. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.
+  <pre>Get which branch is currently default branch set by CatalogService.SetDefaultBranch method under a specified parent catalog. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.
 
 Args:
   catalog: string, The parent catalog resource name, such as `projects/*/locations/global/catalogs/default_catalog`. (required)
@@ -278,7 +278,7 @@
 
 <div class="method">
     <code class="details" id="setDefaultBranch">setDefaultBranch(catalog, body=None, x__xgafv=None)</code>
-  <pre>Set a specified branch id as default branch. API methods such as SearchService.Search, ProductService.GetProduct, ProductService.ListProducts will treat requests using &quot;default_branch&quot; to the actual branch id set as default. For example, if `projects/*/locations/*/catalogs/*/branches/1` is set as default, setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/default_branch` is equivalent to setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/1`. Using multiple branches can be useful when developers would like to have a staging branch to test and verify for future usage. When it becomes ready, developers switch on the staging branch using this API while keeping using `projects/*/locations/*/catalogs/*/branches/default_branch` as SearchRequest.branch to route the traffic to this staging branch. CAUTION: If you have live predict/search traffic, switching the default branch could potentially cause outages if the ID space of the new branch is very different from the old one. More specifically: * PredictionService will only return product IDs from branch {newBranch}. * SearchService will only return product IDs from branch {newBranch} (if branch is not explicitly set). * UserEventService will only join events with products from branch {newBranch}. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.
+  <pre>Set a specified branch id as default branch. API methods such as SearchService.Search, ProductService.GetProduct, ProductService.ListProducts will treat requests using &quot;default_branch&quot; to the actual branch id set as default. For example, if `projects/*/locations/*/catalogs/*/branches/1` is set as default, setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/default_branch` is equivalent to setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/1`. Using multiple branches can be useful when developers would like to have a staging branch to test and verify for future usage. When it becomes ready, developers switch on the staging branch using this API while keeping using `projects/*/locations/*/catalogs/*/branches/default_branch` as SearchRequest.branch to route the traffic to this staging branch. CAUTION: If you have live predict/search traffic, switching the default branch could potentially cause outages if the ID space of the new branch is very different from the old one. More specifically: * PredictionService will only return product IDs from branch {newBranch}. * SearchService will only return product IDs from branch {newBranch} (if branch is not explicitly set). * UserEventService will only join events with products from branch {newBranch}. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.
 
 Args:
   catalog: string, Full resource name of the catalog, such as `projects/*/locations/global/catalogs/default_catalog`. (required)
diff --git a/docs/dyn/retail_v2beta.projects.locations.catalogs.placements.html b/docs/dyn/retail_v2beta.projects.locations.catalogs.placements.html
index af31af4..a19c62b 100644
--- a/docs/dyn/retail_v2beta.projects.locations.catalogs.placements.html
+++ b/docs/dyn/retail_v2beta.projects.locations.catalogs.placements.html
@@ -82,7 +82,7 @@
 <p class="firstline">Makes a recommendation prediction.</p>
 <p class="toc_element">
   <code><a href="#search">search(placement, body=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Performs a search. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.</p>
+<p class="firstline">Performs a search. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.</p>
 <p class="toc_element">
   <code><a href="#search_next">search_next(previous_request, previous_response)</a></code></p>
 <p class="firstline">Retrieves the next page of results.</p>
@@ -145,7 +145,7 @@
     &quot;pageViewId&quot;: &quot;A String&quot;, # A unique id of a web page view. This should be kept the same for all user events triggered from the same pageview. For example, an item detail page view could trigger multiple events as the user is browsing the page. The `pageViewId` property should be kept the same for all these events so that they can be grouped together properly. When using the client side event reporting with JavaScript pixel and Google Tag Manager, this value is filled in automatically.
     &quot;productDetails&quot;: [ # The main product details related to the event. This field is required for the following event types: * `add-to-cart` * `detail-page-view` * `purchase-complete` In a `search` event, this field represents the products returned to the end user on the current page (the end user may have not finished broswing the whole page yet). When a new page is returned to the end user, after pagination/filtering/ordering even for the same query, a new `search` event with different product_details is desired. The end user may have not finished broswing the whole page yet.
       { # Detailed product information associated with a user event.
-        &quot;product&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. Product information. Only Product.id field is used when ingesting an event, all other product fields are ignored as we will look them up from the catalog.
+        &quot;product&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. Product information. Required field(s): * Product.id Optional override field(s): * Product.price_info If any supported optional fields are provided, we will treat them as a full override when looking up product information from the catalog. Thus, it is important to ensure that the overriding fields are accurate and complete. All other product fields are ignored and instead populated via catalog lookup after event ingestion.
           &quot;attributes&quot;: { # Highly encouraged. Extra product attributes to be included. For example, for products, this could include the store name, vendor, style, color, etc. These are very strong signals for recommendation model, thus we highly recommend providing the attributes here. Features that can take on one of a limited number of possible values. Two types of features can be set are: Textual features. some examples would be the brand/maker of a product, or country of a customer. Numerical features. Some examples would be the height/weight of a product, or age of a customer. For example: `{ &quot;vendor&quot;: {&quot;text&quot;: [&quot;vendor123&quot;, &quot;vendor456&quot;]}, &quot;lengths_cm&quot;: {&quot;numbers&quot;:[2.3, 15.4]}, &quot;heights_cm&quot;: {&quot;numbers&quot;:[8.1, 6.4]} }`. This field needs to pass all below criteria, otherwise an INVALID_ARGUMENT error is returned: * Max entries count: 200 by default; 100 for Type.VARIANT. * The key must be a UTF-8 encoded string with a length limit of 128 characters. * Max indexable entries count: 200 by default; 40 for Type.VARIANT. * Max searchable entries count: 30. * For indexable attribute, the key must match the pattern: a-zA-Z0-9*. For example, key0LikeThis or KEY_1_LIKE_THIS.
             &quot;a_key&quot;: { # A custom attribute that is not explicitly modeled in Product.
               &quot;indexable&quot;: True or False, # If true, custom attribute values are indexed, so that it can be filtered, faceted or boosted in SearchService.Search. This field is ignored in a UserEvent. See SearchRequest.filter, SearchRequest.facet_specs and SearchRequest.boost_spec for more details.
@@ -252,7 +252,7 @@
               42,
             ],
           },
-          &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+          &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
           &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
             &quot;A String&quot;,
           ],
@@ -319,7 +319,7 @@
 
 <div class="method">
     <code class="details" id="search">search(placement, body=None, x__xgafv=None)</code>
-  <pre>Performs a search. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.
+  <pre>Performs a search. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.
 
 Args:
   placement: string, Required. The resource name of the search engine placement, such as `projects/*/locations/global/catalogs/default_catalog/placements/default_search`. This field is used to identify the set of models that will be used to make the search. We currently support one placement with the following ID: * `default_search`. (required)
@@ -337,7 +337,7 @@
   },
   &quot;branch&quot;: &quot;A String&quot;, # The branch resource name, such as `projects/*/locations/global/catalogs/default_catalog/branches/0`. Use &quot;default_branch&quot; as the branch ID or leave this field empty, to search products under the default branch.
   &quot;canonicalFilter&quot;: &quot;A String&quot;, # The filter applied to every search request when quality improvement such as query expansion is needed. For example, if a query does not have enough results, an expanded query with SearchRequest.canonical_filter will be returned as a supplement of the original query. This field is strongly recommended to achieve high search quality. See SearchRequest.filter for more details about filter syntax.
-  &quot;dynamicFacetSpec&quot;: { # The specifications of dynamically generated facets. # The specification for dynamically generated facets. Notice that only textual facets can be dynamically generated. This feature requires additional allowlisting. Contact Retail Support (retail-search-support@google.com) if you are interested in using dynamic facet feature.
+  &quot;dynamicFacetSpec&quot;: { # The specifications of dynamically generated facets. # The specification for dynamically generated facets. Notice that only textual facets can be dynamically generated. This feature requires additional allowlisting. Contact Retail Search support team if you are interested in using dynamic facet feature.
     &quot;mode&quot;: &quot;A String&quot;, # Mode of the DynamicFacet feature. Defaults to Mode.DISABLED if it&#x27;s unset.
   },
   &quot;facetSpecs&quot;: [ # Facet specifications for faceted search. If empty, no facets are returned. A maximum of 100 values are allowed. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -358,8 +358,8 @@
             &quot;minimum&quot;: 3.14, # Inclusive lower bound.
           },
         ],
-        &quot;key&quot;: &quot;A String&quot;, # Required. Supported textual and numerical facet keys in Product object, over which the facet values are computed. Facet key is case-sensitive. Allowed facet keys when FacetKey.query is not specified: * textual_field = *# The Product.brands. * &quot;brands&quot;; *# The Product.categories. * &quot;categories&quot;; *# The Audience.genders. * | &quot;genders&quot;; *# The Audience.age_groups. * | &quot;ageGroups&quot;; *# The Product.availability. Value is one of * *# &quot;IN_STOCK&quot;, &quot;OUT_OF_STOCK&quot;, PREORDER&quot;, &quot;BACKORDER&quot;. * | &quot;availability&quot;; *# The ColorInfo.color_families. * | &quot;colorFamilies&quot;; *# The ColorInfo.colors. * | &quot;colors&quot;; *# The Product.sizes. * | &quot;sizes&quot;; *# The Product.materials. * | &quot;materials&quot;; *# The Product.patterns. * | &quot;patterns&quot;; *# The Product.conditions. * | &quot;conditions&quot;; *# The textual custom attribute in Product object. Key can * *# be any key in the Product.attributes map * *# if the attribute values are textual. * *# map. * | &quot;attributes.key&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.PICKUP_IN_STORE. * | &quot;pickupInStore&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.SHIP_TO_STORE. * | &quot;shipToStore&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.SAME_DAY_DELIVERY. * | &quot;sameDayDelivery&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.NEXT_DAY_DELIVERY. * | &quot;nextDayDelivery&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_1. * | &quot;customFulfillment1&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_2. * | &quot;customFulfillment2&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_3. * | &quot;customFulfillment3&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_4. * | &quot;customFulfillment4&quot;; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_5. * | &quot;customFulfillment5&quot;; * numerical_field = *# The PriceInfo.price. * &quot;price&quot;; *# The discount. Computed by (original_price-price)/price * &quot;discount&quot;; *# The Rating.average_rating. * &quot;rating&quot;; *# The Rating.rating_count. * &quot;ratingCount&quot;; *# The numerical custom attribute in Product object. Key can * *# be any key in the Product.attributes map * *# if the attribute values are numerical. * | &quot;attributes.key&quot;;
-        &quot;orderBy&quot;: &quot;A String&quot;, # The order in which Facet.values are returned. Allowed values are: * &quot;count desc&quot;, which means order by Facet.FacetValue.count descending. * &quot;value desc&quot;, which means order by Facet.FacetValue.value descending. Only applies to textual facets. If not set, textual values are sorted in [natural order](https://en.wikipedia.org/wiki/Natural_sort_order); numerical intervals are sorted in the order given by FacetSpec.FacetKey.intervals; FulfillmentInfo.ids are sorted in the order given by FacetSpec.FacetKey.restricted_values.
+        &quot;key&quot;: &quot;A String&quot;, # Required. Supported textual and numerical facet keys in Product object, over which the facet values are computed. Facet key is case-sensitive. Allowed facet keys when FacetKey.query is not specified: * textual_field = *# The Product.brands. * | &quot;brands&quot;; *# The Product.categories. * | &quot;categories&quot;; *# The Audience.genders. * | &quot;genders&quot;; *# The Audience.age_groups. * | &quot;ageGroups&quot;; *# The Product.availability. Value is one of * *# &quot;IN_STOCK&quot;, &quot;OUT_OF_STOCK&quot;, PREORDER&quot;, &quot;BACKORDER&quot;. * | &quot;availability&quot;; *# The ColorInfo.color_families. * | &quot;colorFamilies&quot;; *# The ColorInfo.colors. * | &quot;colors&quot;; *# The Product.sizes. * | &quot;sizes&quot;; *# The Product.materials. * | &quot;materials&quot;; *# The Product.patterns. * | &quot;patterns&quot;; *# The Product.conditions. * | &quot;conditions&quot;; *# The textual custom attribute in Product object. Key can * *# be any key in the Product.attributes map * *# if the attribute values are textual. * | &quot;attributes.key&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;pickup-in-store&quot;. * | &quot;pickupInStore&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;ship-to-store&quot;. * | &quot;shipToStore&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;same-day-delivery&quot;. * | &quot;sameDayDelivery&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;next-day-delivery&quot;. * | &quot;nextDayDelivery&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;custom-type-1&quot;. * | &quot;customFulfillment1&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;custom-type-2&quot;. * | &quot;customFulfillment2&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;custom-type-3&quot;. * | &quot;customFulfillment3&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;custom-type-4&quot;. * | &quot;customFulfillment4&quot;; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# &quot;custom-type-5&quot;. * | &quot;customFulfillment5&quot;; * numerical_field = *# The PriceInfo.price. * | &quot;price&quot;; *# The discount. Computed by (original_price-price)/price * | &quot;discount&quot;; *# The Rating.average_rating. * | &quot;rating&quot;; *# The Rating.rating_count. * | &quot;ratingCount&quot;; *# The numerical custom attribute in Product object. Key can * *# be any key in the Product.attributes map * *# if the attribute values are numerical. * | &quot;attributes.key&quot;;
+        &quot;orderBy&quot;: &quot;A String&quot;, # The order in which Facet.values are returned. Allowed values are: * &quot;count desc&quot;, which means order by Facet.FacetValue.count descending. * &quot;value desc&quot;, which means order by Facet.FacetValue.value descending. Only applies to textual facets. If not set, textual values are sorted in [natural order](https://en.wikipedia.org/wiki/Natural_sort_order); numerical intervals are sorted in the order given by FacetSpec.FacetKey.intervals; FulfillmentInfo.place_ids are sorted in the order given by FacetSpec.FacetKey.restricted_values.
         &quot;prefixes&quot;: [ # Only get facet values that start with the given string prefix. For example, suppose &quot;categories&quot; has three values &quot;Women &gt; Shoe&quot;, &quot;Women &gt; Dress&quot; and &quot;Men &gt; Shoe&quot;. If set &quot;prefixes&quot; to &quot;Women&quot;, the &quot;categories&quot; facet will give only &quot;Women &gt; Shoe&quot; and &quot;Women &gt; Dress&quot;. Only supported on textual fields. Maximum is 10.
           &quot;A String&quot;,
         ],
@@ -389,7 +389,7 @@
     &quot;userAgent&quot;: &quot;A String&quot;, # User agent as included in the HTTP header. Required for getting SearchResponse.sponsored_results. The field must be a UTF-8 encoded string with a length limit of 1,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. This should not be set when using the client side event reporting with GTM or JavaScript tag in UserEventService.CollectUserEvent or if direct_user_request is set.
     &quot;userId&quot;: &quot;A String&quot;, # Highly recommended for logged-in users. Unique identifier for logged-in user, such as a user name. The field must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned.
   },
-  &quot;variantRollupKeys&quot;: [ # The keys to fetch and rollup the matching variant Products attributes. The attributes from all the matching variant Products are merged and de-duplicated. Notice that rollup variant Products attributes will lead to extra query latency. Maximum number of keys is 10. For Product.fulfillment_info, a fulfillment type and a fulfillment ID must be provided in the format of &quot;fulfillmentType.filfillmentId&quot;. E.g., in &quot;pickupInStore.store123&quot;, &quot;pickupInStore&quot; is fulfillment type and &quot;store123&quot; is the store ID. Supported keys are: * colorFamilies * price * originalPrice * discount * attributes.key, where key is any key in the Product.attributes map. * pickupInStore.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.PICKUP_IN_STORE. * shipToStore.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.SHIP_TO_STORE. * sameDayDelivery.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.SAME_DAY_DELIVERY. * nextDayDelivery.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.NEXT_DAY_DELIVERY. * customFulfillment1.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_1. * customFulfillment2.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_2. * customFulfillment3.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_3. * customFulfillment4.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_4. * customFulfillment5.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_5. If this field is set to an invalid value other than these, an INVALID_ARGUMENT error is returned.
+  &quot;variantRollupKeys&quot;: [ # The keys to fetch and rollup the matching variant Products attributes. The attributes from all the matching variant Products are merged and de-duplicated. Notice that rollup variant Products attributes will lead to extra query latency. Maximum number of keys is 10. For FulfillmentInfo, a fulfillment type and a fulfillment ID must be provided in the format of &quot;fulfillmentType.fulfillmentId&quot;. E.g., in &quot;pickupInStore.store123&quot;, &quot;pickupInStore&quot; is fulfillment type and &quot;store123&quot; is the store ID. Supported keys are: * colorFamilies * price * originalPrice * discount * attributes.key, where key is any key in the Product.attributes map. * pickupInStore.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;pickup-in-store&quot;. * shipToStore.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;ship-to-store&quot;. * sameDayDelivery.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;same-day-delivery&quot;. * nextDayDelivery.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;next-day-delivery&quot;. * customFulfillment1.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;custom-type-1&quot;. * customFulfillment2.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;custom-type-2&quot;. * customFulfillment3.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;custom-type-3&quot;. * customFulfillment4.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;custom-type-4&quot;. * customFulfillment5.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type &quot;custom-type-5&quot;. If this field is set to an invalid value other than these, an INVALID_ARGUMENT error is returned.
     &quot;A String&quot;,
   ],
   &quot;visitorId&quot;: &quot;A String&quot;, # Required. A unique identifier for tracking visitors. For example, this could be implemented with an HTTP cookie, which should be able to uniquely identify a visitor on a single device. This unique identifier should not change if the visitor logs in or out of the website. The field must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -543,7 +543,7 @@
             42,
           ],
         },
-        &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+        &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
         &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
           &quot;A String&quot;,
         ],
@@ -558,7 +558,7 @@
           # Object with schema name: GoogleCloudRetailV2betaProduct
         ],
       },
-      &quot;variantRollupValues&quot;: { # The rollup matching variant Product attributes. The key is one of the SearchRequest.variant_rollup_keys. The values are the merged and de-duplicated Product attributes. Notice that the rollup values are respect filter. For example, when filtering by &quot;colorFamilies:ANY(\&quot;red\&quot;)&quot; and rollup &quot;colorFamilies&quot;, only &quot;red&quot; is returned. For textual and numerical attributes, the rollup values is a list of string or double values with type google.protobuf.ListValue. For example, if there are two variants with colors &quot;red&quot; and &quot;blue&quot;, the rollup values are { key: &quot;colorFamilies&quot; value { list_value { values { string_value: &quot;red&quot; } values { string_value: &quot;blue&quot; } } } } For Product.fulfillment_info, the rollup values is a double value with type google.protobuf.Value. For example, {key: &quot;pickupInStore.store1&quot; value { number_value: 10 }} means a there are 10 variants in this product are available in the store &quot;store1&quot;.
+      &quot;variantRollupValues&quot;: { # The rollup matching variant Product attributes. The key is one of the SearchRequest.variant_rollup_keys. The values are the merged and de-duplicated Product attributes. Notice that the rollup values are respect filter. For example, when filtering by &quot;colorFamilies:ANY(\&quot;red\&quot;)&quot; and rollup &quot;colorFamilies&quot;, only &quot;red&quot; is returned. For textual and numerical attributes, the rollup values is a list of string or double values with type google.protobuf.ListValue. For example, if there are two variants with colors &quot;red&quot; and &quot;blue&quot;, the rollup values are { key: &quot;colorFamilies&quot; value { list_value { values { string_value: &quot;red&quot; } values { string_value: &quot;blue&quot; } } } } For FulfillmentInfo, the rollup values is a double value with type google.protobuf.Value. For example, {key: &quot;pickupInStore.store1&quot; value { number_value: 10 }} means a there are 10 variants in this product are available in the store &quot;store1&quot;.
         &quot;a_key&quot;: &quot;&quot;,
       },
     },
diff --git a/docs/dyn/retail_v2beta.projects.locations.catalogs.userEvents.html b/docs/dyn/retail_v2beta.projects.locations.catalogs.userEvents.html
index 9374ea6..5c022c7 100644
--- a/docs/dyn/retail_v2beta.projects.locations.catalogs.userEvents.html
+++ b/docs/dyn/retail_v2beta.projects.locations.catalogs.userEvents.html
@@ -194,7 +194,7 @@
           &quot;pageViewId&quot;: &quot;A String&quot;, # A unique id of a web page view. This should be kept the same for all user events triggered from the same pageview. For example, an item detail page view could trigger multiple events as the user is browsing the page. The `pageViewId` property should be kept the same for all these events so that they can be grouped together properly. When using the client side event reporting with JavaScript pixel and Google Tag Manager, this value is filled in automatically.
           &quot;productDetails&quot;: [ # The main product details related to the event. This field is required for the following event types: * `add-to-cart` * `detail-page-view` * `purchase-complete` In a `search` event, this field represents the products returned to the end user on the current page (the end user may have not finished broswing the whole page yet). When a new page is returned to the end user, after pagination/filtering/ordering even for the same query, a new `search` event with different product_details is desired. The end user may have not finished broswing the whole page yet.
             { # Detailed product information associated with a user event.
-              &quot;product&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. Product information. Only Product.id field is used when ingesting an event, all other product fields are ignored as we will look them up from the catalog.
+              &quot;product&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. Product information. Required field(s): * Product.id Optional override field(s): * Product.price_info If any supported optional fields are provided, we will treat them as a full override when looking up product information from the catalog. Thus, it is important to ensure that the overriding fields are accurate and complete. All other product fields are ignored and instead populated via catalog lookup after event ingestion.
                 &quot;attributes&quot;: { # Highly encouraged. Extra product attributes to be included. For example, for products, this could include the store name, vendor, style, color, etc. These are very strong signals for recommendation model, thus we highly recommend providing the attributes here. Features that can take on one of a limited number of possible values. Two types of features can be set are: Textual features. some examples would be the brand/maker of a product, or country of a customer. Numerical features. Some examples would be the height/weight of a product, or age of a customer. For example: `{ &quot;vendor&quot;: {&quot;text&quot;: [&quot;vendor123&quot;, &quot;vendor456&quot;]}, &quot;lengths_cm&quot;: {&quot;numbers&quot;:[2.3, 15.4]}, &quot;heights_cm&quot;: {&quot;numbers&quot;:[8.1, 6.4]} }`. This field needs to pass all below criteria, otherwise an INVALID_ARGUMENT error is returned: * Max entries count: 200 by default; 100 for Type.VARIANT. * The key must be a UTF-8 encoded string with a length limit of 128 characters. * Max indexable entries count: 200 by default; 40 for Type.VARIANT. * Max searchable entries count: 30. * For indexable attribute, the key must match the pattern: a-zA-Z0-9*. For example, key0LikeThis or KEY_1_LIKE_THIS.
                   &quot;a_key&quot;: { # A custom attribute that is not explicitly modeled in Product.
                     &quot;indexable&quot;: True or False, # If true, custom attribute values are indexed, so that it can be filtered, faceted or boosted in SearchService.Search. This field is ignored in a UserEvent. See SearchRequest.filter, SearchRequest.facet_specs and SearchRequest.boost_spec for more details.
@@ -301,7 +301,7 @@
                     42,
                   ],
                 },
-                &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+                &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
                 &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
                   &quot;A String&quot;,
                 ],
@@ -500,7 +500,7 @@
   &quot;pageViewId&quot;: &quot;A String&quot;, # A unique id of a web page view. This should be kept the same for all user events triggered from the same pageview. For example, an item detail page view could trigger multiple events as the user is browsing the page. The `pageViewId` property should be kept the same for all these events so that they can be grouped together properly. When using the client side event reporting with JavaScript pixel and Google Tag Manager, this value is filled in automatically.
   &quot;productDetails&quot;: [ # The main product details related to the event. This field is required for the following event types: * `add-to-cart` * `detail-page-view` * `purchase-complete` In a `search` event, this field represents the products returned to the end user on the current page (the end user may have not finished broswing the whole page yet). When a new page is returned to the end user, after pagination/filtering/ordering even for the same query, a new `search` event with different product_details is desired. The end user may have not finished broswing the whole page yet.
     { # Detailed product information associated with a user event.
-      &quot;product&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. Product information. Only Product.id field is used when ingesting an event, all other product fields are ignored as we will look them up from the catalog.
+      &quot;product&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. Product information. Required field(s): * Product.id Optional override field(s): * Product.price_info If any supported optional fields are provided, we will treat them as a full override when looking up product information from the catalog. Thus, it is important to ensure that the overriding fields are accurate and complete. All other product fields are ignored and instead populated via catalog lookup after event ingestion.
         &quot;attributes&quot;: { # Highly encouraged. Extra product attributes to be included. For example, for products, this could include the store name, vendor, style, color, etc. These are very strong signals for recommendation model, thus we highly recommend providing the attributes here. Features that can take on one of a limited number of possible values. Two types of features can be set are: Textual features. some examples would be the brand/maker of a product, or country of a customer. Numerical features. Some examples would be the height/weight of a product, or age of a customer. For example: `{ &quot;vendor&quot;: {&quot;text&quot;: [&quot;vendor123&quot;, &quot;vendor456&quot;]}, &quot;lengths_cm&quot;: {&quot;numbers&quot;:[2.3, 15.4]}, &quot;heights_cm&quot;: {&quot;numbers&quot;:[8.1, 6.4]} }`. This field needs to pass all below criteria, otherwise an INVALID_ARGUMENT error is returned: * Max entries count: 200 by default; 100 for Type.VARIANT. * The key must be a UTF-8 encoded string with a length limit of 128 characters. * Max indexable entries count: 200 by default; 40 for Type.VARIANT. * Max searchable entries count: 30. * For indexable attribute, the key must match the pattern: a-zA-Z0-9*. For example, key0LikeThis or KEY_1_LIKE_THIS.
           &quot;a_key&quot;: { # A custom attribute that is not explicitly modeled in Product.
             &quot;indexable&quot;: True or False, # If true, custom attribute values are indexed, so that it can be filtered, faceted or boosted in SearchService.Search. This field is ignored in a UserEvent. See SearchRequest.filter, SearchRequest.facet_specs and SearchRequest.boost_spec for more details.
@@ -607,7 +607,7 @@
             42,
           ],
         },
-        &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+        &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
         &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
           &quot;A String&quot;,
         ],
@@ -687,7 +687,7 @@
   &quot;pageViewId&quot;: &quot;A String&quot;, # A unique id of a web page view. This should be kept the same for all user events triggered from the same pageview. For example, an item detail page view could trigger multiple events as the user is browsing the page. The `pageViewId` property should be kept the same for all these events so that they can be grouped together properly. When using the client side event reporting with JavaScript pixel and Google Tag Manager, this value is filled in automatically.
   &quot;productDetails&quot;: [ # The main product details related to the event. This field is required for the following event types: * `add-to-cart` * `detail-page-view` * `purchase-complete` In a `search` event, this field represents the products returned to the end user on the current page (the end user may have not finished broswing the whole page yet). When a new page is returned to the end user, after pagination/filtering/ordering even for the same query, a new `search` event with different product_details is desired. The end user may have not finished broswing the whole page yet.
     { # Detailed product information associated with a user event.
-      &quot;product&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. Product information. Only Product.id field is used when ingesting an event, all other product fields are ignored as we will look them up from the catalog.
+      &quot;product&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. Product information. Required field(s): * Product.id Optional override field(s): * Product.price_info If any supported optional fields are provided, we will treat them as a full override when looking up product information from the catalog. Thus, it is important to ensure that the overriding fields are accurate and complete. All other product fields are ignored and instead populated via catalog lookup after event ingestion.
         &quot;attributes&quot;: { # Highly encouraged. Extra product attributes to be included. For example, for products, this could include the store name, vendor, style, color, etc. These are very strong signals for recommendation model, thus we highly recommend providing the attributes here. Features that can take on one of a limited number of possible values. Two types of features can be set are: Textual features. some examples would be the brand/maker of a product, or country of a customer. Numerical features. Some examples would be the height/weight of a product, or age of a customer. For example: `{ &quot;vendor&quot;: {&quot;text&quot;: [&quot;vendor123&quot;, &quot;vendor456&quot;]}, &quot;lengths_cm&quot;: {&quot;numbers&quot;:[2.3, 15.4]}, &quot;heights_cm&quot;: {&quot;numbers&quot;:[8.1, 6.4]} }`. This field needs to pass all below criteria, otherwise an INVALID_ARGUMENT error is returned: * Max entries count: 200 by default; 100 for Type.VARIANT. * The key must be a UTF-8 encoded string with a length limit of 128 characters. * Max indexable entries count: 200 by default; 40 for Type.VARIANT. * Max searchable entries count: 30. * For indexable attribute, the key must match the pattern: a-zA-Z0-9*. For example, key0LikeThis or KEY_1_LIKE_THIS.
           &quot;a_key&quot;: { # A custom attribute that is not explicitly modeled in Product.
             &quot;indexable&quot;: True or False, # If true, custom attribute values are indexed, so that it can be filtered, faceted or boosted in SearchService.Search. This field is ignored in a UserEvent. See SearchRequest.filter, SearchRequest.facet_specs and SearchRequest.boost_spec for more details.
@@ -794,7 +794,7 @@
             42,
           ],
         },
-        &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.
+        &quot;retrievableFields&quot;: &quot;A String&quot;, # Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form &quot;attributes.key&quot; where &quot;key&quot; is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.
         &quot;sizes&quot;: [ # The size of the product. To represent different size systems or size types, consider using this format: [[[size_system:]size_type:]size_value]. For example, in &quot;US:MENS:M&quot;, &quot;US&quot; represents size system; &quot;MENS&quot; represents size type; &quot;M&quot; represents size value. In &quot;GIRLS:27&quot;, size system is empty; &quot;GIRLS&quot; represents size type; &quot;27&quot; represents size value. In &quot;32 inches&quot;, both size system and size type are empty, while size value is &quot;32 inches&quot;. A maximum of 20 values are allowed per Product. Each value must be a UTF-8 encoded string with a length limit of 128 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [size](https://support.google.com/merchants/answer/6324492), [size_type](https://support.google.com/merchants/answer/6324497) and [size_system](https://support.google.com/merchants/answer/6324502). Schema.org property [Product.size](https://schema.org/size).
           &quot;A String&quot;,
         ],
diff --git a/docs/dyn/serviceusage_v1.services.html b/docs/dyn/serviceusage_v1.services.html
index 83b09da..a70d238 100644
--- a/docs/dyn/serviceusage_v1.services.html
+++ b/docs/dyn/serviceusage_v1.services.html
@@ -279,7 +279,7 @@
             ],
             &quot;launchStage&quot;: &quot;A String&quot;, # Optional. The launch stage of the monitored resource definition.
             &quot;name&quot;: &quot;A String&quot;, # Optional. The resource name of the monitored resource descriptor: `&quot;projects/{project_id}/monitoredResourceDescriptors/{type}&quot;` where {type} is the value of the `type` field in this object and {project_id} is a project ID that provides API-specific context for accessing the type. APIs that do not use project information can use the resource name format `&quot;monitoredResourceDescriptors/{type}&quot;`.
-            &quot;type&quot;: &quot;A String&quot;, # Required. The monitored resource type. For example, the type `&quot;cloudsql_database&quot;` represents databases in Google Cloud SQL.
+            &quot;type&quot;: &quot;A String&quot;, # Required. The monitored resource type. For example, the type `&quot;cloudsql_database&quot;` represents databases in Google Cloud SQL. For a list of types, see [Monitoring resource types](https://cloud.google.com/monitoring/api/resources) and [Logging resource types](https://cloud.google.com/logging/docs/api/v2/resource-list).
           },
         ],
         &quot;monitoring&quot;: { # Monitoring configuration of the service. The example below shows how to configure monitored resources and metrics for monitoring. In the example, a monitored resource and two metrics are defined. The `library.googleapis.com/book/returned_count` metric is sent to both producer and consumer projects, whereas the `library.googleapis.com/book/num_overdue` metric is only sent to the consumer project. monitored_resources: - type: library.googleapis.com/Branch display_name: &quot;Library Branch&quot; description: &quot;A branch of a library.&quot; launch_stage: GA labels: - key: resource_container description: &quot;The Cloud container (ie. project id) for the Branch.&quot; - key: location description: &quot;The location of the library branch.&quot; - key: branch_id description: &quot;The id of the branch.&quot; metrics: - name: library.googleapis.com/book/returned_count display_name: &quot;Books Returned&quot; description: &quot;The count of books that have been returned.&quot; launch_stage: GA metric_kind: DELTA value_type: INT64 unit: &quot;1&quot; labels: - key: customer_id description: &quot;The id of the customer.&quot; - name: library.googleapis.com/book/num_overdue display_name: &quot;Books Overdue&quot; description: &quot;The current number of overdue books.&quot; launch_stage: GA metric_kind: GAUGE value_type: INT64 unit: &quot;1&quot; labels: - key: customer_id description: &quot;The id of the customer.&quot; monitoring: producer_destinations: - monitored_resource: library.googleapis.com/Branch metrics: - library.googleapis.com/book/returned_count consumer_destinations: - monitored_resource: library.googleapis.com/Branch metrics: - library.googleapis.com/book/returned_count - library.googleapis.com/book/num_overdue # Monitoring configuration. This should not include the &#x27;producer_destinations&#x27; field.
@@ -572,7 +572,7 @@
         ],
         &quot;launchStage&quot;: &quot;A String&quot;, # Optional. The launch stage of the monitored resource definition.
         &quot;name&quot;: &quot;A String&quot;, # Optional. The resource name of the monitored resource descriptor: `&quot;projects/{project_id}/monitoredResourceDescriptors/{type}&quot;` where {type} is the value of the `type` field in this object and {project_id} is a project ID that provides API-specific context for accessing the type. APIs that do not use project information can use the resource name format `&quot;monitoredResourceDescriptors/{type}&quot;`.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The monitored resource type. For example, the type `&quot;cloudsql_database&quot;` represents databases in Google Cloud SQL.
+        &quot;type&quot;: &quot;A String&quot;, # Required. The monitored resource type. For example, the type `&quot;cloudsql_database&quot;` represents databases in Google Cloud SQL. For a list of types, see [Monitoring resource types](https://cloud.google.com/monitoring/api/resources) and [Logging resource types](https://cloud.google.com/logging/docs/api/v2/resource-list).
       },
     ],
     &quot;monitoring&quot;: { # Monitoring configuration of the service. The example below shows how to configure monitored resources and metrics for monitoring. In the example, a monitored resource and two metrics are defined. The `library.googleapis.com/book/returned_count` metric is sent to both producer and consumer projects, whereas the `library.googleapis.com/book/num_overdue` metric is only sent to the consumer project. monitored_resources: - type: library.googleapis.com/Branch display_name: &quot;Library Branch&quot; description: &quot;A branch of a library.&quot; launch_stage: GA labels: - key: resource_container description: &quot;The Cloud container (ie. project id) for the Branch.&quot; - key: location description: &quot;The location of the library branch.&quot; - key: branch_id description: &quot;The id of the branch.&quot; metrics: - name: library.googleapis.com/book/returned_count display_name: &quot;Books Returned&quot; description: &quot;The count of books that have been returned.&quot; launch_stage: GA metric_kind: DELTA value_type: INT64 unit: &quot;1&quot; labels: - key: customer_id description: &quot;The id of the customer.&quot; - name: library.googleapis.com/book/num_overdue display_name: &quot;Books Overdue&quot; description: &quot;The current number of overdue books.&quot; launch_stage: GA metric_kind: GAUGE value_type: INT64 unit: &quot;1&quot; labels: - key: customer_id description: &quot;The id of the customer.&quot; monitoring: producer_destinations: - monitored_resource: library.googleapis.com/Branch metrics: - library.googleapis.com/book/returned_count consumer_destinations: - monitored_resource: library.googleapis.com/Branch metrics: - library.googleapis.com/book/returned_count - library.googleapis.com/book/num_overdue # Monitoring configuration. This should not include the &#x27;producer_destinations&#x27; field.
@@ -780,7 +780,7 @@
             ],
             &quot;launchStage&quot;: &quot;A String&quot;, # Optional. The launch stage of the monitored resource definition.
             &quot;name&quot;: &quot;A String&quot;, # Optional. The resource name of the monitored resource descriptor: `&quot;projects/{project_id}/monitoredResourceDescriptors/{type}&quot;` where {type} is the value of the `type` field in this object and {project_id} is a project ID that provides API-specific context for accessing the type. APIs that do not use project information can use the resource name format `&quot;monitoredResourceDescriptors/{type}&quot;`.
-            &quot;type&quot;: &quot;A String&quot;, # Required. The monitored resource type. For example, the type `&quot;cloudsql_database&quot;` represents databases in Google Cloud SQL.
+            &quot;type&quot;: &quot;A String&quot;, # Required. The monitored resource type. For example, the type `&quot;cloudsql_database&quot;` represents databases in Google Cloud SQL. For a list of types, see [Monitoring resource types](https://cloud.google.com/monitoring/api/resources) and [Logging resource types](https://cloud.google.com/logging/docs/api/v2/resource-list).
           },
         ],
         &quot;monitoring&quot;: { # Monitoring configuration of the service. The example below shows how to configure monitored resources and metrics for monitoring. In the example, a monitored resource and two metrics are defined. The `library.googleapis.com/book/returned_count` metric is sent to both producer and consumer projects, whereas the `library.googleapis.com/book/num_overdue` metric is only sent to the consumer project. monitored_resources: - type: library.googleapis.com/Branch display_name: &quot;Library Branch&quot; description: &quot;A branch of a library.&quot; launch_stage: GA labels: - key: resource_container description: &quot;The Cloud container (ie. project id) for the Branch.&quot; - key: location description: &quot;The location of the library branch.&quot; - key: branch_id description: &quot;The id of the branch.&quot; metrics: - name: library.googleapis.com/book/returned_count display_name: &quot;Books Returned&quot; description: &quot;The count of books that have been returned.&quot; launch_stage: GA metric_kind: DELTA value_type: INT64 unit: &quot;1&quot; labels: - key: customer_id description: &quot;The id of the customer.&quot; - name: library.googleapis.com/book/num_overdue display_name: &quot;Books Overdue&quot; description: &quot;The current number of overdue books.&quot; launch_stage: GA metric_kind: GAUGE value_type: INT64 unit: &quot;1&quot; labels: - key: customer_id description: &quot;The id of the customer.&quot; monitoring: producer_destinations: - monitored_resource: library.googleapis.com/Branch metrics: - library.googleapis.com/book/returned_count consumer_destinations: - monitored_resource: library.googleapis.com/Branch metrics: - library.googleapis.com/book/returned_count - library.googleapis.com/book/num_overdue # Monitoring configuration. This should not include the &#x27;producer_destinations&#x27; field.
diff --git a/docs/dyn/serviceusage_v1beta1.services.html b/docs/dyn/serviceusage_v1beta1.services.html
index 014992f..5dbc0e9 100644
--- a/docs/dyn/serviceusage_v1beta1.services.html
+++ b/docs/dyn/serviceusage_v1beta1.services.html
@@ -403,7 +403,7 @@
         ],
         &quot;launchStage&quot;: &quot;A String&quot;, # Optional. The launch stage of the monitored resource definition.
         &quot;name&quot;: &quot;A String&quot;, # Optional. The resource name of the monitored resource descriptor: `&quot;projects/{project_id}/monitoredResourceDescriptors/{type}&quot;` where {type} is the value of the `type` field in this object and {project_id} is a project ID that provides API-specific context for accessing the type. APIs that do not use project information can use the resource name format `&quot;monitoredResourceDescriptors/{type}&quot;`.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The monitored resource type. For example, the type `&quot;cloudsql_database&quot;` represents databases in Google Cloud SQL.
+        &quot;type&quot;: &quot;A String&quot;, # Required. The monitored resource type. For example, the type `&quot;cloudsql_database&quot;` represents databases in Google Cloud SQL. For a list of types, see [Monitoring resource types](https://cloud.google.com/monitoring/api/resources) and [Logging resource types](https://cloud.google.com/logging/docs/api/v2/resource-list).
       },
     ],
     &quot;monitoring&quot;: { # Monitoring configuration of the service. The example below shows how to configure monitored resources and metrics for monitoring. In the example, a monitored resource and two metrics are defined. The `library.googleapis.com/book/returned_count` metric is sent to both producer and consumer projects, whereas the `library.googleapis.com/book/num_overdue` metric is only sent to the consumer project. monitored_resources: - type: library.googleapis.com/Branch display_name: &quot;Library Branch&quot; description: &quot;A branch of a library.&quot; launch_stage: GA labels: - key: resource_container description: &quot;The Cloud container (ie. project id) for the Branch.&quot; - key: location description: &quot;The location of the library branch.&quot; - key: branch_id description: &quot;The id of the branch.&quot; metrics: - name: library.googleapis.com/book/returned_count display_name: &quot;Books Returned&quot; description: &quot;The count of books that have been returned.&quot; launch_stage: GA metric_kind: DELTA value_type: INT64 unit: &quot;1&quot; labels: - key: customer_id description: &quot;The id of the customer.&quot; - name: library.googleapis.com/book/num_overdue display_name: &quot;Books Overdue&quot; description: &quot;The current number of overdue books.&quot; launch_stage: GA metric_kind: GAUGE value_type: INT64 unit: &quot;1&quot; labels: - key: customer_id description: &quot;The id of the customer.&quot; monitoring: producer_destinations: - monitored_resource: library.googleapis.com/Branch metrics: - library.googleapis.com/book/returned_count consumer_destinations: - monitored_resource: library.googleapis.com/Branch metrics: - library.googleapis.com/book/returned_count - library.googleapis.com/book/num_overdue # Monitoring configuration. This should not include the &#x27;producer_destinations&#x27; field.
@@ -611,7 +611,7 @@
             ],
             &quot;launchStage&quot;: &quot;A String&quot;, # Optional. The launch stage of the monitored resource definition.
             &quot;name&quot;: &quot;A String&quot;, # Optional. The resource name of the monitored resource descriptor: `&quot;projects/{project_id}/monitoredResourceDescriptors/{type}&quot;` where {type} is the value of the `type` field in this object and {project_id} is a project ID that provides API-specific context for accessing the type. APIs that do not use project information can use the resource name format `&quot;monitoredResourceDescriptors/{type}&quot;`.
-            &quot;type&quot;: &quot;A String&quot;, # Required. The monitored resource type. For example, the type `&quot;cloudsql_database&quot;` represents databases in Google Cloud SQL.
+            &quot;type&quot;: &quot;A String&quot;, # Required. The monitored resource type. For example, the type `&quot;cloudsql_database&quot;` represents databases in Google Cloud SQL. For a list of types, see [Monitoring resource types](https://cloud.google.com/monitoring/api/resources) and [Logging resource types](https://cloud.google.com/logging/docs/api/v2/resource-list).
           },
         ],
         &quot;monitoring&quot;: { # Monitoring configuration of the service. The example below shows how to configure monitored resources and metrics for monitoring. In the example, a monitored resource and two metrics are defined. The `library.googleapis.com/book/returned_count` metric is sent to both producer and consumer projects, whereas the `library.googleapis.com/book/num_overdue` metric is only sent to the consumer project. monitored_resources: - type: library.googleapis.com/Branch display_name: &quot;Library Branch&quot; description: &quot;A branch of a library.&quot; launch_stage: GA labels: - key: resource_container description: &quot;The Cloud container (ie. project id) for the Branch.&quot; - key: location description: &quot;The location of the library branch.&quot; - key: branch_id description: &quot;The id of the branch.&quot; metrics: - name: library.googleapis.com/book/returned_count display_name: &quot;Books Returned&quot; description: &quot;The count of books that have been returned.&quot; launch_stage: GA metric_kind: DELTA value_type: INT64 unit: &quot;1&quot; labels: - key: customer_id description: &quot;The id of the customer.&quot; - name: library.googleapis.com/book/num_overdue display_name: &quot;Books Overdue&quot; description: &quot;The current number of overdue books.&quot; launch_stage: GA metric_kind: GAUGE value_type: INT64 unit: &quot;1&quot; labels: - key: customer_id description: &quot;The id of the customer.&quot; monitoring: producer_destinations: - monitored_resource: library.googleapis.com/Branch metrics: - library.googleapis.com/book/returned_count consumer_destinations: - monitored_resource: library.googleapis.com/Branch metrics: - library.googleapis.com/book/returned_count - library.googleapis.com/book/num_overdue # Monitoring configuration. This should not include the &#x27;producer_destinations&#x27; field.
diff --git a/docs/dyn/spanner_v1.projects.instances.html b/docs/dyn/spanner_v1.projects.instances.html
index 875fa51..2a86dc9 100644
--- a/docs/dyn/spanner_v1.projects.instances.html
+++ b/docs/dyn/spanner_v1.projects.instances.html
@@ -155,8 +155,8 @@
       &quot;a_key&quot;: &quot;A String&quot;,
     },
     &quot;name&quot;: &quot;A String&quot;, # Required. A unique identifier for the instance, which cannot be changed after the instance is created. Values are of the form `projects//instances/a-z*[a-z0-9]`. The final segment of the name must be between 2 and 64 characters in length.
-    &quot;nodeCount&quot;: 42, # The number of nodes allocated to this instance. This may be zero in API responses for instances that are not yet in state `READY`. See [the documentation](https://cloud.google.com/spanner/docs/instances#node_count) for more information about nodes.
-    &quot;processingUnits&quot;: 42, # The number of processing units allocated to this instance. At most one of processing_units or node_count should be present in the message. This may be zero in API responses for instances that are not yet in state `READY`.
+    &quot;nodeCount&quot;: 42, # The number of nodes allocated to this instance. At most one of either node_count or processing_units should be present in the message. This may be zero in API responses for instances that are not yet in state `READY`. See [the documentation](https://cloud.google.com/spanner/docs/compute-capacity) for more information about nodes and processing units.
+    &quot;processingUnits&quot;: 42, # The number of processing units allocated to this instance. At most one of processing_units or node_count should be present in the message. This may be zero in API responses for instances that are not yet in state `READY`. See [the documentation](https://cloud.google.com/spanner/docs/compute-capacity) for more information about nodes and processing units.
     &quot;state&quot;: &quot;A String&quot;, # Output only. The current instance state. For CreateInstance, the state must be either omitted or set to `CREATING`. For UpdateInstance, the state must be either omitted or set to `READY`.
   },
   &quot;instanceId&quot;: &quot;A String&quot;, # Required. The ID of the instance to create. Valid identifiers are of the form `a-z*[a-z0-9]` and must be between 2 and 64 characters in length.
@@ -234,8 +234,8 @@
     &quot;a_key&quot;: &quot;A String&quot;,
   },
   &quot;name&quot;: &quot;A String&quot;, # Required. A unique identifier for the instance, which cannot be changed after the instance is created. Values are of the form `projects//instances/a-z*[a-z0-9]`. The final segment of the name must be between 2 and 64 characters in length.
-  &quot;nodeCount&quot;: 42, # The number of nodes allocated to this instance. This may be zero in API responses for instances that are not yet in state `READY`. See [the documentation](https://cloud.google.com/spanner/docs/instances#node_count) for more information about nodes.
-  &quot;processingUnits&quot;: 42, # The number of processing units allocated to this instance. At most one of processing_units or node_count should be present in the message. This may be zero in API responses for instances that are not yet in state `READY`.
+  &quot;nodeCount&quot;: 42, # The number of nodes allocated to this instance. At most one of either node_count or processing_units should be present in the message. This may be zero in API responses for instances that are not yet in state `READY`. See [the documentation](https://cloud.google.com/spanner/docs/compute-capacity) for more information about nodes and processing units.
+  &quot;processingUnits&quot;: 42, # The number of processing units allocated to this instance. At most one of processing_units or node_count should be present in the message. This may be zero in API responses for instances that are not yet in state `READY`. See [the documentation](https://cloud.google.com/spanner/docs/compute-capacity) for more information about nodes and processing units.
   &quot;state&quot;: &quot;A String&quot;, # Output only. The current instance state. For CreateInstance, the state must be either omitted or set to `CREATING`. For UpdateInstance, the state must be either omitted or set to `READY`.
 }</pre>
 </div>
@@ -313,8 +313,8 @@
         &quot;a_key&quot;: &quot;A String&quot;,
       },
       &quot;name&quot;: &quot;A String&quot;, # Required. A unique identifier for the instance, which cannot be changed after the instance is created. Values are of the form `projects//instances/a-z*[a-z0-9]`. The final segment of the name must be between 2 and 64 characters in length.
-      &quot;nodeCount&quot;: 42, # The number of nodes allocated to this instance. This may be zero in API responses for instances that are not yet in state `READY`. See [the documentation](https://cloud.google.com/spanner/docs/instances#node_count) for more information about nodes.
-      &quot;processingUnits&quot;: 42, # The number of processing units allocated to this instance. At most one of processing_units or node_count should be present in the message. This may be zero in API responses for instances that are not yet in state `READY`.
+      &quot;nodeCount&quot;: 42, # The number of nodes allocated to this instance. At most one of either node_count or processing_units should be present in the message. This may be zero in API responses for instances that are not yet in state `READY`. See [the documentation](https://cloud.google.com/spanner/docs/compute-capacity) for more information about nodes and processing units.
+      &quot;processingUnits&quot;: 42, # The number of processing units allocated to this instance. At most one of processing_units or node_count should be present in the message. This may be zero in API responses for instances that are not yet in state `READY`. See [the documentation](https://cloud.google.com/spanner/docs/compute-capacity) for more information about nodes and processing units.
       &quot;state&quot;: &quot;A String&quot;, # Output only. The current instance state. For CreateInstance, the state must be either omitted or set to `CREATING`. For UpdateInstance, the state must be either omitted or set to `READY`.
     },
   ],
@@ -360,8 +360,8 @@
       &quot;a_key&quot;: &quot;A String&quot;,
     },
     &quot;name&quot;: &quot;A String&quot;, # Required. A unique identifier for the instance, which cannot be changed after the instance is created. Values are of the form `projects//instances/a-z*[a-z0-9]`. The final segment of the name must be between 2 and 64 characters in length.
-    &quot;nodeCount&quot;: 42, # The number of nodes allocated to this instance. This may be zero in API responses for instances that are not yet in state `READY`. See [the documentation](https://cloud.google.com/spanner/docs/instances#node_count) for more information about nodes.
-    &quot;processingUnits&quot;: 42, # The number of processing units allocated to this instance. At most one of processing_units or node_count should be present in the message. This may be zero in API responses for instances that are not yet in state `READY`.
+    &quot;nodeCount&quot;: 42, # The number of nodes allocated to this instance. At most one of either node_count or processing_units should be present in the message. This may be zero in API responses for instances that are not yet in state `READY`. See [the documentation](https://cloud.google.com/spanner/docs/compute-capacity) for more information about nodes and processing units.
+    &quot;processingUnits&quot;: 42, # The number of processing units allocated to this instance. At most one of processing_units or node_count should be present in the message. This may be zero in API responses for instances that are not yet in state `READY`. See [the documentation](https://cloud.google.com/spanner/docs/compute-capacity) for more information about nodes and processing units.
     &quot;state&quot;: &quot;A String&quot;, # Output only. The current instance state. For CreateInstance, the state must be either omitted or set to `CREATING`. For UpdateInstance, the state must be either omitted or set to `READY`.
   },
 }
diff --git a/docs/dyn/speech_v1p1beta1.speech.html b/docs/dyn/speech_v1p1beta1.speech.html
index ff43ade..0b1fda9 100644
--- a/docs/dyn/speech_v1p1beta1.speech.html
+++ b/docs/dyn/speech_v1p1beta1.speech.html
@@ -174,13 +174,6 @@
         ],
       },
     ],
-    &quot;transcriptNormalization&quot;: { # Transcription normalization configuration. Use transcription normalization to automatically replace parts of the transcript with phrases of your choosing. For StreamingRecognize, this normalization only applies to stable partial transcripts (stability &gt; 0.8) and final transcripts. # Use transcription normalization to automatically replace parts of the transcript with phrases of your choosing. For StreamingRecognize, this normalization only applies to stable partial transcripts (stability &gt; 0.8) and final transcripts.
-      &quot;entries&quot;: { # A single replacement configuration. # A list of replacement entries. We will perform replacement with one entry at a time. For example, the second entry in [&quot;cat&quot; =&gt; &quot;dog&quot;, &quot;mountain cat&quot; =&gt; &quot;mountain dog&quot;] will never be applied because we will always process the first entry before it. At most 100 entries.
-        &quot;caseSensitive&quot;: True or False, # Whether the search is case sensitive.
-        &quot;replace&quot;: &quot;A String&quot;, # What to replace with. Max length is 100 characters.
-        &quot;search&quot;: &quot;A String&quot;, # What to replace. Max length is 100 characters.
-      },
-    },
     &quot;useEnhanced&quot;: True or False, # Set to true to use an enhanced model for speech recognition. If `use_enhanced` is set to true and the `model` field is not set, then an appropriate enhanced model is chosen if an enhanced model exists for the audio. If `use_enhanced` is true and an enhanced version of the specified model does not exist, then the speech is recognized using the standard version of the specified model.
   },
   &quot;outputConfig&quot;: { # Specifies an optional destination for the recognition results. # Optional. Specifies an optional destination for the recognition results.
@@ -302,13 +295,6 @@
         ],
       },
     ],
-    &quot;transcriptNormalization&quot;: { # Transcription normalization configuration. Use transcription normalization to automatically replace parts of the transcript with phrases of your choosing. For StreamingRecognize, this normalization only applies to stable partial transcripts (stability &gt; 0.8) and final transcripts. # Use transcription normalization to automatically replace parts of the transcript with phrases of your choosing. For StreamingRecognize, this normalization only applies to stable partial transcripts (stability &gt; 0.8) and final transcripts.
-      &quot;entries&quot;: { # A single replacement configuration. # A list of replacement entries. We will perform replacement with one entry at a time. For example, the second entry in [&quot;cat&quot; =&gt; &quot;dog&quot;, &quot;mountain cat&quot; =&gt; &quot;mountain dog&quot;] will never be applied because we will always process the first entry before it. At most 100 entries.
-        &quot;caseSensitive&quot;: True or False, # Whether the search is case sensitive.
-        &quot;replace&quot;: &quot;A String&quot;, # What to replace with. Max length is 100 characters.
-        &quot;search&quot;: &quot;A String&quot;, # What to replace. Max length is 100 characters.
-      },
-    },
     &quot;useEnhanced&quot;: True or False, # Set to true to use an enhanced model for speech recognition. If `use_enhanced` is set to true and the `model` field is not set, then an appropriate enhanced model is chosen if an enhanced model exists for the audio. If `use_enhanced` is true and an enhanced version of the specified model does not exist, then the speech is recognized using the standard version of the specified model.
   },
 }
diff --git a/docs/dyn/storagetransfer_v1.transferJobs.html b/docs/dyn/storagetransfer_v1.transferJobs.html
index 4aa4a9b..2f78e3c 100644
--- a/docs/dyn/storagetransfer_v1.transferJobs.html
+++ b/docs/dyn/storagetransfer_v1.transferJobs.html
@@ -115,6 +115,9 @@
   &quot;description&quot;: &quot;A String&quot;, # A description provided by the user for the job. Its max length is 1024 bytes when Unicode-encoded.
   &quot;lastModificationTime&quot;: &quot;A String&quot;, # Output only. The time that the transfer job was last modified.
   &quot;latestOperationName&quot;: &quot;A String&quot;, # The name of the most recently started TransferOperation of this JobConfig. Present if a TransferOperation has been created for this JobConfig.
+  &quot;loggingConfig&quot;: { # Logging configure. # Logging configuration.
+    &quot;enableOnpremGcsTransferLogs&quot;: True or False, # Enables the Cloud Storage transfer logs for this transfer. This is only supported for transfer jobs with PosixFilesystem sources. The default is that logs are not generated for this transfer.
+  },
   &quot;name&quot;: &quot;A String&quot;, # A unique name (within the transfer project) assigned when the job is created. If this field is empty in a CreateTransferJobRequest, Storage Transfer Service assigns a unique name. Otherwise, the specified name is used as the unique name for this job. If the specified name is in use by a job, the creation request fails with an ALREADY_EXISTS error. This name must start with `&quot;transferJobs/&quot;` prefix and end with a letter or a number, and should be no more than 128 characters. For transfers involving PosixFilesystem, this name must start with &#x27;transferJobs/OPI&#x27; specifically. For all other transfer types, this name must not start with &#x27;transferJobs/OPI&#x27;. &#x27;transferJobs/OPI&#x27; is a reserved prefix for PosixFilesystem transfers. Non-PosixFilesystem example: `&quot;transferJobs/^(?!OPI)[A-Za-z0-9-._~]*[A-Za-z0-9]$&quot;` PosixFilesystem example: `&quot;transferJobs/OPI^[A-Za-z0-9-._~]*[A-Za-z0-9]$&quot;` Applications must not rely on the enforcement of naming requirements involving OPI. Invalid job names fail with an INVALID_ARGUMENT error.
   &quot;notificationConfig&quot;: { # Specification to configure notifications published to Pub/Sub. Notifications are published to the customer-provided topic using the following `PubsubMessage.attributes`: * `&quot;eventType&quot;`: one of the EventType values * `&quot;payloadFormat&quot;`: one of the PayloadFormat values * `&quot;projectId&quot;`: the project_id of the `TransferOperation` * `&quot;transferJobName&quot;`: the transfer_job_name of the `TransferOperation` * `&quot;transferOperationName&quot;`: the name of the `TransferOperation` The `PubsubMessage.data` contains a TransferOperation resource formatted according to the specified `PayloadFormat`. # Notification configuration. This is not supported for transfers involving PosixFilesystem.
     &quot;eventTypes&quot;: [ # Event types for which a notification is desired. If empty, send notifications for all event types.
@@ -158,7 +161,7 @@
       },
       &quot;bucketName&quot;: &quot;A String&quot;, # Required. S3 Bucket name (see [Creating a bucket](https://docs.aws.amazon.com/AmazonS3/latest/dev/create-bucket-get-location-example.html)).
       &quot;path&quot;: &quot;A String&quot;, # Root path to transfer objects. Must be an empty string or full path name that ends with a &#x27;/&#x27;. This field is treated as an object prefix. As such, it should generally not begin with a &#x27;/&#x27;.
-      &quot;roleArn&quot;: &quot;A String&quot;, # Input only. The Amazon Resource Name (ARN) of the role to support temporary credentials via `AssumeRoleWithWebIdentity`. For more information about ARNs, see [IAM ARNs](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns). When a role ARN is provided, Transfer Service fetches temporary credentials for the session using a `AssumeRoleWithWebIdentity` call for the provided role using the GoogleServiceAccount for this project.
+      &quot;roleArn&quot;: &quot;A String&quot;, # The Amazon Resource Name (ARN) of the role to support temporary credentials via `AssumeRoleWithWebIdentity`. For more information about ARNs, see [IAM ARNs](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns). When a role ARN is provided, Transfer Service fetches temporary credentials for the session using a `AssumeRoleWithWebIdentity` call for the provided role using the GoogleServiceAccount for this project.
     },
     &quot;azureBlobStorageDataSource&quot;: { # An AzureBlobStorageData resource can be a data source, but not a data sink. An AzureBlobStorageData resource represents one Azure container. The storage account determines the [Azure endpoint](https://docs.microsoft.com/en-us/azure/storage/common/storage-create-storage-account#storage-account-endpoints). In an AzureBlobStorageData resource, a blobs&#x27;s name is the [Azure Blob Storage blob&#x27;s key name](https://docs.microsoft.com/en-us/rest/api/storageservices/naming-and-referencing-containers--blobs--and-metadata#blob-names). # An Azure Blob Storage data source.
       &quot;azureCredentials&quot;: { # Azure credentials For information on our data retention policy for user credentials, see [User credentials](/storage-transfer/docs/data-retention#user-credentials). # Required. Input only. Credentials used to authenticate API requests to Azure. For information on our data retention policy for user credentials, see [User credentials](/storage-transfer/docs/data-retention#user-credentials).
@@ -191,6 +194,9 @@
       &quot;maxTimeElapsedSinceLastModification&quot;: &quot;A String&quot;, # If specified, only objects with a &quot;last modification time&quot; on or after `NOW` - `max_time_elapsed_since_last_modification` and objects that don&#x27;t have a &quot;last modification time&quot; are transferred. For each TransferOperation started by this TransferJob, `NOW` refers to the start_time of the `TransferOperation`.
       &quot;minTimeElapsedSinceLastModification&quot;: &quot;A String&quot;, # If specified, only objects with a &quot;last modification time&quot; before `NOW` - `min_time_elapsed_since_last_modification` and objects that don&#x27;t have a &quot;last modification time&quot; are transferred. For each TransferOperation started by this TransferJob, `NOW` refers to the start_time of the `TransferOperation`.
     },
+    &quot;posixDataSource&quot;: { # A POSIX filesystem data source or sink. # A POSIX Filesystem data source.
+      &quot;rootDirectory&quot;: &quot;A String&quot;, # Root directory path to the filesystem.
+    },
     &quot;transferOptions&quot;: { # TransferOptions define the actions to be performed on objects in a transfer. # If the option delete_objects_unique_in_sink is `true` and time-based object conditions such as &#x27;last modification time&#x27; are specified, the request fails with an INVALID_ARGUMENT error.
       &quot;deleteObjectsFromSourceAfterTransfer&quot;: True or False, # Whether objects should be deleted from the source after they are transferred to the sink. **Note:** This option and delete_objects_unique_in_sink are mutually exclusive.
       &quot;deleteObjectsUniqueInSink&quot;: True or False, # Whether objects that exist only in the sink should be deleted. **Note:** This option and delete_objects_from_source_after_transfer are mutually exclusive.
@@ -213,6 +219,9 @@
   &quot;description&quot;: &quot;A String&quot;, # A description provided by the user for the job. Its max length is 1024 bytes when Unicode-encoded.
   &quot;lastModificationTime&quot;: &quot;A String&quot;, # Output only. The time that the transfer job was last modified.
   &quot;latestOperationName&quot;: &quot;A String&quot;, # The name of the most recently started TransferOperation of this JobConfig. Present if a TransferOperation has been created for this JobConfig.
+  &quot;loggingConfig&quot;: { # Logging configure. # Logging configuration.
+    &quot;enableOnpremGcsTransferLogs&quot;: True or False, # Enables the Cloud Storage transfer logs for this transfer. This is only supported for transfer jobs with PosixFilesystem sources. The default is that logs are not generated for this transfer.
+  },
   &quot;name&quot;: &quot;A String&quot;, # A unique name (within the transfer project) assigned when the job is created. If this field is empty in a CreateTransferJobRequest, Storage Transfer Service assigns a unique name. Otherwise, the specified name is used as the unique name for this job. If the specified name is in use by a job, the creation request fails with an ALREADY_EXISTS error. This name must start with `&quot;transferJobs/&quot;` prefix and end with a letter or a number, and should be no more than 128 characters. For transfers involving PosixFilesystem, this name must start with &#x27;transferJobs/OPI&#x27; specifically. For all other transfer types, this name must not start with &#x27;transferJobs/OPI&#x27;. &#x27;transferJobs/OPI&#x27; is a reserved prefix for PosixFilesystem transfers. Non-PosixFilesystem example: `&quot;transferJobs/^(?!OPI)[A-Za-z0-9-._~]*[A-Za-z0-9]$&quot;` PosixFilesystem example: `&quot;transferJobs/OPI^[A-Za-z0-9-._~]*[A-Za-z0-9]$&quot;` Applications must not rely on the enforcement of naming requirements involving OPI. Invalid job names fail with an INVALID_ARGUMENT error.
   &quot;notificationConfig&quot;: { # Specification to configure notifications published to Pub/Sub. Notifications are published to the customer-provided topic using the following `PubsubMessage.attributes`: * `&quot;eventType&quot;`: one of the EventType values * `&quot;payloadFormat&quot;`: one of the PayloadFormat values * `&quot;projectId&quot;`: the project_id of the `TransferOperation` * `&quot;transferJobName&quot;`: the transfer_job_name of the `TransferOperation` * `&quot;transferOperationName&quot;`: the name of the `TransferOperation` The `PubsubMessage.data` contains a TransferOperation resource formatted according to the specified `PayloadFormat`. # Notification configuration. This is not supported for transfers involving PosixFilesystem.
     &quot;eventTypes&quot;: [ # Event types for which a notification is desired. If empty, send notifications for all event types.
@@ -256,7 +265,7 @@
       },
       &quot;bucketName&quot;: &quot;A String&quot;, # Required. S3 Bucket name (see [Creating a bucket](https://docs.aws.amazon.com/AmazonS3/latest/dev/create-bucket-get-location-example.html)).
       &quot;path&quot;: &quot;A String&quot;, # Root path to transfer objects. Must be an empty string or full path name that ends with a &#x27;/&#x27;. This field is treated as an object prefix. As such, it should generally not begin with a &#x27;/&#x27;.
-      &quot;roleArn&quot;: &quot;A String&quot;, # Input only. The Amazon Resource Name (ARN) of the role to support temporary credentials via `AssumeRoleWithWebIdentity`. For more information about ARNs, see [IAM ARNs](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns). When a role ARN is provided, Transfer Service fetches temporary credentials for the session using a `AssumeRoleWithWebIdentity` call for the provided role using the GoogleServiceAccount for this project.
+      &quot;roleArn&quot;: &quot;A String&quot;, # The Amazon Resource Name (ARN) of the role to support temporary credentials via `AssumeRoleWithWebIdentity`. For more information about ARNs, see [IAM ARNs](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns). When a role ARN is provided, Transfer Service fetches temporary credentials for the session using a `AssumeRoleWithWebIdentity` call for the provided role using the GoogleServiceAccount for this project.
     },
     &quot;azureBlobStorageDataSource&quot;: { # An AzureBlobStorageData resource can be a data source, but not a data sink. An AzureBlobStorageData resource represents one Azure container. The storage account determines the [Azure endpoint](https://docs.microsoft.com/en-us/azure/storage/common/storage-create-storage-account#storage-account-endpoints). In an AzureBlobStorageData resource, a blobs&#x27;s name is the [Azure Blob Storage blob&#x27;s key name](https://docs.microsoft.com/en-us/rest/api/storageservices/naming-and-referencing-containers--blobs--and-metadata#blob-names). # An Azure Blob Storage data source.
       &quot;azureCredentials&quot;: { # Azure credentials For information on our data retention policy for user credentials, see [User credentials](/storage-transfer/docs/data-retention#user-credentials). # Required. Input only. Credentials used to authenticate API requests to Azure. For information on our data retention policy for user credentials, see [User credentials](/storage-transfer/docs/data-retention#user-credentials).
@@ -289,6 +298,9 @@
       &quot;maxTimeElapsedSinceLastModification&quot;: &quot;A String&quot;, # If specified, only objects with a &quot;last modification time&quot; on or after `NOW` - `max_time_elapsed_since_last_modification` and objects that don&#x27;t have a &quot;last modification time&quot; are transferred. For each TransferOperation started by this TransferJob, `NOW` refers to the start_time of the `TransferOperation`.
       &quot;minTimeElapsedSinceLastModification&quot;: &quot;A String&quot;, # If specified, only objects with a &quot;last modification time&quot; before `NOW` - `min_time_elapsed_since_last_modification` and objects that don&#x27;t have a &quot;last modification time&quot; are transferred. For each TransferOperation started by this TransferJob, `NOW` refers to the start_time of the `TransferOperation`.
     },
+    &quot;posixDataSource&quot;: { # A POSIX filesystem data source or sink. # A POSIX Filesystem data source.
+      &quot;rootDirectory&quot;: &quot;A String&quot;, # Root directory path to the filesystem.
+    },
     &quot;transferOptions&quot;: { # TransferOptions define the actions to be performed on objects in a transfer. # If the option delete_objects_unique_in_sink is `true` and time-based object conditions such as &#x27;last modification time&#x27; are specified, the request fails with an INVALID_ARGUMENT error.
       &quot;deleteObjectsFromSourceAfterTransfer&quot;: True or False, # Whether objects should be deleted from the source after they are transferred to the sink. **Note:** This option and delete_objects_unique_in_sink are mutually exclusive.
       &quot;deleteObjectsUniqueInSink&quot;: True or False, # Whether objects that exist only in the sink should be deleted. **Note:** This option and delete_objects_from_source_after_transfer are mutually exclusive.
@@ -303,7 +315,7 @@
   <pre>Gets a transfer job.
 
 Args:
-  jobName: string, Required. &quot; The job to get. (required)
+  jobName: string, Required. The job to get. (required)
   projectId: string, Required. The ID of the Google Cloud Platform Console project that owns the job. (required)
   x__xgafv: string, V1 error format.
     Allowed values
@@ -319,6 +331,9 @@
   &quot;description&quot;: &quot;A String&quot;, # A description provided by the user for the job. Its max length is 1024 bytes when Unicode-encoded.
   &quot;lastModificationTime&quot;: &quot;A String&quot;, # Output only. The time that the transfer job was last modified.
   &quot;latestOperationName&quot;: &quot;A String&quot;, # The name of the most recently started TransferOperation of this JobConfig. Present if a TransferOperation has been created for this JobConfig.
+  &quot;loggingConfig&quot;: { # Logging configure. # Logging configuration.
+    &quot;enableOnpremGcsTransferLogs&quot;: True or False, # Enables the Cloud Storage transfer logs for this transfer. This is only supported for transfer jobs with PosixFilesystem sources. The default is that logs are not generated for this transfer.
+  },
   &quot;name&quot;: &quot;A String&quot;, # A unique name (within the transfer project) assigned when the job is created. If this field is empty in a CreateTransferJobRequest, Storage Transfer Service assigns a unique name. Otherwise, the specified name is used as the unique name for this job. If the specified name is in use by a job, the creation request fails with an ALREADY_EXISTS error. This name must start with `&quot;transferJobs/&quot;` prefix and end with a letter or a number, and should be no more than 128 characters. For transfers involving PosixFilesystem, this name must start with &#x27;transferJobs/OPI&#x27; specifically. For all other transfer types, this name must not start with &#x27;transferJobs/OPI&#x27;. &#x27;transferJobs/OPI&#x27; is a reserved prefix for PosixFilesystem transfers. Non-PosixFilesystem example: `&quot;transferJobs/^(?!OPI)[A-Za-z0-9-._~]*[A-Za-z0-9]$&quot;` PosixFilesystem example: `&quot;transferJobs/OPI^[A-Za-z0-9-._~]*[A-Za-z0-9]$&quot;` Applications must not rely on the enforcement of naming requirements involving OPI. Invalid job names fail with an INVALID_ARGUMENT error.
   &quot;notificationConfig&quot;: { # Specification to configure notifications published to Pub/Sub. Notifications are published to the customer-provided topic using the following `PubsubMessage.attributes`: * `&quot;eventType&quot;`: one of the EventType values * `&quot;payloadFormat&quot;`: one of the PayloadFormat values * `&quot;projectId&quot;`: the project_id of the `TransferOperation` * `&quot;transferJobName&quot;`: the transfer_job_name of the `TransferOperation` * `&quot;transferOperationName&quot;`: the name of the `TransferOperation` The `PubsubMessage.data` contains a TransferOperation resource formatted according to the specified `PayloadFormat`. # Notification configuration. This is not supported for transfers involving PosixFilesystem.
     &quot;eventTypes&quot;: [ # Event types for which a notification is desired. If empty, send notifications for all event types.
@@ -362,7 +377,7 @@
       },
       &quot;bucketName&quot;: &quot;A String&quot;, # Required. S3 Bucket name (see [Creating a bucket](https://docs.aws.amazon.com/AmazonS3/latest/dev/create-bucket-get-location-example.html)).
       &quot;path&quot;: &quot;A String&quot;, # Root path to transfer objects. Must be an empty string or full path name that ends with a &#x27;/&#x27;. This field is treated as an object prefix. As such, it should generally not begin with a &#x27;/&#x27;.
-      &quot;roleArn&quot;: &quot;A String&quot;, # Input only. The Amazon Resource Name (ARN) of the role to support temporary credentials via `AssumeRoleWithWebIdentity`. For more information about ARNs, see [IAM ARNs](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns). When a role ARN is provided, Transfer Service fetches temporary credentials for the session using a `AssumeRoleWithWebIdentity` call for the provided role using the GoogleServiceAccount for this project.
+      &quot;roleArn&quot;: &quot;A String&quot;, # The Amazon Resource Name (ARN) of the role to support temporary credentials via `AssumeRoleWithWebIdentity`. For more information about ARNs, see [IAM ARNs](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns). When a role ARN is provided, Transfer Service fetches temporary credentials for the session using a `AssumeRoleWithWebIdentity` call for the provided role using the GoogleServiceAccount for this project.
     },
     &quot;azureBlobStorageDataSource&quot;: { # An AzureBlobStorageData resource can be a data source, but not a data sink. An AzureBlobStorageData resource represents one Azure container. The storage account determines the [Azure endpoint](https://docs.microsoft.com/en-us/azure/storage/common/storage-create-storage-account#storage-account-endpoints). In an AzureBlobStorageData resource, a blobs&#x27;s name is the [Azure Blob Storage blob&#x27;s key name](https://docs.microsoft.com/en-us/rest/api/storageservices/naming-and-referencing-containers--blobs--and-metadata#blob-names). # An Azure Blob Storage data source.
       &quot;azureCredentials&quot;: { # Azure credentials For information on our data retention policy for user credentials, see [User credentials](/storage-transfer/docs/data-retention#user-credentials). # Required. Input only. Credentials used to authenticate API requests to Azure. For information on our data retention policy for user credentials, see [User credentials](/storage-transfer/docs/data-retention#user-credentials).
@@ -395,6 +410,9 @@
       &quot;maxTimeElapsedSinceLastModification&quot;: &quot;A String&quot;, # If specified, only objects with a &quot;last modification time&quot; on or after `NOW` - `max_time_elapsed_since_last_modification` and objects that don&#x27;t have a &quot;last modification time&quot; are transferred. For each TransferOperation started by this TransferJob, `NOW` refers to the start_time of the `TransferOperation`.
       &quot;minTimeElapsedSinceLastModification&quot;: &quot;A String&quot;, # If specified, only objects with a &quot;last modification time&quot; before `NOW` - `min_time_elapsed_since_last_modification` and objects that don&#x27;t have a &quot;last modification time&quot; are transferred. For each TransferOperation started by this TransferJob, `NOW` refers to the start_time of the `TransferOperation`.
     },
+    &quot;posixDataSource&quot;: { # A POSIX filesystem data source or sink. # A POSIX Filesystem data source.
+      &quot;rootDirectory&quot;: &quot;A String&quot;, # Root directory path to the filesystem.
+    },
     &quot;transferOptions&quot;: { # TransferOptions define the actions to be performed on objects in a transfer. # If the option delete_objects_unique_in_sink is `true` and time-based object conditions such as &#x27;last modification time&#x27; are specified, the request fails with an INVALID_ARGUMENT error.
       &quot;deleteObjectsFromSourceAfterTransfer&quot;: True or False, # Whether objects should be deleted from the source after they are transferred to the sink. **Note:** This option and delete_objects_unique_in_sink are mutually exclusive.
       &quot;deleteObjectsUniqueInSink&quot;: True or False, # Whether objects that exist only in the sink should be deleted. **Note:** This option and delete_objects_from_source_after_transfer are mutually exclusive.
@@ -429,6 +447,9 @@
       &quot;description&quot;: &quot;A String&quot;, # A description provided by the user for the job. Its max length is 1024 bytes when Unicode-encoded.
       &quot;lastModificationTime&quot;: &quot;A String&quot;, # Output only. The time that the transfer job was last modified.
       &quot;latestOperationName&quot;: &quot;A String&quot;, # The name of the most recently started TransferOperation of this JobConfig. Present if a TransferOperation has been created for this JobConfig.
+      &quot;loggingConfig&quot;: { # Logging configure. # Logging configuration.
+        &quot;enableOnpremGcsTransferLogs&quot;: True or False, # Enables the Cloud Storage transfer logs for this transfer. This is only supported for transfer jobs with PosixFilesystem sources. The default is that logs are not generated for this transfer.
+      },
       &quot;name&quot;: &quot;A String&quot;, # A unique name (within the transfer project) assigned when the job is created. If this field is empty in a CreateTransferJobRequest, Storage Transfer Service assigns a unique name. Otherwise, the specified name is used as the unique name for this job. If the specified name is in use by a job, the creation request fails with an ALREADY_EXISTS error. This name must start with `&quot;transferJobs/&quot;` prefix and end with a letter or a number, and should be no more than 128 characters. For transfers involving PosixFilesystem, this name must start with &#x27;transferJobs/OPI&#x27; specifically. For all other transfer types, this name must not start with &#x27;transferJobs/OPI&#x27;. &#x27;transferJobs/OPI&#x27; is a reserved prefix for PosixFilesystem transfers. Non-PosixFilesystem example: `&quot;transferJobs/^(?!OPI)[A-Za-z0-9-._~]*[A-Za-z0-9]$&quot;` PosixFilesystem example: `&quot;transferJobs/OPI^[A-Za-z0-9-._~]*[A-Za-z0-9]$&quot;` Applications must not rely on the enforcement of naming requirements involving OPI. Invalid job names fail with an INVALID_ARGUMENT error.
       &quot;notificationConfig&quot;: { # Specification to configure notifications published to Pub/Sub. Notifications are published to the customer-provided topic using the following `PubsubMessage.attributes`: * `&quot;eventType&quot;`: one of the EventType values * `&quot;payloadFormat&quot;`: one of the PayloadFormat values * `&quot;projectId&quot;`: the project_id of the `TransferOperation` * `&quot;transferJobName&quot;`: the transfer_job_name of the `TransferOperation` * `&quot;transferOperationName&quot;`: the name of the `TransferOperation` The `PubsubMessage.data` contains a TransferOperation resource formatted according to the specified `PayloadFormat`. # Notification configuration. This is not supported for transfers involving PosixFilesystem.
         &quot;eventTypes&quot;: [ # Event types for which a notification is desired. If empty, send notifications for all event types.
@@ -472,7 +493,7 @@
           },
           &quot;bucketName&quot;: &quot;A String&quot;, # Required. S3 Bucket name (see [Creating a bucket](https://docs.aws.amazon.com/AmazonS3/latest/dev/create-bucket-get-location-example.html)).
           &quot;path&quot;: &quot;A String&quot;, # Root path to transfer objects. Must be an empty string or full path name that ends with a &#x27;/&#x27;. This field is treated as an object prefix. As such, it should generally not begin with a &#x27;/&#x27;.
-          &quot;roleArn&quot;: &quot;A String&quot;, # Input only. The Amazon Resource Name (ARN) of the role to support temporary credentials via `AssumeRoleWithWebIdentity`. For more information about ARNs, see [IAM ARNs](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns). When a role ARN is provided, Transfer Service fetches temporary credentials for the session using a `AssumeRoleWithWebIdentity` call for the provided role using the GoogleServiceAccount for this project.
+          &quot;roleArn&quot;: &quot;A String&quot;, # The Amazon Resource Name (ARN) of the role to support temporary credentials via `AssumeRoleWithWebIdentity`. For more information about ARNs, see [IAM ARNs](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns). When a role ARN is provided, Transfer Service fetches temporary credentials for the session using a `AssumeRoleWithWebIdentity` call for the provided role using the GoogleServiceAccount for this project.
         },
         &quot;azureBlobStorageDataSource&quot;: { # An AzureBlobStorageData resource can be a data source, but not a data sink. An AzureBlobStorageData resource represents one Azure container. The storage account determines the [Azure endpoint](https://docs.microsoft.com/en-us/azure/storage/common/storage-create-storage-account#storage-account-endpoints). In an AzureBlobStorageData resource, a blobs&#x27;s name is the [Azure Blob Storage blob&#x27;s key name](https://docs.microsoft.com/en-us/rest/api/storageservices/naming-and-referencing-containers--blobs--and-metadata#blob-names). # An Azure Blob Storage data source.
           &quot;azureCredentials&quot;: { # Azure credentials For information on our data retention policy for user credentials, see [User credentials](/storage-transfer/docs/data-retention#user-credentials). # Required. Input only. Credentials used to authenticate API requests to Azure. For information on our data retention policy for user credentials, see [User credentials](/storage-transfer/docs/data-retention#user-credentials).
@@ -505,6 +526,9 @@
           &quot;maxTimeElapsedSinceLastModification&quot;: &quot;A String&quot;, # If specified, only objects with a &quot;last modification time&quot; on or after `NOW` - `max_time_elapsed_since_last_modification` and objects that don&#x27;t have a &quot;last modification time&quot; are transferred. For each TransferOperation started by this TransferJob, `NOW` refers to the start_time of the `TransferOperation`.
           &quot;minTimeElapsedSinceLastModification&quot;: &quot;A String&quot;, # If specified, only objects with a &quot;last modification time&quot; before `NOW` - `min_time_elapsed_since_last_modification` and objects that don&#x27;t have a &quot;last modification time&quot; are transferred. For each TransferOperation started by this TransferJob, `NOW` refers to the start_time of the `TransferOperation`.
         },
+        &quot;posixDataSource&quot;: { # A POSIX filesystem data source or sink. # A POSIX Filesystem data source.
+          &quot;rootDirectory&quot;: &quot;A String&quot;, # Root directory path to the filesystem.
+        },
         &quot;transferOptions&quot;: { # TransferOptions define the actions to be performed on objects in a transfer. # If the option delete_objects_unique_in_sink is `true` and time-based object conditions such as &#x27;last modification time&#x27; are specified, the request fails with an INVALID_ARGUMENT error.
           &quot;deleteObjectsFromSourceAfterTransfer&quot;: True or False, # Whether objects should be deleted from the source after they are transferred to the sink. **Note:** This option and delete_objects_unique_in_sink are mutually exclusive.
           &quot;deleteObjectsUniqueInSink&quot;: True or False, # Whether objects that exist only in the sink should be deleted. **Note:** This option and delete_objects_from_source_after_transfer are mutually exclusive.
@@ -547,6 +571,9 @@
     &quot;description&quot;: &quot;A String&quot;, # A description provided by the user for the job. Its max length is 1024 bytes when Unicode-encoded.
     &quot;lastModificationTime&quot;: &quot;A String&quot;, # Output only. The time that the transfer job was last modified.
     &quot;latestOperationName&quot;: &quot;A String&quot;, # The name of the most recently started TransferOperation of this JobConfig. Present if a TransferOperation has been created for this JobConfig.
+    &quot;loggingConfig&quot;: { # Logging configure. # Logging configuration.
+      &quot;enableOnpremGcsTransferLogs&quot;: True or False, # Enables the Cloud Storage transfer logs for this transfer. This is only supported for transfer jobs with PosixFilesystem sources. The default is that logs are not generated for this transfer.
+    },
     &quot;name&quot;: &quot;A String&quot;, # A unique name (within the transfer project) assigned when the job is created. If this field is empty in a CreateTransferJobRequest, Storage Transfer Service assigns a unique name. Otherwise, the specified name is used as the unique name for this job. If the specified name is in use by a job, the creation request fails with an ALREADY_EXISTS error. This name must start with `&quot;transferJobs/&quot;` prefix and end with a letter or a number, and should be no more than 128 characters. For transfers involving PosixFilesystem, this name must start with &#x27;transferJobs/OPI&#x27; specifically. For all other transfer types, this name must not start with &#x27;transferJobs/OPI&#x27;. &#x27;transferJobs/OPI&#x27; is a reserved prefix for PosixFilesystem transfers. Non-PosixFilesystem example: `&quot;transferJobs/^(?!OPI)[A-Za-z0-9-._~]*[A-Za-z0-9]$&quot;` PosixFilesystem example: `&quot;transferJobs/OPI^[A-Za-z0-9-._~]*[A-Za-z0-9]$&quot;` Applications must not rely on the enforcement of naming requirements involving OPI. Invalid job names fail with an INVALID_ARGUMENT error.
     &quot;notificationConfig&quot;: { # Specification to configure notifications published to Pub/Sub. Notifications are published to the customer-provided topic using the following `PubsubMessage.attributes`: * `&quot;eventType&quot;`: one of the EventType values * `&quot;payloadFormat&quot;`: one of the PayloadFormat values * `&quot;projectId&quot;`: the project_id of the `TransferOperation` * `&quot;transferJobName&quot;`: the transfer_job_name of the `TransferOperation` * `&quot;transferOperationName&quot;`: the name of the `TransferOperation` The `PubsubMessage.data` contains a TransferOperation resource formatted according to the specified `PayloadFormat`. # Notification configuration. This is not supported for transfers involving PosixFilesystem.
       &quot;eventTypes&quot;: [ # Event types for which a notification is desired. If empty, send notifications for all event types.
@@ -590,7 +617,7 @@
         },
         &quot;bucketName&quot;: &quot;A String&quot;, # Required. S3 Bucket name (see [Creating a bucket](https://docs.aws.amazon.com/AmazonS3/latest/dev/create-bucket-get-location-example.html)).
         &quot;path&quot;: &quot;A String&quot;, # Root path to transfer objects. Must be an empty string or full path name that ends with a &#x27;/&#x27;. This field is treated as an object prefix. As such, it should generally not begin with a &#x27;/&#x27;.
-        &quot;roleArn&quot;: &quot;A String&quot;, # Input only. The Amazon Resource Name (ARN) of the role to support temporary credentials via `AssumeRoleWithWebIdentity`. For more information about ARNs, see [IAM ARNs](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns). When a role ARN is provided, Transfer Service fetches temporary credentials for the session using a `AssumeRoleWithWebIdentity` call for the provided role using the GoogleServiceAccount for this project.
+        &quot;roleArn&quot;: &quot;A String&quot;, # The Amazon Resource Name (ARN) of the role to support temporary credentials via `AssumeRoleWithWebIdentity`. For more information about ARNs, see [IAM ARNs](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns). When a role ARN is provided, Transfer Service fetches temporary credentials for the session using a `AssumeRoleWithWebIdentity` call for the provided role using the GoogleServiceAccount for this project.
       },
       &quot;azureBlobStorageDataSource&quot;: { # An AzureBlobStorageData resource can be a data source, but not a data sink. An AzureBlobStorageData resource represents one Azure container. The storage account determines the [Azure endpoint](https://docs.microsoft.com/en-us/azure/storage/common/storage-create-storage-account#storage-account-endpoints). In an AzureBlobStorageData resource, a blobs&#x27;s name is the [Azure Blob Storage blob&#x27;s key name](https://docs.microsoft.com/en-us/rest/api/storageservices/naming-and-referencing-containers--blobs--and-metadata#blob-names). # An Azure Blob Storage data source.
         &quot;azureCredentials&quot;: { # Azure credentials For information on our data retention policy for user credentials, see [User credentials](/storage-transfer/docs/data-retention#user-credentials). # Required. Input only. Credentials used to authenticate API requests to Azure. For information on our data retention policy for user credentials, see [User credentials](/storage-transfer/docs/data-retention#user-credentials).
@@ -623,6 +650,9 @@
         &quot;maxTimeElapsedSinceLastModification&quot;: &quot;A String&quot;, # If specified, only objects with a &quot;last modification time&quot; on or after `NOW` - `max_time_elapsed_since_last_modification` and objects that don&#x27;t have a &quot;last modification time&quot; are transferred. For each TransferOperation started by this TransferJob, `NOW` refers to the start_time of the `TransferOperation`.
         &quot;minTimeElapsedSinceLastModification&quot;: &quot;A String&quot;, # If specified, only objects with a &quot;last modification time&quot; before `NOW` - `min_time_elapsed_since_last_modification` and objects that don&#x27;t have a &quot;last modification time&quot; are transferred. For each TransferOperation started by this TransferJob, `NOW` refers to the start_time of the `TransferOperation`.
       },
+      &quot;posixDataSource&quot;: { # A POSIX filesystem data source or sink. # A POSIX Filesystem data source.
+        &quot;rootDirectory&quot;: &quot;A String&quot;, # Root directory path to the filesystem.
+      },
       &quot;transferOptions&quot;: { # TransferOptions define the actions to be performed on objects in a transfer. # If the option delete_objects_unique_in_sink is `true` and time-based object conditions such as &#x27;last modification time&#x27; are specified, the request fails with an INVALID_ARGUMENT error.
         &quot;deleteObjectsFromSourceAfterTransfer&quot;: True or False, # Whether objects should be deleted from the source after they are transferred to the sink. **Note:** This option and delete_objects_unique_in_sink are mutually exclusive.
         &quot;deleteObjectsUniqueInSink&quot;: True or False, # Whether objects that exist only in the sink should be deleted. **Note:** This option and delete_objects_from_source_after_transfer are mutually exclusive.
@@ -647,6 +677,9 @@
   &quot;description&quot;: &quot;A String&quot;, # A description provided by the user for the job. Its max length is 1024 bytes when Unicode-encoded.
   &quot;lastModificationTime&quot;: &quot;A String&quot;, # Output only. The time that the transfer job was last modified.
   &quot;latestOperationName&quot;: &quot;A String&quot;, # The name of the most recently started TransferOperation of this JobConfig. Present if a TransferOperation has been created for this JobConfig.
+  &quot;loggingConfig&quot;: { # Logging configure. # Logging configuration.
+    &quot;enableOnpremGcsTransferLogs&quot;: True or False, # Enables the Cloud Storage transfer logs for this transfer. This is only supported for transfer jobs with PosixFilesystem sources. The default is that logs are not generated for this transfer.
+  },
   &quot;name&quot;: &quot;A String&quot;, # A unique name (within the transfer project) assigned when the job is created. If this field is empty in a CreateTransferJobRequest, Storage Transfer Service assigns a unique name. Otherwise, the specified name is used as the unique name for this job. If the specified name is in use by a job, the creation request fails with an ALREADY_EXISTS error. This name must start with `&quot;transferJobs/&quot;` prefix and end with a letter or a number, and should be no more than 128 characters. For transfers involving PosixFilesystem, this name must start with &#x27;transferJobs/OPI&#x27; specifically. For all other transfer types, this name must not start with &#x27;transferJobs/OPI&#x27;. &#x27;transferJobs/OPI&#x27; is a reserved prefix for PosixFilesystem transfers. Non-PosixFilesystem example: `&quot;transferJobs/^(?!OPI)[A-Za-z0-9-._~]*[A-Za-z0-9]$&quot;` PosixFilesystem example: `&quot;transferJobs/OPI^[A-Za-z0-9-._~]*[A-Za-z0-9]$&quot;` Applications must not rely on the enforcement of naming requirements involving OPI. Invalid job names fail with an INVALID_ARGUMENT error.
   &quot;notificationConfig&quot;: { # Specification to configure notifications published to Pub/Sub. Notifications are published to the customer-provided topic using the following `PubsubMessage.attributes`: * `&quot;eventType&quot;`: one of the EventType values * `&quot;payloadFormat&quot;`: one of the PayloadFormat values * `&quot;projectId&quot;`: the project_id of the `TransferOperation` * `&quot;transferJobName&quot;`: the transfer_job_name of the `TransferOperation` * `&quot;transferOperationName&quot;`: the name of the `TransferOperation` The `PubsubMessage.data` contains a TransferOperation resource formatted according to the specified `PayloadFormat`. # Notification configuration. This is not supported for transfers involving PosixFilesystem.
     &quot;eventTypes&quot;: [ # Event types for which a notification is desired. If empty, send notifications for all event types.
@@ -690,7 +723,7 @@
       },
       &quot;bucketName&quot;: &quot;A String&quot;, # Required. S3 Bucket name (see [Creating a bucket](https://docs.aws.amazon.com/AmazonS3/latest/dev/create-bucket-get-location-example.html)).
       &quot;path&quot;: &quot;A String&quot;, # Root path to transfer objects. Must be an empty string or full path name that ends with a &#x27;/&#x27;. This field is treated as an object prefix. As such, it should generally not begin with a &#x27;/&#x27;.
-      &quot;roleArn&quot;: &quot;A String&quot;, # Input only. The Amazon Resource Name (ARN) of the role to support temporary credentials via `AssumeRoleWithWebIdentity`. For more information about ARNs, see [IAM ARNs](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns). When a role ARN is provided, Transfer Service fetches temporary credentials for the session using a `AssumeRoleWithWebIdentity` call for the provided role using the GoogleServiceAccount for this project.
+      &quot;roleArn&quot;: &quot;A String&quot;, # The Amazon Resource Name (ARN) of the role to support temporary credentials via `AssumeRoleWithWebIdentity`. For more information about ARNs, see [IAM ARNs](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns). When a role ARN is provided, Transfer Service fetches temporary credentials for the session using a `AssumeRoleWithWebIdentity` call for the provided role using the GoogleServiceAccount for this project.
     },
     &quot;azureBlobStorageDataSource&quot;: { # An AzureBlobStorageData resource can be a data source, but not a data sink. An AzureBlobStorageData resource represents one Azure container. The storage account determines the [Azure endpoint](https://docs.microsoft.com/en-us/azure/storage/common/storage-create-storage-account#storage-account-endpoints). In an AzureBlobStorageData resource, a blobs&#x27;s name is the [Azure Blob Storage blob&#x27;s key name](https://docs.microsoft.com/en-us/rest/api/storageservices/naming-and-referencing-containers--blobs--and-metadata#blob-names). # An Azure Blob Storage data source.
       &quot;azureCredentials&quot;: { # Azure credentials For information on our data retention policy for user credentials, see [User credentials](/storage-transfer/docs/data-retention#user-credentials). # Required. Input only. Credentials used to authenticate API requests to Azure. For information on our data retention policy for user credentials, see [User credentials](/storage-transfer/docs/data-retention#user-credentials).
@@ -723,6 +756,9 @@
       &quot;maxTimeElapsedSinceLastModification&quot;: &quot;A String&quot;, # If specified, only objects with a &quot;last modification time&quot; on or after `NOW` - `max_time_elapsed_since_last_modification` and objects that don&#x27;t have a &quot;last modification time&quot; are transferred. For each TransferOperation started by this TransferJob, `NOW` refers to the start_time of the `TransferOperation`.
       &quot;minTimeElapsedSinceLastModification&quot;: &quot;A String&quot;, # If specified, only objects with a &quot;last modification time&quot; before `NOW` - `min_time_elapsed_since_last_modification` and objects that don&#x27;t have a &quot;last modification time&quot; are transferred. For each TransferOperation started by this TransferJob, `NOW` refers to the start_time of the `TransferOperation`.
     },
+    &quot;posixDataSource&quot;: { # A POSIX filesystem data source or sink. # A POSIX Filesystem data source.
+      &quot;rootDirectory&quot;: &quot;A String&quot;, # Root directory path to the filesystem.
+    },
     &quot;transferOptions&quot;: { # TransferOptions define the actions to be performed on objects in a transfer. # If the option delete_objects_unique_in_sink is `true` and time-based object conditions such as &#x27;last modification time&#x27; are specified, the request fails with an INVALID_ARGUMENT error.
       &quot;deleteObjectsFromSourceAfterTransfer&quot;: True or False, # Whether objects should be deleted from the source after they are transferred to the sink. **Note:** This option and delete_objects_unique_in_sink are mutually exclusive.
       &quot;deleteObjectsUniqueInSink&quot;: True or False, # Whether objects that exist only in the sink should be deleted. **Note:** This option and delete_objects_from_source_after_transfer are mutually exclusive.
diff --git a/docs/dyn/sts_v1.v1.html b/docs/dyn/sts_v1.v1.html
index 113c877..0ddf0a0 100644
--- a/docs/dyn/sts_v1.v1.html
+++ b/docs/dyn/sts_v1.v1.html
@@ -118,7 +118,7 @@
   &quot;iss&quot;: &quot;A String&quot;, # The issuer of the provided token.
   &quot;scope&quot;: &quot;A String&quot;, # A list of scopes associated with the provided token.
   &quot;sub&quot;: &quot;A String&quot;, # The unique user ID associated with the provided token. For Google Accounts, this value is based on the Google Account&#x27;s user ID. For federated identities, this value is based on the identity pool ID and the value of the mapped `google.subject` attribute.
-  &quot;username&quot;: &quot;A String&quot;, # The human-readable identifier for the token principal subject. For example, if the provided token is associated with a workload identity pool, this field contains a value in the following format: `principal://iam.googleapis.com/projects//locations//workloadIdentityPools//subject/`
+  &quot;username&quot;: &quot;A String&quot;, # The human-readable identifier for the token principal subject. For example, if the provided token is associated with a workload identity pool, this field contains a value in the following format: `principal://iam.googleapis.com/projects//locations/global/workloadIdentityPools//subject/`
 }</pre>
 </div>
 
@@ -131,12 +131,12 @@
     The object takes the form of:
 
 { # Request message for ExchangeToken.
-  &quot;audience&quot;: &quot;A String&quot;, # The full resource name of the identity provider; for example: `//iam.googleapis.com/projects//workloadIdentityPools//providers/`. Required when exchanging an external credential for a Google access token.
+  &quot;audience&quot;: &quot;A String&quot;, # The full resource name of the identity provider; for example: `//iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/`. Required when exchanging an external credential for a Google access token.
   &quot;grantType&quot;: &quot;A String&quot;, # Required. The grant type. Must be `urn:ietf:params:oauth:grant-type:token-exchange`, which indicates a token exchange.
   &quot;options&quot;: &quot;A String&quot;, # A set of features that Security Token Service supports, in addition to the standard OAuth 2.0 token exchange, formatted as a serialized JSON object of Options.
   &quot;requestedTokenType&quot;: &quot;A String&quot;, # Required. An identifier for the type of requested security token. Must be `urn:ietf:params:oauth:token-type:access_token`.
   &quot;scope&quot;: &quot;A String&quot;, # The OAuth 2.0 scopes to include on the resulting access token, formatted as a list of space-delimited, case-sensitive strings. Required when exchanging an external credential for a Google access token.
-  &quot;subjectToken&quot;: &quot;A String&quot;, # Required. The input token. This token is either an external credential issued by a workload identity pool provider, or a short-lived access token issued by Google. If the token is an OIDC JWT, it must use the JWT format defined in [RFC 7523](https://tools.ietf.org/html/rfc7523), and the `subject_token_type` must be either `urn:ietf:params:oauth:token-type:jwt` or `urn:ietf:params:oauth:token-type:id_token`. The following headers are required: - `kid`: The identifier of the signing key securing the JWT. - `alg`: The cryptographic algorithm securing the JWT. Must be `RS256` or `ES256`. The following payload fields are required. For more information, see [RFC 7523, Section 3](https://tools.ietf.org/html/rfc7523#section-3): - `iss`: The issuer of the token. The issuer must provide a discovery document at the URL `/.well-known/openid-configuration`, where `` is the value of this field. The document must be formatted according to section 4.2 of the [OIDC 1.0 Discovery specification](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). - `iat`: The issue time, in seconds, since the Unix epoch. Must be in the past. - `exp`: The expiration time, in seconds, since the Unix epoch. Must be less than 48 hours after `iat`. Shorter expiration times are more secure. If possible, we recommend setting an expiration time less than 6 hours. - `sub`: The identity asserted in the JWT. - `aud`: For workload identity pools, this must be a value specified in the allowed audiences for the workload identity pool provider, or one of the audiences allowed by default if no audiences were specified. See https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.providers#oidc Example header: ``` { &quot;alg&quot;: &quot;RS256&quot;, &quot;kid&quot;: &quot;us-east-11&quot; } ``` Example payload: ``` { &quot;iss&quot;: &quot;https://accounts.google.com&quot;, &quot;iat&quot;: 1517963104, &quot;exp&quot;: 1517966704, &quot;aud&quot;: &quot;//iam.googleapis.com/projects/1234567890123/locations/global/workloadIdentityPools/my-pool/providers/my-provider&quot;, &quot;sub&quot;: &quot;113475438248934895348&quot;, &quot;my_claims&quot;: { &quot;additional_claim&quot;: &quot;value&quot; } } ``` If `subject_token` is for AWS, it must be a serialized `GetCallerIdentity` token. This token contains the same information as a request to the AWS [`GetCallerIdentity()`](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity) method, as well as the AWS [signature](https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html) for the request information. Use Signature Version 4. Format the request as URL-encoded JSON, and set the `subject_token_type` parameter to `urn:ietf:params:aws:token-type:aws4_request`. The following parameters are required: - `url`: The URL of the AWS STS endpoint for `GetCallerIdentity()`, such as `https://sts.amazonaws.com?Action=GetCallerIdentity&amp;Version=2011-06-15`. Regional endpoints are also supported. - `method`: The HTTP request method: `POST`. - `headers`: The HTTP request headers, which must include: - `Authorization`: The request signature. - `x-amz-date`: The time you will send the request, formatted as an [ISO8601 Basic](https://docs.aws.amazon.com/general/latest/gr/sigv4_elements.html#sigv4_elements_date) string. This value is typically set to the current time and is used to help prevent replay attacks. - `host`: The hostname of the `url` field; for example, `sts.amazonaws.com`. - `x-goog-cloud-target-resource`: The full, canonical resource name of the workload identity pool provider, with or without an `https:` prefix. To help ensure data integrity, we recommend including this header in the `SignedHeaders` field of the signed request. For example: //iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ If you are using temporary security credentials provided by AWS, you must also include the header `x-amz-security-token`, with the value set to the session token. The following example shows a `GetCallerIdentity` token: ``` { &quot;headers&quot;: [ {&quot;key&quot;: &quot;x-amz-date&quot;, &quot;value&quot;: &quot;20200815T015049Z&quot;}, {&quot;key&quot;: &quot;Authorization&quot;, &quot;value&quot;: &quot;AWS4-HMAC-SHA256+Credential=$credential,+SignedHeaders=host;x-amz-date;x-goog-cloud-target-resource,+Signature=$signature&quot;}, {&quot;key&quot;: &quot;x-goog-cloud-target-resource&quot;, &quot;value&quot;: &quot;//iam.googleapis.com/projects//locations//workloadIdentityPools//providers/&quot;}, {&quot;key&quot;: &quot;host&quot;, &quot;value&quot;: &quot;sts.amazonaws.com&quot;} . ], &quot;method&quot;: &quot;POST&quot;, &quot;url&quot;: &quot;https://sts.amazonaws.com?Action=GetCallerIdentity&amp;Version=2011-06-15&quot; } ``` You can also use a Google-issued OAuth 2.0 access token with this field to obtain an access token with new security attributes applied, such as a Credential Access Boundary. In this case, set `subject_token_type` to `urn:ietf:params:oauth:token-type:access_token`. If an access token already contains security attributes, you cannot apply additional security attributes.
+  &quot;subjectToken&quot;: &quot;A String&quot;, # Required. The input token. This token is either an external credential issued by a workload identity pool provider, or a short-lived access token issued by Google. If the token is an OIDC JWT, it must use the JWT format defined in [RFC 7523](https://tools.ietf.org/html/rfc7523), and the `subject_token_type` must be either `urn:ietf:params:oauth:token-type:jwt` or `urn:ietf:params:oauth:token-type:id_token`. The following headers are required: - `kid`: The identifier of the signing key securing the JWT. - `alg`: The cryptographic algorithm securing the JWT. Must be `RS256` or `ES256`. The following payload fields are required. For more information, see [RFC 7523, Section 3](https://tools.ietf.org/html/rfc7523#section-3): - `iss`: The issuer of the token. The issuer must provide a discovery document at the URL `/.well-known/openid-configuration`, where `` is the value of this field. The document must be formatted according to section 4.2 of the [OIDC 1.0 Discovery specification](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). - `iat`: The issue time, in seconds, since the Unix epoch. Must be in the past. - `exp`: The expiration time, in seconds, since the Unix epoch. Must be less than 48 hours after `iat`. Shorter expiration times are more secure. If possible, we recommend setting an expiration time less than 6 hours. - `sub`: The identity asserted in the JWT. - `aud`: For workload identity pools, this must be a value specified in the allowed audiences for the workload identity pool provider, or one of the audiences allowed by default if no audiences were specified. See https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.providers#oidc Example header: ``` { &quot;alg&quot;: &quot;RS256&quot;, &quot;kid&quot;: &quot;us-east-11&quot; } ``` Example payload: ``` { &quot;iss&quot;: &quot;https://accounts.google.com&quot;, &quot;iat&quot;: 1517963104, &quot;exp&quot;: 1517966704, &quot;aud&quot;: &quot;//iam.googleapis.com/projects/1234567890123/locations/global/workloadIdentityPools/my-pool/providers/my-provider&quot;, &quot;sub&quot;: &quot;113475438248934895348&quot;, &quot;my_claims&quot;: { &quot;additional_claim&quot;: &quot;value&quot; } } ``` If `subject_token` is for AWS, it must be a serialized `GetCallerIdentity` token. This token contains the same information as a request to the AWS [`GetCallerIdentity()`](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity) method, as well as the AWS [signature](https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html) for the request information. Use Signature Version 4. Format the request as URL-encoded JSON, and set the `subject_token_type` parameter to `urn:ietf:params:aws:token-type:aws4_request`. The following parameters are required: - `url`: The URL of the AWS STS endpoint for `GetCallerIdentity()`, such as `https://sts.amazonaws.com?Action=GetCallerIdentity&amp;Version=2011-06-15`. Regional endpoints are also supported. - `method`: The HTTP request method: `POST`. - `headers`: The HTTP request headers, which must include: - `Authorization`: The request signature. - `x-amz-date`: The time you will send the request, formatted as an [ISO8601 Basic](https://docs.aws.amazon.com/general/latest/gr/sigv4_elements.html#sigv4_elements_date) string. This value is typically set to the current time and is used to help prevent replay attacks. - `host`: The hostname of the `url` field; for example, `sts.amazonaws.com`. - `x-goog-cloud-target-resource`: The full, canonical resource name of the workload identity pool provider, with or without an `https:` prefix. To help ensure data integrity, we recommend including this header in the `SignedHeaders` field of the signed request. For example: //iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ If you are using temporary security credentials provided by AWS, you must also include the header `x-amz-security-token`, with the value set to the session token. The following example shows a `GetCallerIdentity` token: ``` { &quot;headers&quot;: [ {&quot;key&quot;: &quot;x-amz-date&quot;, &quot;value&quot;: &quot;20200815T015049Z&quot;}, {&quot;key&quot;: &quot;Authorization&quot;, &quot;value&quot;: &quot;AWS4-HMAC-SHA256+Credential=$credential,+SignedHeaders=host;x-amz-date;x-goog-cloud-target-resource,+Signature=$signature&quot;}, {&quot;key&quot;: &quot;x-goog-cloud-target-resource&quot;, &quot;value&quot;: &quot;//iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/&quot;}, {&quot;key&quot;: &quot;host&quot;, &quot;value&quot;: &quot;sts.amazonaws.com&quot;} . ], &quot;method&quot;: &quot;POST&quot;, &quot;url&quot;: &quot;https://sts.amazonaws.com?Action=GetCallerIdentity&amp;Version=2011-06-15&quot; } ``` You can also use a Google-issued OAuth 2.0 access token with this field to obtain an access token with new security attributes applied, such as a Credential Access Boundary. In this case, set `subject_token_type` to `urn:ietf:params:oauth:token-type:access_token`. If an access token already contains security attributes, you cannot apply additional security attributes.
   &quot;subjectTokenType&quot;: &quot;A String&quot;, # Required. An identifier that indicates the type of the security token in the `subject_token` parameter. Supported values are `urn:ietf:params:oauth:token-type:jwt`, `urn:ietf:params:oauth:token-type:id_token`, `urn:ietf:params:aws:token-type:aws4_request`, and `urn:ietf:params:oauth:token-type:access_token`.
 }
 
diff --git a/docs/dyn/sts_v1beta.v1beta.html b/docs/dyn/sts_v1beta.v1beta.html
index 44ba55f..c394345 100644
--- a/docs/dyn/sts_v1beta.v1beta.html
+++ b/docs/dyn/sts_v1beta.v1beta.html
@@ -95,12 +95,12 @@
     The object takes the form of:
 
 { # Request message for ExchangeToken.
-  &quot;audience&quot;: &quot;A String&quot;, # The full resource name of the identity provider. For example, `//iam.googleapis.com/projects//workloadIdentityPools//providers/`. Required when exchanging an external credential for a Google access token.
+  &quot;audience&quot;: &quot;A String&quot;, # The full resource name of the identity provider. For example, `//iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/`. Required when exchanging an external credential for a Google access token.
   &quot;grantType&quot;: &quot;A String&quot;, # Required. The grant type. Must be `urn:ietf:params:oauth:grant-type:token-exchange`, which indicates a token exchange.
   &quot;options&quot;: &quot;A String&quot;, # A set of features that Security Token Service supports, in addition to the standard OAuth 2.0 token exchange, formatted as a serialized JSON object of Options.
   &quot;requestedTokenType&quot;: &quot;A String&quot;, # Required. The type of security token. Must be `urn:ietf:params:oauth:token-type:access_token`, which indicates an OAuth 2.0 access token.
   &quot;scope&quot;: &quot;A String&quot;, # The OAuth 2.0 scopes to include on the resulting access token, formatted as a list of space-delimited, case-sensitive strings. Required when exchanging an external credential for a Google access token.
-  &quot;subjectToken&quot;: &quot;A String&quot;, # Required. The input token. This token is either an external credential issued by a workload identity pool provider, or a short-lived access token issued by Google. If the token is an OIDC JWT, it must use the JWT format defined in [RFC 7523](https://tools.ietf.org/html/rfc7523), and the `subject_token_type` must be either `urn:ietf:params:oauth:token-type:jwt` or `urn:ietf:params:oauth:token-type:id_token`. The following headers are required: - `kid`: The identifier of the signing key securing the JWT. - `alg`: The cryptographic algorithm securing the JWT. Must be `RS256` or `ES256`. The following payload fields are required. For more information, see [RFC 7523, Section 3](https://tools.ietf.org/html/rfc7523#section-3): - `iss`: The issuer of the token. The issuer must provide a discovery document at the URL `/.well-known/openid-configuration`, where `` is the value of this field. The document must be formatted according to section 4.2 of the [OIDC 1.0 Discovery specification](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). - `iat`: The issue time, in seconds, since the Unix epoch. Must be in the past. - `exp`: The expiration time, in seconds, since the Unix epoch. Must be less than 48 hours after `iat`. Shorter expiration times are more secure. If possible, we recommend setting an expiration time less than 6 hours. - `sub`: The identity asserted in the JWT. - `aud`: For workload identity pools, this must be a value specified in the allowed audiences for the workload identity pool provider, or one of the audiences allowed by default if no audiences were specified. See https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.providers#oidc Example header: ``` { &quot;alg&quot;: &quot;RS256&quot;, &quot;kid&quot;: &quot;us-east-11&quot; } ``` Example payload: ``` { &quot;iss&quot;: &quot;https://accounts.google.com&quot;, &quot;iat&quot;: 1517963104, &quot;exp&quot;: 1517966704, &quot;aud&quot;: &quot;//iam.googleapis.com/projects/1234567890123/locations/global/workloadIdentityPools/my-pool/providers/my-provider&quot;, &quot;sub&quot;: &quot;113475438248934895348&quot;, &quot;my_claims&quot;: { &quot;additional_claim&quot;: &quot;value&quot; } } ``` If `subject_token` is for AWS, it must be a serialized `GetCallerIdentity` token. This token contains the same information as a request to the AWS [`GetCallerIdentity()`](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity) method, as well as the AWS [signature](https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html) for the request information. Use Signature Version 4. Format the request as URL-encoded JSON, and set the `subject_token_type` parameter to `urn:ietf:params:aws:token-type:aws4_request`. The following parameters are required: - `url`: The URL of the AWS STS endpoint for `GetCallerIdentity()`, such as `https://sts.amazonaws.com?Action=GetCallerIdentity&amp;Version=2011-06-15`. Regional endpoints are also supported. - `method`: The HTTP request method: `POST`. - `headers`: The HTTP request headers, which must include: - `Authorization`: The request signature. - `x-amz-date`: The time you will send the request, formatted as an [ISO8601 Basic](https://docs.aws.amazon.com/general/latest/gr/sigv4_elements.html#sigv4_elements_date) string. This value is typically set to the current time and is used to help prevent replay attacks. - `host`: The hostname of the `url` field; for example, `sts.amazonaws.com`. - `x-goog-cloud-target-resource`: The full, canonical resource name of the workload identity pool provider, with or without an `https:` prefix. To help ensure data integrity, we recommend including this header in the `SignedHeaders` field of the signed request. For example: //iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ If you are using temporary security credentials provided by AWS, you must also include the header `x-amz-security-token`, with the value set to the session token. The following example shows a `GetCallerIdentity` token: ``` { &quot;headers&quot;: [ {&quot;key&quot;: &quot;x-amz-date&quot;, &quot;value&quot;: &quot;20200815T015049Z&quot;}, {&quot;key&quot;: &quot;Authorization&quot;, &quot;value&quot;: &quot;AWS4-HMAC-SHA256+Credential=$credential,+SignedHeaders=host;x-amz-date;x-goog-cloud-target-resource,+Signature=$signature&quot;}, {&quot;key&quot;: &quot;x-goog-cloud-target-resource&quot;, &quot;value&quot;: &quot;//iam.googleapis.com/projects//locations//workloadIdentityPools//providers/&quot;}, {&quot;key&quot;: &quot;host&quot;, &quot;value&quot;: &quot;sts.amazonaws.com&quot;} . ], &quot;method&quot;: &quot;POST&quot;, &quot;url&quot;: &quot;https://sts.amazonaws.com?Action=GetCallerIdentity&amp;Version=2011-06-15&quot; } ``` You can also use a Google-issued OAuth 2.0 access token with this field to obtain an access token with new security attributes applied, such as a Credential Access Boundary. In this case, set `subject_token_type` to `urn:ietf:params:oauth:token-type:access_token`. If an access token already contains security attributes, you cannot apply additional security attributes.
+  &quot;subjectToken&quot;: &quot;A String&quot;, # Required. The input token. This token is either an external credential issued by a workload identity pool provider, or a short-lived access token issued by Google. If the token is an OIDC JWT, it must use the JWT format defined in [RFC 7523](https://tools.ietf.org/html/rfc7523), and the `subject_token_type` must be either `urn:ietf:params:oauth:token-type:jwt` or `urn:ietf:params:oauth:token-type:id_token`. The following headers are required: - `kid`: The identifier of the signing key securing the JWT. - `alg`: The cryptographic algorithm securing the JWT. Must be `RS256` or `ES256`. The following payload fields are required. For more information, see [RFC 7523, Section 3](https://tools.ietf.org/html/rfc7523#section-3): - `iss`: The issuer of the token. The issuer must provide a discovery document at the URL `/.well-known/openid-configuration`, where `` is the value of this field. The document must be formatted according to section 4.2 of the [OIDC 1.0 Discovery specification](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). - `iat`: The issue time, in seconds, since the Unix epoch. Must be in the past. - `exp`: The expiration time, in seconds, since the Unix epoch. Must be less than 48 hours after `iat`. Shorter expiration times are more secure. If possible, we recommend setting an expiration time less than 6 hours. - `sub`: The identity asserted in the JWT. - `aud`: For workload identity pools, this must be a value specified in the allowed audiences for the workload identity pool provider, or one of the audiences allowed by default if no audiences were specified. See https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.providers#oidc Example header: ``` { &quot;alg&quot;: &quot;RS256&quot;, &quot;kid&quot;: &quot;us-east-11&quot; } ``` Example payload: ``` { &quot;iss&quot;: &quot;https://accounts.google.com&quot;, &quot;iat&quot;: 1517963104, &quot;exp&quot;: 1517966704, &quot;aud&quot;: &quot;//iam.googleapis.com/projects/1234567890123/locations/global/workloadIdentityPools/my-pool/providers/my-provider&quot;, &quot;sub&quot;: &quot;113475438248934895348&quot;, &quot;my_claims&quot;: { &quot;additional_claim&quot;: &quot;value&quot; } } ``` If `subject_token` is for AWS, it must be a serialized `GetCallerIdentity` token. This token contains the same information as a request to the AWS [`GetCallerIdentity()`](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity) method, as well as the AWS [signature](https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html) for the request information. Use Signature Version 4. Format the request as URL-encoded JSON, and set the `subject_token_type` parameter to `urn:ietf:params:aws:token-type:aws4_request`. The following parameters are required: - `url`: The URL of the AWS STS endpoint for `GetCallerIdentity()`, such as `https://sts.amazonaws.com?Action=GetCallerIdentity&amp;Version=2011-06-15`. Regional endpoints are also supported. - `method`: The HTTP request method: `POST`. - `headers`: The HTTP request headers, which must include: - `Authorization`: The request signature. - `x-amz-date`: The time you will send the request, formatted as an [ISO8601 Basic](https://docs.aws.amazon.com/general/latest/gr/sigv4_elements.html#sigv4_elements_date) string. This value is typically set to the current time and is used to help prevent replay attacks. - `host`: The hostname of the `url` field; for example, `sts.amazonaws.com`. - `x-goog-cloud-target-resource`: The full, canonical resource name of the workload identity pool provider, with or without an `https:` prefix. To help ensure data integrity, we recommend including this header in the `SignedHeaders` field of the signed request. For example: //iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ If you are using temporary security credentials provided by AWS, you must also include the header `x-amz-security-token`, with the value set to the session token. The following example shows a `GetCallerIdentity` token: ``` { &quot;headers&quot;: [ {&quot;key&quot;: &quot;x-amz-date&quot;, &quot;value&quot;: &quot;20200815T015049Z&quot;}, {&quot;key&quot;: &quot;Authorization&quot;, &quot;value&quot;: &quot;AWS4-HMAC-SHA256+Credential=$credential,+SignedHeaders=host;x-amz-date;x-goog-cloud-target-resource,+Signature=$signature&quot;}, {&quot;key&quot;: &quot;x-goog-cloud-target-resource&quot;, &quot;value&quot;: &quot;//iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/&quot;}, {&quot;key&quot;: &quot;host&quot;, &quot;value&quot;: &quot;sts.amazonaws.com&quot;} . ], &quot;method&quot;: &quot;POST&quot;, &quot;url&quot;: &quot;https://sts.amazonaws.com?Action=GetCallerIdentity&amp;Version=2011-06-15&quot; } ``` You can also use a Google-issued OAuth 2.0 access token with this field to obtain an access token with new security attributes applied, such as a Credential Access Boundary. In this case, set `subject_token_type` to `urn:ietf:params:oauth:token-type:access_token`. If an access token already contains security attributes, you cannot apply additional security attributes.
   &quot;subjectTokenType&quot;: &quot;A String&quot;, # Required. An identifier that indicates the type of the security token in the `subject_token` parameter. Supported values are `urn:ietf:params:oauth:token-type:jwt`, `urn:ietf:params:oauth:token-type:id_token`, `urn:ietf:params:aws:token-type:aws4_request`, and `urn:ietf:params:oauth:token-type:access_token`.
 }
 
diff --git a/googleapiclient/discovery_cache/documents/abusiveexperiencereport.v1.json b/googleapiclient/discovery_cache/documents/abusiveexperiencereport.v1.json
index 6a8ddda..519d376 100644
--- a/googleapiclient/discovery_cache/documents/abusiveexperiencereport.v1.json
+++ b/googleapiclient/discovery_cache/documents/abusiveexperiencereport.v1.json
@@ -139,7 +139,7 @@
       }
     }
   },
-  "revision": "20210712",
+  "revision": "20210723",
   "rootUrl": "https://abusiveexperiencereport.googleapis.com/",
   "schemas": {
     "SiteSummaryResponse": {
diff --git a/googleapiclient/discovery_cache/documents/acceleratedmobilepageurl.v1.json b/googleapiclient/discovery_cache/documents/acceleratedmobilepageurl.v1.json
index 1b46f4d..20abdcf 100644
--- a/googleapiclient/discovery_cache/documents/acceleratedmobilepageurl.v1.json
+++ b/googleapiclient/discovery_cache/documents/acceleratedmobilepageurl.v1.json
@@ -115,7 +115,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://acceleratedmobilepageurl.googleapis.com/",
   "schemas": {
     "AmpUrl": {
diff --git a/googleapiclient/discovery_cache/documents/accessapproval.v1.json b/googleapiclient/discovery_cache/documents/accessapproval.v1.json
index cc749dc..99030dd 100644
--- a/googleapiclient/discovery_cache/documents/accessapproval.v1.json
+++ b/googleapiclient/discovery_cache/documents/accessapproval.v1.json
@@ -14,7 +14,7 @@
   "canonicalName": "Access Approval",
   "description": "An API for controlling access to data by Google personnel.",
   "discoveryVersion": "v1",
-  "documentationLink": "https://cloud.google.com/access-approval/docs",
+  "documentationLink": "https://cloud.google.com/cloud-provider-access-management/access-approval/docs",
   "fullyEncodeReservedExpansion": true,
   "icons": {
     "x16": "http://www.google.com/images/icons/product/search-16.gif",
@@ -754,7 +754,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210730",
   "rootUrl": "https://accessapproval.googleapis.com/",
   "schemas": {
     "AccessApprovalSettings": {
diff --git a/googleapiclient/discovery_cache/documents/adexchangebuyer.v1.2.json b/googleapiclient/discovery_cache/documents/adexchangebuyer.v1.2.json
index 347dc5e..a272d21 100644
--- a/googleapiclient/discovery_cache/documents/adexchangebuyer.v1.2.json
+++ b/googleapiclient/discovery_cache/documents/adexchangebuyer.v1.2.json
@@ -15,7 +15,7 @@
   "description": "Accesses your bidding-account information, submits creatives for validation, finds available direct deals, and retrieves performance reports.",
   "discoveryVersion": "v1",
   "documentationLink": "https://developers.google.com/ad-exchange/buyer-rest",
-  "etag": "\"uWj2hSb4GVjzdDlAnRd2gbM1ZQ8/X0Fc7JxXDQWMuYY6RaDO4JgT_o8\"",
+  "etag": "\"uWj2hSb4GVjzdDlAnRd2gbM1ZQ8/_98o2LMYZrDRamMMf9QGxhlegTM\"",
   "icons": {
     "x16": "https://www.google.com/images/icons/product/doubleclick-16.gif",
     "x32": "https://www.google.com/images/icons/product/doubleclick-32.gif"
@@ -259,7 +259,7 @@
       }
     }
   },
-  "revision": "20210725",
+  "revision": "20210731",
   "rootUrl": "https://www.googleapis.com/",
   "schemas": {
     "Account": {
diff --git a/googleapiclient/discovery_cache/documents/adexchangebuyer.v1.3.json b/googleapiclient/discovery_cache/documents/adexchangebuyer.v1.3.json
index 3d3f225..a7e1b7f 100644
--- a/googleapiclient/discovery_cache/documents/adexchangebuyer.v1.3.json
+++ b/googleapiclient/discovery_cache/documents/adexchangebuyer.v1.3.json
@@ -15,7 +15,7 @@
   "description": "Accesses your bidding-account information, submits creatives for validation, finds available direct deals, and retrieves performance reports.",
   "discoveryVersion": "v1",
   "documentationLink": "https://developers.google.com/ad-exchange/buyer-rest",
-  "etag": "\"uWj2hSb4GVjzdDlAnRd2gbM1ZQ8/_cIH3d5t3MiKPg5aWuy50XtXXb0\"",
+  "etag": "\"uWj2hSb4GVjzdDlAnRd2gbM1ZQ8/aOdvMnPPTKTvfrtSf21x5dD8J88\"",
   "icons": {
     "x16": "https://www.google.com/images/icons/product/doubleclick-16.gif",
     "x32": "https://www.google.com/images/icons/product/doubleclick-32.gif"
@@ -699,7 +699,7 @@
       }
     }
   },
-  "revision": "20210725",
+  "revision": "20210731",
   "rootUrl": "https://www.googleapis.com/",
   "schemas": {
     "Account": {
diff --git a/googleapiclient/discovery_cache/documents/adexchangebuyer.v1.4.json b/googleapiclient/discovery_cache/documents/adexchangebuyer.v1.4.json
index 8d1c4d6..f7f57a3 100644
--- a/googleapiclient/discovery_cache/documents/adexchangebuyer.v1.4.json
+++ b/googleapiclient/discovery_cache/documents/adexchangebuyer.v1.4.json
@@ -15,7 +15,7 @@
   "description": "Accesses your bidding-account information, submits creatives for validation, finds available direct deals, and retrieves performance reports.",
   "discoveryVersion": "v1",
   "documentationLink": "https://developers.google.com/ad-exchange/buyer-rest",
-  "etag": "\"uWj2hSb4GVjzdDlAnRd2gbM1ZQ8/1dlKfDUB7WMEncYh7eNZDmXqECk\"",
+  "etag": "\"uWj2hSb4GVjzdDlAnRd2gbM1ZQ8/f24Up8gmkcqDo80eN8sqbshnA4A\"",
   "icons": {
     "x16": "https://www.google.com/images/icons/product/doubleclick-16.gif",
     "x32": "https://www.google.com/images/icons/product/doubleclick-32.gif"
@@ -1255,7 +1255,7 @@
       }
     }
   },
-  "revision": "20210725",
+  "revision": "20210731",
   "rootUrl": "https://www.googleapis.com/",
   "schemas": {
     "Account": {
diff --git a/googleapiclient/discovery_cache/documents/adexchangebuyer2.v2beta1.json b/googleapiclient/discovery_cache/documents/adexchangebuyer2.v2beta1.json
index 8c0446e..f065953 100644
--- a/googleapiclient/discovery_cache/documents/adexchangebuyer2.v2beta1.json
+++ b/googleapiclient/discovery_cache/documents/adexchangebuyer2.v2beta1.json
@@ -2568,7 +2568,7 @@
       }
     }
   },
-  "revision": "20210724",
+  "revision": "20210731",
   "rootUrl": "https://adexchangebuyer.googleapis.com/",
   "schemas": {
     "AbsoluteDateRange": {
diff --git a/googleapiclient/discovery_cache/documents/adexperiencereport.v1.json b/googleapiclient/discovery_cache/documents/adexperiencereport.v1.json
index 8029250..5f97ed1 100644
--- a/googleapiclient/discovery_cache/documents/adexperiencereport.v1.json
+++ b/googleapiclient/discovery_cache/documents/adexperiencereport.v1.json
@@ -138,7 +138,7 @@
       }
     }
   },
-  "revision": "20210712",
+  "revision": "20210723",
   "rootUrl": "https://adexperiencereport.googleapis.com/",
   "schemas": {
     "PlatformSummary": {
diff --git a/googleapiclient/discovery_cache/documents/admin.datatransfer_v1.json b/googleapiclient/discovery_cache/documents/admin.datatransfer_v1.json
index 7ba8979..5058fdc 100644
--- a/googleapiclient/discovery_cache/documents/admin.datatransfer_v1.json
+++ b/googleapiclient/discovery_cache/documents/admin.datatransfer_v1.json
@@ -272,7 +272,7 @@
       }
     }
   },
-  "revision": "20210720",
+  "revision": "20210727",
   "rootUrl": "https://admin.googleapis.com/",
   "schemas": {
     "Application": {
diff --git a/googleapiclient/discovery_cache/documents/admin.directory_v1.json b/googleapiclient/discovery_cache/documents/admin.directory_v1.json
index 40c3c22..3150e4f 100644
--- a/googleapiclient/discovery_cache/documents/admin.directory_v1.json
+++ b/googleapiclient/discovery_cache/documents/admin.directory_v1.json
@@ -4397,7 +4397,7 @@
       }
     }
   },
-  "revision": "20210720",
+  "revision": "20210727",
   "rootUrl": "https://admin.googleapis.com/",
   "schemas": {
     "Alias": {
diff --git a/googleapiclient/discovery_cache/documents/admin.reports_v1.json b/googleapiclient/discovery_cache/documents/admin.reports_v1.json
index 3e72367..891c230 100644
--- a/googleapiclient/discovery_cache/documents/admin.reports_v1.json
+++ b/googleapiclient/discovery_cache/documents/admin.reports_v1.json
@@ -631,7 +631,7 @@
       }
     }
   },
-  "revision": "20210720",
+  "revision": "20210727",
   "rootUrl": "https://admin.googleapis.com/",
   "schemas": {
     "Activities": {
diff --git a/googleapiclient/discovery_cache/documents/admob.v1.json b/googleapiclient/discovery_cache/documents/admob.v1.json
index e893990..6fcbc87 100644
--- a/googleapiclient/discovery_cache/documents/admob.v1.json
+++ b/googleapiclient/discovery_cache/documents/admob.v1.json
@@ -321,7 +321,7 @@
       }
     }
   },
-  "revision": "20210724",
+  "revision": "20210802",
   "rootUrl": "https://admob.googleapis.com/",
   "schemas": {
     "AdUnit": {
diff --git a/googleapiclient/discovery_cache/documents/admob.v1beta.json b/googleapiclient/discovery_cache/documents/admob.v1beta.json
index 8e12aed..ae8864f 100644
--- a/googleapiclient/discovery_cache/documents/admob.v1beta.json
+++ b/googleapiclient/discovery_cache/documents/admob.v1beta.json
@@ -321,7 +321,7 @@
       }
     }
   },
-  "revision": "20210724",
+  "revision": "20210802",
   "rootUrl": "https://admob.googleapis.com/",
   "schemas": {
     "AdUnit": {
diff --git a/googleapiclient/discovery_cache/documents/adsense.v2.json b/googleapiclient/discovery_cache/documents/adsense.v2.json
index 67e7d86..f872d90 100644
--- a/googleapiclient/discovery_cache/documents/adsense.v2.json
+++ b/googleapiclient/discovery_cache/documents/adsense.v2.json
@@ -1567,7 +1567,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210730",
   "rootUrl": "https://adsense.googleapis.com/",
   "schemas": {
     "Account": {
@@ -1775,7 +1775,7 @@
             "In-feed ad unit.",
             "In-article ad unit.",
             "Matched content unit.",
-            "Link ad unit. Note that link ad units are being retired, see https://support.google.com/adsense/answer/9987221."
+            "Link ad unit. Note that link ad units have now been retired, see https://support.google.com/adsense/answer/9987221."
           ],
           "type": "string"
         }
diff --git a/googleapiclient/discovery_cache/documents/analyticsadmin.v1alpha.json b/googleapiclient/discovery_cache/documents/analyticsadmin.v1alpha.json
index 8e53f74..7ec08e1 100644
--- a/googleapiclient/discovery_cache/documents/analyticsadmin.v1alpha.json
+++ b/googleapiclient/discovery_cache/documents/analyticsadmin.v1alpha.json
@@ -3092,7 +3092,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://analyticsadmin.googleapis.com/",
   "schemas": {
     "GoogleAnalyticsAdminV1alphaAccount": {
diff --git a/googleapiclient/discovery_cache/documents/analyticsdata.v1beta.json b/googleapiclient/discovery_cache/documents/analyticsdata.v1beta.json
index 87701dd..d750beb 100644
--- a/googleapiclient/discovery_cache/documents/analyticsdata.v1beta.json
+++ b/googleapiclient/discovery_cache/documents/analyticsdata.v1beta.json
@@ -284,7 +284,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210730",
   "rootUrl": "https://analyticsdata.googleapis.com/",
   "schemas": {
     "BatchRunPivotReportsRequest": {
diff --git a/googleapiclient/discovery_cache/documents/androiddeviceprovisioning.v1.json b/googleapiclient/discovery_cache/documents/androiddeviceprovisioning.v1.json
index 6a88213..2d09fbb 100644
--- a/googleapiclient/discovery_cache/documents/androiddeviceprovisioning.v1.json
+++ b/googleapiclient/discovery_cache/documents/androiddeviceprovisioning.v1.json
@@ -825,7 +825,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210728",
   "rootUrl": "https://androiddeviceprovisioning.googleapis.com/",
   "schemas": {
     "ClaimDeviceRequest": {
diff --git a/googleapiclient/discovery_cache/documents/androidenterprise.v1.json b/googleapiclient/discovery_cache/documents/androidenterprise.v1.json
index aa773c0..748b092 100644
--- a/googleapiclient/discovery_cache/documents/androidenterprise.v1.json
+++ b/googleapiclient/discovery_cache/documents/androidenterprise.v1.json
@@ -290,7 +290,7 @@
           ]
         },
         "update": {
-          "description": "Updates the device policy. To ensure the policy is properly enforced, you need to prevent unmanaged accounts from accessing Google Play by setting the allowed_accounts in the managed configuration for the Google Play package. See restrict accounts in Google Play.",
+          "description": "Updates the device policy. To ensure the policy is properly enforced, you need to prevent unmanaged accounts from accessing Google Play by setting the allowed_accounts in the managed configuration for the Google Play package. See restrict accounts in Google Play. When provisioning a new device, you should set the device policy using this method before adding the managed Google Play Account to the device, otherwise the policy will not be applied for a short period of time after adding the account to the device.",
           "flatPath": "androidenterprise/v1/enterprises/{enterpriseId}/users/{userId}/devices/{deviceId}",
           "httpMethod": "PUT",
           "id": "androidenterprise.devices.update",
@@ -2610,7 +2610,7 @@
       }
     }
   },
-  "revision": "20210721",
+  "revision": "20210728",
   "rootUrl": "https://androidenterprise.googleapis.com/",
   "schemas": {
     "Administrator": {
diff --git a/googleapiclient/discovery_cache/documents/androidmanagement.v1.json b/googleapiclient/discovery_cache/documents/androidmanagement.v1.json
index 695dcf0..7ef3d88 100644
--- a/googleapiclient/discovery_cache/documents/androidmanagement.v1.json
+++ b/googleapiclient/discovery_cache/documents/androidmanagement.v1.json
@@ -1004,7 +1004,7 @@
       }
     }
   },
-  "revision": "20210713",
+  "revision": "20210719",
   "rootUrl": "https://androidmanagement.googleapis.com/",
   "schemas": {
     "AdvancedSecurityOverrides": {
@@ -1831,7 +1831,7 @@
         },
         "memoryInfo": {
           "$ref": "MemoryInfo",
-          "description": "Memory information. This information is only available if memoryInfoEnabled is true in the device's policy."
+          "description": "Memory information: contains information about device memory and storage."
         },
         "name": {
           "description": "The name of the device in the form enterprises/{enterpriseId}/devices/{deviceId}.",
@@ -3040,9 +3040,9 @@
             "The password must contain alphabetic (or symbol) characters.This, when applied on personally owned work profile devices on Android 12 device-scoped, will be treated as COMPLEXITY_HIGH for application. See PasswordQuality for details.",
             "The password must contain both numeric and alphabetic (or symbol) characters.This, when applied on personally owned work profile devices on Android 12 device-scoped, will be treated as COMPLEXITY_HIGH for application. See PasswordQuality for details.",
             "The password must meet the minimum requirements specified in passwordMinimumLength, passwordMinimumLetters, passwordMinimumSymbols, etc. For example, if passwordMinimumSymbols is 2, the password must contain at least two symbols.This, when applied on personally owned work profile devices on Android 12 device-scoped, will be treated as COMPLEXITY_HIGH for application. In this case, the requirements in passwordMinimumLength, passwordMinimumLetters, passwordMinimumSymbols, etc are not applied. See PasswordQuality for details.",
-            "Password satisfies one of the following: pattern PIN with repeating (4444) or ordered (1234, 4321, 2468) sequencesEnforcement varies among different Android versions, management modes and password scopes. See PasswordQuality for details.",
-            "Password satisfies one of the following: PIN with no repeating (4444) or ordered (1234, 4321, 2468) sequences, length at least 4 alphabetic, length at least 4 alphanumeric, length at least 4Enforcement varies among different Android versions, management modes and password scopes. See PasswordQuality for details.",
-            "Password satisfies one of the following:On Android 12 and above: PIN with no repeating (4444) or ordered (1234, 4321, 2468) sequences, length at least 8 alphabetic, length at least 6 alphanumeric, length at least 6Enforcement varies among different Android versions, management modes and password scopes. See PasswordQuality for details."
+            "Define the low password complexity band as: pattern PIN with repeating (4444) or ordered (1234, 4321, 2468) sequencesThis sets the minimum complexity band which the password must meet.Enforcement varies among different Android versions, management modes and password scopes. See PasswordQuality for details.",
+            "Define the medium password complexity band as: PIN with no repeating (4444) or ordered (1234, 4321, 2468) sequences, length at least 4 alphabetic, length at least 4 alphanumeric, length at least 4This sets the minimum complexity band which the password must meet.Enforcement varies among different Android versions, management modes and password scopes. See PasswordQuality for details.",
+            "Define the high password complexity band as:On Android 12 and above: PIN with no repeating (4444) or ordered (1234, 4321, 2468) sequences, length at least 8 alphabetic, length at least 6 alphanumeric, length at least 6This sets the minimum complexity band which the password must meet.Enforcement varies among different Android versions, management modes and password scopes. See PasswordQuality for details."
           ],
           "type": "string"
         },
@@ -4037,7 +4037,7 @@
           "type": "boolean"
         },
         "memoryInfoEnabled": {
-          "description": "Whether memory reporting is enabled.",
+          "description": "Whether memory event reporting is enabled.",
           "type": "boolean"
         },
         "networkInfoEnabled": {
diff --git a/googleapiclient/discovery_cache/documents/androidpublisher.v3.json b/googleapiclient/discovery_cache/documents/androidpublisher.v3.json
index 6430c34..d1778e4 100644
--- a/googleapiclient/discovery_cache/documents/androidpublisher.v3.json
+++ b/googleapiclient/discovery_cache/documents/androidpublisher.v3.json
@@ -1873,6 +1873,11 @@
             "sku"
           ],
           "parameters": {
+            "allowMissing": {
+              "description": "If set to true, and the in-app product with the given package_name and sku doesn't exist, the in-app product will be created.",
+              "location": "query",
+              "type": "boolean"
+            },
             "autoConvertMissingPrices": {
               "description": "If true the prices for all regions targeted by the parent app that don't have a price specified for this in-app product will be auto converted to the target currency based on the default price. Defaults to false.",
               "location": "query",
@@ -2676,7 +2681,7 @@
       }
     }
   },
-  "revision": "20210724",
+  "revision": "20210728",
   "rootUrl": "https://androidpublisher.googleapis.com/",
   "schemas": {
     "Apk": {
diff --git a/googleapiclient/discovery_cache/documents/apigateway.v1.json b/googleapiclient/discovery_cache/documents/apigateway.v1.json
index a7e8386..cbb9fea 100644
--- a/googleapiclient/discovery_cache/documents/apigateway.v1.json
+++ b/googleapiclient/discovery_cache/documents/apigateway.v1.json
@@ -1083,7 +1083,7 @@
       }
     }
   },
-  "revision": "20210714",
+  "revision": "20210721",
   "rootUrl": "https://apigateway.googleapis.com/",
   "schemas": {
     "ApigatewayApi": {
diff --git a/googleapiclient/discovery_cache/documents/apigee.v1.json b/googleapiclient/discovery_cache/documents/apigee.v1.json
index 53ccfec..f837660 100644
--- a/googleapiclient/discovery_cache/documents/apigee.v1.json
+++ b/googleapiclient/discovery_cache/documents/apigee.v1.json
@@ -3615,6 +3615,11 @@
                           "description": "Flag that specifies whether to enable sequenced rollout. If set to `true`, a best-effort attempt will be made to roll out the routing rules corresponding to this deployment and the environment changes to add this deployment in a safe order. This reduces the risk of downtime that could be caused by changing the environment group's routing before the new destination for the affected traffic is ready to receive it. This should only be necessary if the new deployment will be capturing traffic from another environment under a shared environment group or if traffic will be rerouted to a different environment due to a base path removal. The [GenerateDeployChangeReport API](GenerateDeployChangeReport) may be used to examine routing changes before issuing the deployment request, and its response will indicate if a sequenced rollout is recommended for the deployment.",
                           "location": "query",
                           "type": "boolean"
+                        },
+                        "serviceAccount": {
+                          "description": "Google Cloud IAM service account. The service account represents the identity of the deployed proxy, and determines what permissions it has. The format must be `{ACCOUNT_ID}@{PROJECT}.iam.gserviceaccount.com`.",
+                          "location": "query",
+                          "type": "string"
                         }
                       },
                       "path": "v1/{+name}/deployments",
@@ -5014,6 +5019,11 @@
                           "description": "Flag that specifies whether the new deployment replaces other deployed revisions of the shared flow in the environment. Set `override` to `true` to replace other deployed revisions. By default, `override` is `false` and the deployment is rejected if other revisions of the shared flow are deployed in the environment.",
                           "location": "query",
                           "type": "boolean"
+                        },
+                        "serviceAccount": {
+                          "description": "Google Cloud IAM service account. The service account represents the identity of the deployed proxy, and determines what permissions it has. The format must be `{ACCOUNT_ID}@{PROJECT}.iam.gserviceaccount.com`.",
+                          "location": "query",
+                          "type": "string"
                         }
                       },
                       "path": "v1/{+name}/deployments",
@@ -7011,9 +7021,38 @@
       }
     }
   },
-  "revision": "20210719",
+  "revision": "20210722",
   "rootUrl": "https://apigee.googleapis.com/",
   "schemas": {
+    "EdgeConfigstoreBundleBadBundle": {
+      "description": "Describes why a bundle is invalid. Intended for use in error details.",
+      "id": "EdgeConfigstoreBundleBadBundle",
+      "properties": {
+        "violations": {
+          "description": "Describes all precondition violations.",
+          "items": {
+            "$ref": "EdgeConfigstoreBundleBadBundleViolation"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "EdgeConfigstoreBundleBadBundleViolation": {
+      "description": "A message type used to describe a single bundle validation error.",
+      "id": "EdgeConfigstoreBundleBadBundleViolation",
+      "properties": {
+        "description": {
+          "description": "A description of why the bundle is invalid and how to fix it.",
+          "type": "string"
+        },
+        "filename": {
+          "description": "The filename (including relative path from the bundle root) in which the error occurred.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "GoogleApiHttpBody": {
       "description": "Message that represents an arbitrary HTTP body. It should only be used for payload formats that can't be represented as JSON, such as raw binary or an HTML page. This message can be used both in streaming and non-streaming API methods in the request as well as the response. It can be used as a top-level request field, which is convenient if one wants to extract parameters from either the URL or HTTP template into the request fields and also want access to the raw HTTP body. Example: message GetResourceRequest { // A unique request id. string request_id = 1; // The raw HTTP body is bound to this field. google.api.HttpBody http_body = 2; } service ResourceService { rpc GetResource(GetResourceRequest) returns (google.api.HttpBody); rpc UpdateResource(google.api.HttpBody) returns (google.protobuf.Empty); } Example with streaming methods: service CaldavService { rpc GetCalendar(stream google.api.HttpBody) returns (stream google.api.HttpBody); rpc UpdateCalendar(stream google.api.HttpBody) returns (stream google.api.HttpBody); } Use of this type only changes how the request and response bodies are handled, all other features will continue to work unchanged.",
       "id": "GoogleApiHttpBody",
@@ -7345,23 +7384,34 @@
       "description": "Metadata describing the API proxy",
       "id": "GoogleCloudApigeeV1ApiProxy",
       "properties": {
+        "labels": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "User labels applied to this API Proxy.",
+          "type": "object"
+        },
         "latestRevisionId": {
-          "description": "The id of the most recently created revision for this api proxy.",
+          "description": "Output only. The id of the most recently created revision for this api proxy.",
+          "readOnly": true,
           "type": "string"
         },
         "metaData": {
           "$ref": "GoogleCloudApigeeV1EntityMetadata",
-          "description": "Metadata describing the API proxy."
+          "description": "Output only. Metadata describing the API proxy.",
+          "readOnly": true
         },
         "name": {
-          "description": "Name of the API proxy.",
+          "description": "Output only. Name of the API proxy.",
+          "readOnly": true,
           "type": "string"
         },
         "revision": {
-          "description": "List of revisons defined for the API proxy.",
+          "description": "Output only. List of revisons defined for the API proxy.",
           "items": {
             "type": "string"
           },
+          "readOnly": true,
           "type": "array"
         }
       },
@@ -8437,6 +8487,10 @@
           },
           "type": "array"
         },
+        "serviceAccount": {
+          "description": "The full resource name of Cloud IAM Service Account that this deployment is using, eg, `projects/-/serviceAccounts/{email}`.",
+          "type": "string"
+        },
         "state": {
           "description": "Current state of the deployment. This field is not populated in List APIs.",
           "enum": [
diff --git a/googleapiclient/discovery_cache/documents/apikeys.v2.json b/googleapiclient/discovery_cache/documents/apikeys.v2.json
index 8d8e4f9..3ef8f97 100644
--- a/googleapiclient/discovery_cache/documents/apikeys.v2.json
+++ b/googleapiclient/discovery_cache/documents/apikeys.v2.json
@@ -424,7 +424,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://apikeys.googleapis.com/",
   "schemas": {
     "Operation": {
diff --git a/googleapiclient/discovery_cache/documents/appengine.v1.json b/googleapiclient/discovery_cache/documents/appengine.v1.json
index 47591e4..3b76c97 100644
--- a/googleapiclient/discovery_cache/documents/appengine.v1.json
+++ b/googleapiclient/discovery_cache/documents/appengine.v1.json
@@ -1595,7 +1595,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210721",
   "rootUrl": "https://appengine.googleapis.com/",
   "schemas": {
     "ApiConfigHandler": {
diff --git a/googleapiclient/discovery_cache/documents/appengine.v1alpha.json b/googleapiclient/discovery_cache/documents/appengine.v1alpha.json
index c513cd0..0cd5cf8 100644
--- a/googleapiclient/discovery_cache/documents/appengine.v1alpha.json
+++ b/googleapiclient/discovery_cache/documents/appengine.v1alpha.json
@@ -709,7 +709,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210721",
   "rootUrl": "https://appengine.googleapis.com/",
   "schemas": {
     "AuthorizedCertificate": {
diff --git a/googleapiclient/discovery_cache/documents/appengine.v1beta.json b/googleapiclient/discovery_cache/documents/appengine.v1beta.json
index 5a51e99..2dd1a8f 100644
--- a/googleapiclient/discovery_cache/documents/appengine.v1beta.json
+++ b/googleapiclient/discovery_cache/documents/appengine.v1beta.json
@@ -1595,7 +1595,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210721",
   "rootUrl": "https://appengine.googleapis.com/",
   "schemas": {
     "ApiConfigHandler": {
@@ -2859,6 +2859,20 @@
           },
           "type": "array"
         },
+        "instanceIpMode": {
+          "description": "The IP mode for instances. Only applicable in the App Engine flexible environment.",
+          "enum": [
+            "INSTANCE_IP_MODE_UNSPECIFIED",
+            "EXTERNAL",
+            "INTERNAL"
+          ],
+          "enumDescriptions": [
+            "Unspecified should be treated as EXTERNAL",
+            "VMs should be created with external and internal IPs",
+            "VMs should be created with internal IPs only"
+          ],
+          "type": "string"
+        },
         "instanceTag": {
           "description": "Tag to apply to the instance during creation. Only applicable in the App Engine flexible environment.",
           "type": "string"
diff --git a/googleapiclient/discovery_cache/documents/area120tables.v1alpha1.json b/googleapiclient/discovery_cache/documents/area120tables.v1alpha1.json
index 800d20a..1419a0d 100644
--- a/googleapiclient/discovery_cache/documents/area120tables.v1alpha1.json
+++ b/googleapiclient/discovery_cache/documents/area120tables.v1alpha1.json
@@ -586,7 +586,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://area120tables.googleapis.com/",
   "schemas": {
     "BatchCreateRowsRequest": {
diff --git a/googleapiclient/discovery_cache/documents/artifactregistry.v1.json b/googleapiclient/discovery_cache/documents/artifactregistry.v1.json
index 5535f54..d560412 100644
--- a/googleapiclient/discovery_cache/documents/artifactregistry.v1.json
+++ b/googleapiclient/discovery_cache/documents/artifactregistry.v1.json
@@ -348,7 +348,7 @@
       }
     }
   },
-  "revision": "20210713",
+  "revision": "20210723",
   "rootUrl": "https://artifactregistry.googleapis.com/",
   "schemas": {
     "AptArtifact": {
@@ -670,6 +670,8 @@
             "MAVEN",
             "NPM",
             "PYPI",
+            "APT",
+            "YUM",
             "PYTHON"
           ],
           "enumDescriptions": [
@@ -678,6 +680,8 @@
             "Maven package format.",
             "NPM package format.",
             "PyPI package format.",
+            "APT package format.",
+            "YUM package format.",
             "Python package format."
           ],
           "type": "string"
diff --git a/googleapiclient/discovery_cache/documents/artifactregistry.v1beta1.json b/googleapiclient/discovery_cache/documents/artifactregistry.v1beta1.json
index dd50d78..a7c917c 100644
--- a/googleapiclient/discovery_cache/documents/artifactregistry.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/artifactregistry.v1beta1.json
@@ -971,7 +971,7 @@
       }
     }
   },
-  "revision": "20210713",
+  "revision": "20210723",
   "rootUrl": "https://artifactregistry.googleapis.com/",
   "schemas": {
     "AptArtifact": {
@@ -1507,6 +1507,8 @@
             "MAVEN",
             "NPM",
             "PYPI",
+            "APT",
+            "YUM",
             "PYTHON"
           ],
           "enumDescriptions": [
@@ -1515,6 +1517,8 @@
             "Maven package format.",
             "NPM package format.",
             "PyPI package format.",
+            "APT package format.",
+            "YUM package format.",
             "Python package format."
           ],
           "type": "string"
diff --git a/googleapiclient/discovery_cache/documents/artifactregistry.v1beta2.json b/googleapiclient/discovery_cache/documents/artifactregistry.v1beta2.json
index 7d365ee..5f11944 100644
--- a/googleapiclient/discovery_cache/documents/artifactregistry.v1beta2.json
+++ b/googleapiclient/discovery_cache/documents/artifactregistry.v1beta2.json
@@ -1035,7 +1035,7 @@
       }
     }
   },
-  "revision": "20210713",
+  "revision": "20210723",
   "rootUrl": "https://artifactregistry.googleapis.com/",
   "schemas": {
     "AptArtifact": {
@@ -1593,6 +1593,8 @@
             "MAVEN",
             "NPM",
             "PYPI",
+            "APT",
+            "YUM",
             "PYTHON"
           ],
           "enumDescriptions": [
@@ -1601,6 +1603,8 @@
             "Maven package format.",
             "NPM package format.",
             "PyPI package format.",
+            "APT package format.",
+            "YUM package format.",
             "Python package format."
           ],
           "type": "string"
diff --git a/googleapiclient/discovery_cache/documents/assuredworkloads.v1.json b/googleapiclient/discovery_cache/documents/assuredworkloads.v1.json
index 5838050..471f455 100644
--- a/googleapiclient/discovery_cache/documents/assuredworkloads.v1.json
+++ b/googleapiclient/discovery_cache/documents/assuredworkloads.v1.json
@@ -351,7 +351,7 @@
       }
     }
   },
-  "revision": "20210714",
+  "revision": "20210729",
   "rootUrl": "https://assuredworkloads.googleapis.com/",
   "schemas": {
     "GoogleCloudAssuredworkloadsV1CreateWorkloadOperationMetadata": {
@@ -368,7 +368,8 @@
             "FEDRAMP_MODERATE",
             "US_REGIONAL_ACCESS",
             "HIPAA",
-            "HITRUST"
+            "HITRUST",
+            "EU_REGIONS_AND_SUPPORT"
           ],
           "enumDescriptions": [
             "Unknown compliance regime.",
@@ -378,7 +379,8 @@
             "FedRAMP Moderate data protection controls",
             "Assured Workloads For US Regions data protection controls",
             "Health Insurance Portability and Accountability Act controls",
-            "Health Information Trust Alliance controls"
+            "Health Information Trust Alliance controls",
+            "Assured Workloads For EU Regions and Support controls"
           ],
           "type": "string"
         },
@@ -434,7 +436,8 @@
             "FEDRAMP_MODERATE",
             "US_REGIONAL_ACCESS",
             "HIPAA",
-            "HITRUST"
+            "HITRUST",
+            "EU_REGIONS_AND_SUPPORT"
           ],
           "enumDescriptions": [
             "Unknown compliance regime.",
@@ -444,7 +447,8 @@
             "FedRAMP Moderate data protection controls",
             "Assured Workloads For US Regions data protection controls",
             "Health Insurance Portability and Accountability Act controls",
-            "Health Information Trust Alliance controls"
+            "Health Information Trust Alliance controls",
+            "Assured Workloads For EU Regions and Support controls"
           ],
           "type": "string"
         },
@@ -478,7 +482,7 @@
           "type": "string"
         },
         "provisionedResourcesParent": {
-          "description": "Input only. The parent resource for the resources managed by this Assured Workload. May be either an organization or a folder. Must be the same or a child of the Workload parent. If not specified all resources are created under the Workload parent. Formats: folders/{folder_id} organizations/{organization_id}",
+          "description": "Input only. The parent resource for the resources managed by this Assured Workload. May be either empty or a folder resource which is a child of the Workload parent. If not specified all resources are created under the parent organization. Format: folders/{folder_id}",
           "type": "string"
         },
         "resourceSettings": {
@@ -589,7 +593,8 @@
             "FEDRAMP_MODERATE",
             "US_REGIONAL_ACCESS",
             "HIPAA",
-            "HITRUST"
+            "HITRUST",
+            "EU_REGIONS_AND_SUPPORT"
           ],
           "enumDescriptions": [
             "Unknown compliance regime.",
@@ -599,7 +604,8 @@
             "FedRAMP Moderate data protection controls",
             "Assured Workloads For US Regions data protection controls",
             "Health Insurance Portability and Accountability Act controls",
-            "Health Information Trust Alliance controls"
+            "Health Information Trust Alliance controls",
+            "Assured Workloads For EU Regions and Support controls"
           ],
           "type": "string"
         },
@@ -648,7 +654,8 @@
             "FEDRAMP_MODERATE",
             "US_REGIONAL_ACCESS",
             "HIPAA",
-            "HITRUST"
+            "HITRUST",
+            "EU_REGIONS_AND_SUPPORT"
           ],
           "enumDescriptions": [
             "Unknown compliance regime.",
@@ -658,7 +665,8 @@
             "FedRAMP Moderate data protection controls",
             "Assured Workloads For US Regions data protection controls",
             "Health Insurance Portability and Accountability Act controls",
-            "Health Information Trust Alliance controls"
+            "Health Information Trust Alliance controls",
+            "Assured Workloads For EU Regions and Support controls"
           ],
           "type": "string"
         },
@@ -704,7 +712,7 @@
           "type": "string"
         },
         "provisionedResourcesParent": {
-          "description": "Input only. The parent resource for the resources managed by this Assured Workload. May be either an organization or a folder. Must be the same or a child of the Workload parent. If not specified all resources are created under the Workload parent. Formats: folders/{folder_id} organizations/{organization_id}",
+          "description": "Input only. The parent resource for the resources managed by this Assured Workload. May be either empty or a folder resource which is a child of the Workload parent. If not specified all resources are created under the parent organization. Format: folders/{folder_id}",
           "type": "string"
         },
         "resourceSettings": {
diff --git a/googleapiclient/discovery_cache/documents/bigquerydatatransfer.v1.json b/googleapiclient/discovery_cache/documents/bigquerydatatransfer.v1.json
index 30117f6..ca4821b 100644
--- a/googleapiclient/discovery_cache/documents/bigquerydatatransfer.v1.json
+++ b/googleapiclient/discovery_cache/documents/bigquerydatatransfer.v1.json
@@ -484,7 +484,7 @@
                   ]
                 },
                 "list": {
-                  "description": "Returns information about all data transfers in the project.",
+                  "description": "Returns information about all transfer configs owned by a project in the specified location.",
                   "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/transferConfigs",
                   "httpMethod": "GET",
                   "id": "bigquerydatatransfer.projects.locations.transferConfigs.list",
@@ -931,7 +931,7 @@
               ]
             },
             "list": {
-              "description": "Returns information about all data transfers in the project.",
+              "description": "Returns information about all transfer configs owned by a project in the specified location.",
               "flatPath": "v1/projects/{projectsId}/transferConfigs",
               "httpMethod": "GET",
               "id": "bigquerydatatransfer.projects.transferConfigs.list",
@@ -1280,7 +1280,7 @@
       }
     }
   },
-  "revision": "20210622",
+  "revision": "20210724",
   "rootUrl": "https://bigquerydatatransfer.googleapis.com/",
   "schemas": {
     "CheckValidCredsRequest": {
diff --git a/googleapiclient/discovery_cache/documents/bigtableadmin.v1.json b/googleapiclient/discovery_cache/documents/bigtableadmin.v1.json
index 898ad24..84537db 100644
--- a/googleapiclient/discovery_cache/documents/bigtableadmin.v1.json
+++ b/googleapiclient/discovery_cache/documents/bigtableadmin.v1.json
@@ -96,7 +96,7 @@
   },
   "protocol": "rest",
   "resources": {},
-  "revision": "20210712",
+  "revision": "20210714",
   "rootUrl": "https://bigtableadmin.googleapis.com/",
   "schemas": {
     "Backup": {
diff --git a/googleapiclient/discovery_cache/documents/bigtableadmin.v2.json b/googleapiclient/discovery_cache/documents/bigtableadmin.v2.json
index d04354d..fe21e19 100644
--- a/googleapiclient/discovery_cache/documents/bigtableadmin.v2.json
+++ b/googleapiclient/discovery_cache/documents/bigtableadmin.v2.json
@@ -1803,7 +1803,7 @@
       }
     }
   },
-  "revision": "20210712",
+  "revision": "20210714",
   "rootUrl": "https://bigtableadmin.googleapis.com/",
   "schemas": {
     "AppProfile": {
diff --git a/googleapiclient/discovery_cache/documents/billingbudgets.v1.json b/googleapiclient/discovery_cache/documents/billingbudgets.v1.json
index ddc9e20..507fca9 100644
--- a/googleapiclient/discovery_cache/documents/billingbudgets.v1.json
+++ b/googleapiclient/discovery_cache/documents/billingbudgets.v1.json
@@ -270,7 +270,7 @@
       }
     }
   },
-  "revision": "20210720",
+  "revision": "20210723",
   "rootUrl": "https://billingbudgets.googleapis.com/",
   "schemas": {
     "GoogleCloudBillingBudgetsV1Budget": {
diff --git a/googleapiclient/discovery_cache/documents/billingbudgets.v1beta1.json b/googleapiclient/discovery_cache/documents/billingbudgets.v1beta1.json
index 7bcd96d..1036f37 100644
--- a/googleapiclient/discovery_cache/documents/billingbudgets.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/billingbudgets.v1beta1.json
@@ -264,7 +264,7 @@
       }
     }
   },
-  "revision": "20210720",
+  "revision": "20210723",
   "rootUrl": "https://billingbudgets.googleapis.com/",
   "schemas": {
     "GoogleCloudBillingBudgetsV1beta1AllUpdatesRule": {
diff --git a/googleapiclient/discovery_cache/documents/blogger.v2.json b/googleapiclient/discovery_cache/documents/blogger.v2.json
index 9516953..36cafc7 100644
--- a/googleapiclient/discovery_cache/documents/blogger.v2.json
+++ b/googleapiclient/discovery_cache/documents/blogger.v2.json
@@ -401,7 +401,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://blogger.googleapis.com/",
   "schemas": {
     "Blog": {
diff --git a/googleapiclient/discovery_cache/documents/blogger.v3.json b/googleapiclient/discovery_cache/documents/blogger.v3.json
index 9fc4f53..60dc5a7 100644
--- a/googleapiclient/discovery_cache/documents/blogger.v3.json
+++ b/googleapiclient/discovery_cache/documents/blogger.v3.json
@@ -1678,7 +1678,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://blogger.googleapis.com/",
   "schemas": {
     "Blog": {
diff --git a/googleapiclient/discovery_cache/documents/books.v1.json b/googleapiclient/discovery_cache/documents/books.v1.json
index 72024b2..64ea41a 100644
--- a/googleapiclient/discovery_cache/documents/books.v1.json
+++ b/googleapiclient/discovery_cache/documents/books.v1.json
@@ -2671,7 +2671,7 @@
       }
     }
   },
-  "revision": "20210721",
+  "revision": "20210728",
   "rootUrl": "https://books.googleapis.com/",
   "schemas": {
     "Annotation": {
diff --git a/googleapiclient/discovery_cache/documents/chat.v1.json b/googleapiclient/discovery_cache/documents/chat.v1.json
index 336fb8b..c60913b 100644
--- a/googleapiclient/discovery_cache/documents/chat.v1.json
+++ b/googleapiclient/discovery_cache/documents/chat.v1.json
@@ -601,7 +601,7 @@
       }
     }
   },
-  "revision": "20210717",
+  "revision": "20210723",
   "rootUrl": "https://chat.googleapis.com/",
   "schemas": {
     "ActionParameter": {
diff --git a/googleapiclient/discovery_cache/documents/chromemanagement.v1.json b/googleapiclient/discovery_cache/documents/chromemanagement.v1.json
index d07a826..78270b8 100644
--- a/googleapiclient/discovery_cache/documents/chromemanagement.v1.json
+++ b/googleapiclient/discovery_cache/documents/chromemanagement.v1.json
@@ -288,7 +288,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://chromemanagement.googleapis.com/",
   "schemas": {
     "GoogleChromeManagementV1BrowserVersion": {
diff --git a/googleapiclient/discovery_cache/documents/chromepolicy.v1.json b/googleapiclient/discovery_cache/documents/chromepolicy.v1.json
index 5fcf25d..6f666e5 100644
--- a/googleapiclient/discovery_cache/documents/chromepolicy.v1.json
+++ b/googleapiclient/discovery_cache/documents/chromepolicy.v1.json
@@ -324,7 +324,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://chromepolicy.googleapis.com/",
   "schemas": {
     "GoogleChromePolicyV1AdditionalTargetKeyName": {
@@ -485,6 +485,21 @@
       },
       "type": "object"
     },
+    "GoogleChromePolicyV1PolicySchemaFieldDependencies": {
+      "description": "The field and the value it must have for another field to be allowed to be set.",
+      "id": "GoogleChromePolicyV1PolicySchemaFieldDependencies",
+      "properties": {
+        "sourceField": {
+          "description": "The source field which this field depends on.",
+          "type": "string"
+        },
+        "sourceFieldValue": {
+          "description": "The value which the source field must have for this field to be allowed to be set.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "GoogleChromePolicyV1PolicySchemaFieldDescription": {
       "description": "Provides detailed information for a particular field that is part of a PolicySchema.",
       "id": "GoogleChromePolicyV1PolicySchemaFieldDescription",
@@ -499,6 +514,14 @@
           "readOnly": true,
           "type": "string"
         },
+        "fieldDependencies": {
+          "description": "Output only. Provides a list of fields and the values they must have for this field to be allowed to be set.",
+          "items": {
+            "$ref": "GoogleChromePolicyV1PolicySchemaFieldDependencies"
+          },
+          "readOnly": true,
+          "type": "array"
+        },
         "inputConstraint": {
           "description": "Output only. Any input constraints associated on the values for the field.",
           "readOnly": true,
diff --git a/googleapiclient/discovery_cache/documents/chromeuxreport.v1.json b/googleapiclient/discovery_cache/documents/chromeuxreport.v1.json
index 2b11b1a..8c8fffc 100644
--- a/googleapiclient/discovery_cache/documents/chromeuxreport.v1.json
+++ b/googleapiclient/discovery_cache/documents/chromeuxreport.v1.json
@@ -116,7 +116,7 @@
       }
     }
   },
-  "revision": "20210721",
+  "revision": "20210728",
   "rootUrl": "https://chromeuxreport.googleapis.com/",
   "schemas": {
     "Bin": {
diff --git a/googleapiclient/discovery_cache/documents/classroom.v1.json b/googleapiclient/discovery_cache/documents/classroom.v1.json
index 5d4d4e4..44377ac 100644
--- a/googleapiclient/discovery_cache/documents/classroom.v1.json
+++ b/googleapiclient/discovery_cache/documents/classroom.v1.json
@@ -2400,7 +2400,7 @@
       }
     }
   },
-  "revision": "20210721",
+  "revision": "20210728",
   "rootUrl": "https://classroom.googleapis.com/",
   "schemas": {
     "Announcement": {
diff --git a/googleapiclient/discovery_cache/documents/cloudasset.v1.json b/googleapiclient/discovery_cache/documents/cloudasset.v1.json
index 2ed3294..b0ed8e7 100644
--- a/googleapiclient/discovery_cache/documents/cloudasset.v1.json
+++ b/googleapiclient/discovery_cache/documents/cloudasset.v1.json
@@ -711,7 +711,7 @@
       }
     }
   },
-  "revision": "20210716",
+  "revision": "20210723",
   "rootUrl": "https://cloudasset.googleapis.com/",
   "schemas": {
     "AccessSelector": {
@@ -1628,7 +1628,7 @@
           "type": "string"
         },
         "name": {
-          "description": "Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{policy_id}/accessLevels/{short_name}`. The maximum length of the `short_name` component is 50 characters.",
+          "description": "Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The maximum length of the `access_level` component is 50 characters.",
           "type": "string"
         },
         "title": {
@@ -1647,7 +1647,7 @@
           "type": "string"
         },
         "name": {
-          "description": "Output only. Resource name of the `AccessPolicy`. Format: `accessPolicies/{policy_id}`",
+          "description": "Output only. Resource name of the `AccessPolicy`. Format: `accessPolicies/{access_policy}`",
           "type": "string"
         },
         "parent": {
@@ -2038,7 +2038,7 @@
           "type": "string"
         },
         "name": {
-          "description": "Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{policy_id}/servicePerimeters/{short_name}`",
+          "description": "Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`",
           "type": "string"
         },
         "perimeterType": {
diff --git a/googleapiclient/discovery_cache/documents/cloudasset.v1beta1.json b/googleapiclient/discovery_cache/documents/cloudasset.v1beta1.json
index e951397..d306b8f 100644
--- a/googleapiclient/discovery_cache/documents/cloudasset.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/cloudasset.v1beta1.json
@@ -411,7 +411,7 @@
       }
     }
   },
-  "revision": "20210716",
+  "revision": "20210723",
   "rootUrl": "https://cloudasset.googleapis.com/",
   "schemas": {
     "AnalyzeIamPolicyLongrunningResponse": {
@@ -896,7 +896,7 @@
           "type": "string"
         },
         "name": {
-          "description": "Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{policy_id}/accessLevels/{short_name}`. The maximum length of the `short_name` component is 50 characters.",
+          "description": "Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The maximum length of the `access_level` component is 50 characters.",
           "type": "string"
         },
         "title": {
@@ -915,7 +915,7 @@
           "type": "string"
         },
         "name": {
-          "description": "Output only. Resource name of the `AccessPolicy`. Format: `accessPolicies/{policy_id}`",
+          "description": "Output only. Resource name of the `AccessPolicy`. Format: `accessPolicies/{access_policy}`",
           "type": "string"
         },
         "parent": {
@@ -1306,7 +1306,7 @@
           "type": "string"
         },
         "name": {
-          "description": "Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{policy_id}/servicePerimeters/{short_name}`",
+          "description": "Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`",
           "type": "string"
         },
         "perimeterType": {
diff --git a/googleapiclient/discovery_cache/documents/cloudasset.v1p1beta1.json b/googleapiclient/discovery_cache/documents/cloudasset.v1p1beta1.json
index 65498f2..5228932 100644
--- a/googleapiclient/discovery_cache/documents/cloudasset.v1p1beta1.json
+++ b/googleapiclient/discovery_cache/documents/cloudasset.v1p1beta1.json
@@ -207,7 +207,7 @@
       }
     }
   },
-  "revision": "20210716",
+  "revision": "20210723",
   "rootUrl": "https://cloudasset.googleapis.com/",
   "schemas": {
     "AnalyzeIamPolicyLongrunningResponse": {
@@ -598,7 +598,7 @@
           "type": "string"
         },
         "name": {
-          "description": "Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{policy_id}/accessLevels/{short_name}`. The maximum length of the `short_name` component is 50 characters.",
+          "description": "Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The maximum length of the `access_level` component is 50 characters.",
           "type": "string"
         },
         "title": {
@@ -617,7 +617,7 @@
           "type": "string"
         },
         "name": {
-          "description": "Output only. Resource name of the `AccessPolicy`. Format: `accessPolicies/{policy_id}`",
+          "description": "Output only. Resource name of the `AccessPolicy`. Format: `accessPolicies/{access_policy}`",
           "type": "string"
         },
         "parent": {
@@ -1008,7 +1008,7 @@
           "type": "string"
         },
         "name": {
-          "description": "Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{policy_id}/servicePerimeters/{short_name}`",
+          "description": "Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`",
           "type": "string"
         },
         "perimeterType": {
diff --git a/googleapiclient/discovery_cache/documents/cloudasset.v1p4beta1.json b/googleapiclient/discovery_cache/documents/cloudasset.v1p4beta1.json
index b1f82bd..1d2e0db 100644
--- a/googleapiclient/discovery_cache/documents/cloudasset.v1p4beta1.json
+++ b/googleapiclient/discovery_cache/documents/cloudasset.v1p4beta1.json
@@ -221,7 +221,7 @@
       }
     }
   },
-  "revision": "20210716",
+  "revision": "20210723",
   "rootUrl": "https://cloudasset.googleapis.com/",
   "schemas": {
     "AccessSelector": {
@@ -843,7 +843,7 @@
           "type": "string"
         },
         "name": {
-          "description": "Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{policy_id}/accessLevels/{short_name}`. The maximum length of the `short_name` component is 50 characters.",
+          "description": "Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The maximum length of the `access_level` component is 50 characters.",
           "type": "string"
         },
         "title": {
@@ -862,7 +862,7 @@
           "type": "string"
         },
         "name": {
-          "description": "Output only. Resource name of the `AccessPolicy`. Format: `accessPolicies/{policy_id}`",
+          "description": "Output only. Resource name of the `AccessPolicy`. Format: `accessPolicies/{access_policy}`",
           "type": "string"
         },
         "parent": {
@@ -1253,7 +1253,7 @@
           "type": "string"
         },
         "name": {
-          "description": "Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{policy_id}/servicePerimeters/{short_name}`",
+          "description": "Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`",
           "type": "string"
         },
         "perimeterType": {
diff --git a/googleapiclient/discovery_cache/documents/cloudasset.v1p5beta1.json b/googleapiclient/discovery_cache/documents/cloudasset.v1p5beta1.json
index 7c9a444..ca9d789 100644
--- a/googleapiclient/discovery_cache/documents/cloudasset.v1p5beta1.json
+++ b/googleapiclient/discovery_cache/documents/cloudasset.v1p5beta1.json
@@ -177,7 +177,7 @@
       }
     }
   },
-  "revision": "20210716",
+  "revision": "20210723",
   "rootUrl": "https://cloudasset.googleapis.com/",
   "schemas": {
     "AnalyzeIamPolicyLongrunningResponse": {
@@ -603,7 +603,7 @@
           "type": "string"
         },
         "name": {
-          "description": "Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{policy_id}/accessLevels/{short_name}`. The maximum length of the `short_name` component is 50 characters.",
+          "description": "Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The maximum length of the `access_level` component is 50 characters.",
           "type": "string"
         },
         "title": {
@@ -622,7 +622,7 @@
           "type": "string"
         },
         "name": {
-          "description": "Output only. Resource name of the `AccessPolicy`. Format: `accessPolicies/{policy_id}`",
+          "description": "Output only. Resource name of the `AccessPolicy`. Format: `accessPolicies/{access_policy}`",
           "type": "string"
         },
         "parent": {
@@ -1013,7 +1013,7 @@
           "type": "string"
         },
         "name": {
-          "description": "Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{policy_id}/servicePerimeters/{short_name}`",
+          "description": "Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`",
           "type": "string"
         },
         "perimeterType": {
diff --git a/googleapiclient/discovery_cache/documents/cloudasset.v1p7beta1.json b/googleapiclient/discovery_cache/documents/cloudasset.v1p7beta1.json
index aa2ba6f..f7d9f3a 100644
--- a/googleapiclient/discovery_cache/documents/cloudasset.v1p7beta1.json
+++ b/googleapiclient/discovery_cache/documents/cloudasset.v1p7beta1.json
@@ -167,7 +167,7 @@
       }
     }
   },
-  "revision": "20210716",
+  "revision": "20210723",
   "rootUrl": "https://cloudasset.googleapis.com/",
   "schemas": {
     "AnalyzeIamPolicyLongrunningResponse": {
@@ -672,7 +672,7 @@
           "type": "string"
         },
         "name": {
-          "description": "Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{policy_id}/accessLevels/{short_name}`. The maximum length of the `short_name` component is 50 characters.",
+          "description": "Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The maximum length of the `access_level` component is 50 characters.",
           "type": "string"
         },
         "title": {
@@ -691,7 +691,7 @@
           "type": "string"
         },
         "name": {
-          "description": "Output only. Resource name of the `AccessPolicy`. Format: `accessPolicies/{policy_id}`",
+          "description": "Output only. Resource name of the `AccessPolicy`. Format: `accessPolicies/{access_policy}`",
           "type": "string"
         },
         "parent": {
@@ -1082,7 +1082,7 @@
           "type": "string"
         },
         "name": {
-          "description": "Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{policy_id}/servicePerimeters/{short_name}`",
+          "description": "Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`",
           "type": "string"
         },
         "perimeterType": {
diff --git a/googleapiclient/discovery_cache/documents/cloudbuild.v1.json b/googleapiclient/discovery_cache/documents/cloudbuild.v1.json
index 57f24c7..5f4facb 100644
--- a/googleapiclient/discovery_cache/documents/cloudbuild.v1.json
+++ b/googleapiclient/discovery_cache/documents/cloudbuild.v1.json
@@ -349,6 +349,177 @@
             }
           }
         },
+        "githubEnterpriseConfigs": {
+          "methods": {
+            "create": {
+              "description": "Create an association between a GCP project and a GitHub Enterprise server. This API is experimental.",
+              "flatPath": "v1/projects/{projectsId}/githubEnterpriseConfigs",
+              "httpMethod": "POST",
+              "id": "cloudbuild.projects.githubEnterpriseConfigs.create",
+              "parameterOrder": [
+                "parent"
+              ],
+              "parameters": {
+                "parent": {
+                  "description": "Name of the parent project. For example: projects/{$project_number} or projects/{$project_id}",
+                  "location": "path",
+                  "pattern": "^projects/[^/]+$",
+                  "required": true,
+                  "type": "string"
+                },
+                "projectId": {
+                  "description": "ID of the project.",
+                  "location": "query",
+                  "type": "string"
+                }
+              },
+              "path": "v1/{+parent}/githubEnterpriseConfigs",
+              "request": {
+                "$ref": "GitHubEnterpriseConfig"
+              },
+              "response": {
+                "$ref": "Operation"
+              },
+              "scopes": [
+                "https://www.googleapis.com/auth/cloud-platform"
+              ]
+            },
+            "delete": {
+              "description": "Delete an association between a GCP project and a GitHub Enterprise server. This API is experimental.",
+              "flatPath": "v1/projects/{projectsId}/githubEnterpriseConfigs/{githubEnterpriseConfigsId}",
+              "httpMethod": "DELETE",
+              "id": "cloudbuild.projects.githubEnterpriseConfigs.delete",
+              "parameterOrder": [
+                "name"
+              ],
+              "parameters": {
+                "configId": {
+                  "description": "Unique identifier of the `GitHubEnterpriseConfig`",
+                  "location": "query",
+                  "type": "string"
+                },
+                "name": {
+                  "description": "This field should contain the name of the enterprise config resource. For example: \"projects/{$project_id}/githubEnterpriseConfig/{$config_id}\"",
+                  "location": "path",
+                  "pattern": "^projects/[^/]+/githubEnterpriseConfigs/[^/]+$",
+                  "required": true,
+                  "type": "string"
+                },
+                "projectId": {
+                  "description": "ID of the project",
+                  "location": "query",
+                  "type": "string"
+                }
+              },
+              "path": "v1/{+name}",
+              "response": {
+                "$ref": "Operation"
+              },
+              "scopes": [
+                "https://www.googleapis.com/auth/cloud-platform"
+              ]
+            },
+            "get": {
+              "description": "Retrieve a GitHubEnterpriseConfig. This API is experimental.",
+              "flatPath": "v1/projects/{projectsId}/githubEnterpriseConfigs/{githubEnterpriseConfigsId}",
+              "httpMethod": "GET",
+              "id": "cloudbuild.projects.githubEnterpriseConfigs.get",
+              "parameterOrder": [
+                "name"
+              ],
+              "parameters": {
+                "configId": {
+                  "description": "Unique identifier of the `GitHubEnterpriseConfig`",
+                  "location": "query",
+                  "type": "string"
+                },
+                "name": {
+                  "description": "This field should contain the name of the enterprise config resource. For example: \"projects/{$project_id}/githubEnterpriseConfig/{$config_id}\"",
+                  "location": "path",
+                  "pattern": "^projects/[^/]+/githubEnterpriseConfigs/[^/]+$",
+                  "required": true,
+                  "type": "string"
+                },
+                "projectId": {
+                  "description": "ID of the project",
+                  "location": "query",
+                  "type": "string"
+                }
+              },
+              "path": "v1/{+name}",
+              "response": {
+                "$ref": "GitHubEnterpriseConfig"
+              },
+              "scopes": [
+                "https://www.googleapis.com/auth/cloud-platform"
+              ]
+            },
+            "list": {
+              "description": "List all GitHubEnterpriseConfigs for a given project. This API is experimental.",
+              "flatPath": "v1/projects/{projectsId}/githubEnterpriseConfigs",
+              "httpMethod": "GET",
+              "id": "cloudbuild.projects.githubEnterpriseConfigs.list",
+              "parameterOrder": [
+                "parent"
+              ],
+              "parameters": {
+                "parent": {
+                  "description": "Name of the parent project. For example: projects/{$project_number} or projects/{$project_id}",
+                  "location": "path",
+                  "pattern": "^projects/[^/]+$",
+                  "required": true,
+                  "type": "string"
+                },
+                "projectId": {
+                  "description": "ID of the project",
+                  "location": "query",
+                  "type": "string"
+                }
+              },
+              "path": "v1/{+parent}/githubEnterpriseConfigs",
+              "response": {
+                "$ref": "ListGithubEnterpriseConfigsResponse"
+              },
+              "scopes": [
+                "https://www.googleapis.com/auth/cloud-platform"
+              ]
+            },
+            "patch": {
+              "description": "Update an association between a GCP project and a GitHub Enterprise server. This API is experimental.",
+              "flatPath": "v1/projects/{projectsId}/githubEnterpriseConfigs/{githubEnterpriseConfigsId}",
+              "httpMethod": "PATCH",
+              "id": "cloudbuild.projects.githubEnterpriseConfigs.patch",
+              "parameterOrder": [
+                "name"
+              ],
+              "parameters": {
+                "name": {
+                  "description": "Optional. The full resource name for the GitHubEnterpriseConfig For example: \"projects/{$project_id}/githubEnterpriseConfig/{$config_id}\"",
+                  "location": "path",
+                  "pattern": "^projects/[^/]+/githubEnterpriseConfigs/[^/]+$",
+                  "required": true,
+                  "type": "string"
+                },
+                "updateMask": {
+                  "description": "Update mask for the resource. If this is set, the server will only update the fields specified in the field mask. Otherwise, a full update of the mutable resource fields will be performed.",
+                  "format": "google-fieldmask",
+                  "location": "query",
+                  "type": "string"
+                }
+              },
+              "path": "v1/{+name}",
+              "request": {
+                "$ref": "GitHubEnterpriseConfig"
+              },
+              "response": {
+                "$ref": "Operation"
+              },
+              "scopes": [
+                "https://www.googleapis.com/auth/cloud-platform"
+              ]
+            }
+          }
+        },
         "locations": {
           "resources": {
             "builds": {
@@ -525,6 +696,177 @@
                 }
               }
             },
+            "githubEnterpriseConfigs": {
+              "methods": {
+                "create": {
+                  "description": "Create an association between a GCP project and a GitHub Enterprise server. This API is experimental.",
+                  "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/githubEnterpriseConfigs",
+                  "httpMethod": "POST",
+                  "id": "cloudbuild.projects.locations.githubEnterpriseConfigs.create",
+                  "parameterOrder": [
+                    "parent"
+                  ],
+                  "parameters": {
+                    "parent": {
+                      "description": "Name of the parent project. For example: projects/{$project_number} or projects/{$project_id}",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    },
+                    "projectId": {
+                      "description": "ID of the project.",
+                      "location": "query",
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1/{+parent}/githubEnterpriseConfigs",
+                  "request": {
+                    "$ref": "GitHubEnterpriseConfig"
+                  },
+                  "response": {
+                    "$ref": "Operation"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                },
+                "delete": {
+                  "description": "Delete an association between a GCP project and a GitHub Enterprise server. This API is experimental.",
+                  "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/githubEnterpriseConfigs/{githubEnterpriseConfigsId}",
+                  "httpMethod": "DELETE",
+                  "id": "cloudbuild.projects.locations.githubEnterpriseConfigs.delete",
+                  "parameterOrder": [
+                    "name"
+                  ],
+                  "parameters": {
+                    "configId": {
+                      "description": "Unique identifier of the `GitHubEnterpriseConfig`",
+                      "location": "query",
+                      "type": "string"
+                    },
+                    "name": {
+                      "description": "This field should contain the name of the enterprise config resource. For example: \"projects/{$project_id}/githubEnterpriseConfig/{$config_id}\"",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+/githubEnterpriseConfigs/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    },
+                    "projectId": {
+                      "description": "ID of the project",
+                      "location": "query",
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1/{+name}",
+                  "response": {
+                    "$ref": "Operation"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                },
+                "get": {
+                  "description": "Retrieve a GitHubEnterpriseConfig. This API is experimental.",
+                  "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/githubEnterpriseConfigs/{githubEnterpriseConfigsId}",
+                  "httpMethod": "GET",
+                  "id": "cloudbuild.projects.locations.githubEnterpriseConfigs.get",
+                  "parameterOrder": [
+                    "name"
+                  ],
+                  "parameters": {
+                    "configId": {
+                      "description": "Unique identifier of the `GitHubEnterpriseConfig`",
+                      "location": "query",
+                      "type": "string"
+                    },
+                    "name": {
+                      "description": "This field should contain the name of the enterprise config resource. For example: \"projects/{$project_id}/githubEnterpriseConfig/{$config_id}\"",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+/githubEnterpriseConfigs/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    },
+                    "projectId": {
+                      "description": "ID of the project",
+                      "location": "query",
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1/{+name}",
+                  "response": {
+                    "$ref": "GitHubEnterpriseConfig"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                },
+                "list": {
+                  "description": "List all GitHubEnterpriseConfigs for a given project. This API is experimental.",
+                  "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/githubEnterpriseConfigs",
+                  "httpMethod": "GET",
+                  "id": "cloudbuild.projects.locations.githubEnterpriseConfigs.list",
+                  "parameterOrder": [
+                    "parent"
+                  ],
+                  "parameters": {
+                    "parent": {
+                      "description": "Name of the parent project. For example: projects/{$project_number} or projects/{$project_id}",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    },
+                    "projectId": {
+                      "description": "ID of the project",
+                      "location": "query",
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1/{+parent}/githubEnterpriseConfigs",
+                  "response": {
+                    "$ref": "ListGithubEnterpriseConfigsResponse"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                },
+                "patch": {
+                  "description": "Update an association between a GCP project and a GitHub Enterprise server. This API is experimental.",
+                  "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/githubEnterpriseConfigs/{githubEnterpriseConfigsId}",
+                  "httpMethod": "PATCH",
+                  "id": "cloudbuild.projects.locations.githubEnterpriseConfigs.patch",
+                  "parameterOrder": [
+                    "name"
+                  ],
+                  "parameters": {
+                    "name": {
+                      "description": "Optional. The full resource name for the GitHubEnterpriseConfig For example: \"projects/{$project_id}/githubEnterpriseConfig/{$config_id}\"",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+/githubEnterpriseConfigs/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    },
+                    "updateMask": {
+                      "description": "Update mask for the resource. If this is set, the server will only update the fields specified in the field mask. Otherwise, a full update of the mutable resource fields will be performed.",
+                      "format": "google-fieldmask",
+                      "location": "query",
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1/{+name}",
+                  "request": {
+                    "$ref": "GitHubEnterpriseConfig"
+                  },
+                  "response": {
+                    "$ref": "Operation"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                }
+              }
+            },
             "operations": {
               "methods": {
                 "cancel": {
@@ -1283,9 +1625,28 @@
           }
         }
       }
+    },
+    "v1": {
+      "methods": {
+        "webhook": {
+          "description": "ReceiveWebhook is called when the API receives a GitHub webhook.",
+          "flatPath": "v1/webhook",
+          "httpMethod": "POST",
+          "id": "cloudbuild.webhook",
+          "parameterOrder": [],
+          "parameters": {},
+          "path": "v1/webhook",
+          "request": {
+            "$ref": "HttpBody"
+          },
+          "response": {
+            "$ref": "Empty"
+          }
+        }
+      }
     }
   },
-  "revision": "20210715",
+  "revision": "20210723",
   "rootUrl": "https://cloudbuild.googleapis.com/",
   "schemas": {
     "ArtifactObjects": {
@@ -1514,7 +1875,7 @@
           "additionalProperties": {
             "$ref": "TimeSpan"
           },
-          "description": "Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. If the build does not specify source or images, these keys will not be included.",
+          "description": "Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps. * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. * SETUPBUILD: time to set up build. If the build does not specify source or images, these keys will not be included.",
           "readOnly": true,
           "type": "object"
         },
@@ -1847,6 +2208,10 @@
           "description": "The `Trigger` name with format: `projects/{project}/locations/{location}/triggers/{trigger}`, where {trigger} is a unique identifier generated by the service.",
           "type": "string"
         },
+        "serviceAccount": {
+          "description": "Optional. The service account used for all user-controlled operations including UpdateBuildTrigger, RunBuildTrigger, CreateBuild, and CancelBuild. If no service account is set, then the standard Cloud Build service account ([PROJECT_NUM]@system.gserviceaccount.com) will be used instead. Format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT_ID_OR_EMAIL}`",
+          "type": "string"
+        },
         "sourceToBuild": {
           "$ref": "GitRepoSource",
           "description": "The repo and ref of the repository from which to build. This field is used only for those triggers that do not respond to SCM events. Triggers that respond to such events build source at whatever commit caused the event. This field is currently only used by Webhook, Pub/Sub, Manual, and Cron triggers."
@@ -1921,6 +2286,27 @@
       "properties": {},
       "type": "object"
     },
+    "CreateGitHubEnterpriseConfigOperationMetadata": {
+      "description": "Metadata for `CreateGithubEnterpriseConfig` operation.",
+      "id": "CreateGitHubEnterpriseConfigOperationMetadata",
+      "properties": {
+        "completeTime": {
+          "description": "Time the operation was completed.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "createTime": {
+          "description": "Time the operation was created.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "githubEnterpriseConfig": {
+          "description": "The resource name of the GitHubEnterprise to be created. Format: `projects/{project}/locations/{location}/githubEnterpriseConfigs/{id}`.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "CreateWorkerPoolOperationMetadata": {
       "description": "Metadata for the `CreateWorkerPool` operation.",
       "id": "CreateWorkerPoolOperationMetadata",
@@ -1942,6 +2328,27 @@
       },
       "type": "object"
     },
+    "DeleteGitHubEnterpriseConfigOperationMetadata": {
+      "description": "Metadata for `DeleteGitHubEnterpriseConfig` operation.",
+      "id": "DeleteGitHubEnterpriseConfigOperationMetadata",
+      "properties": {
+        "completeTime": {
+          "description": "Time the operation was completed.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "createTime": {
+          "description": "Time the operation was created.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "githubEnterpriseConfig": {
+          "description": "The resource name of the GitHubEnterprise to be deleted. Format: `projects/{project}/locations/{location}/githubEnterpriseConfigs/{id}`.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "DeleteWorkerPoolOperationMetadata": {
       "description": "Metadata for the `DeleteWorkerPool` operation.",
       "id": "DeleteWorkerPoolOperationMetadata",
@@ -2016,10 +2423,99 @@
       },
       "type": "object"
     },
+    "GitHubEnterpriseConfig": {
+      "description": "GitHubEnterpriseConfig represents a configuration for a GitHub Enterprise server.",
+      "id": "GitHubEnterpriseConfig",
+      "properties": {
+        "appId": {
+          "description": "Required. The GitHub app id of the Cloud Build app on the GitHub Enterprise server.",
+          "format": "int64",
+          "type": "string"
+        },
+        "createTime": {
+          "description": "Output only. Time when the installation was associated with the project.",
+          "format": "google-datetime",
+          "readOnly": true,
+          "type": "string"
+        },
+        "displayName": {
+          "description": "Name to display for this config.",
+          "type": "string"
+        },
+        "hostUrl": {
+          "description": "The URL of the github enterprise host the configuration is for.",
+          "type": "string"
+        },
+        "name": {
+          "description": "Optional. The full resource name for the GitHubEnterpriseConfig For example: \"projects/{$project_id}/githubEnterpriseConfig/{$config_id}\"",
+          "type": "string"
+        },
+        "peeredNetwork": {
+          "description": "Optional. The network to be used when reaching out to the GitHub Enterprise server. The VPC network must be enabled for private service connection. This should be set if the GitHub Enterprise server is hosted on-premises and not reachable by public internet. If this field is left empty, no network peering will occur and calls to the GitHub Enterprise server will be made over the public internet. Must be in the format `projects/{project}/global/networks/{network}`, where {project} is a project number or id and {network} is the name of a VPC network in the project.",
+          "type": "string"
+        },
+        "secrets": {
+          "$ref": "GitHubEnterpriseSecrets",
+          "description": "Names of secrets in Secret Manager."
+        },
+        "sslCa": {
+          "description": "Optional. SSL certificate to use for requests to GitHub Enterprise.",
+          "type": "string"
+        },
+        "webhookKey": {
+          "description": "The key that should be attached to webhook calls to the ReceiveWebhook endpoint.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "GitHubEnterpriseSecrets": {
+      "description": "GitHubEnterpriseSecrets represents the names of all necessary secrets in Secret Manager for a GitHub Enterprise server. Format is: projects//secrets/.",
+      "id": "GitHubEnterpriseSecrets",
+      "properties": {
+        "oauthClientIdName": {
+          "description": "The resource name for the OAuth client ID secret in Secret Manager.",
+          "type": "string"
+        },
+        "oauthClientIdVersionName": {
+          "description": "The resource name for the OAuth client ID secret version in Secret Manager.",
+          "type": "string"
+        },
+        "oauthSecretName": {
+          "description": "The resource name for the OAuth secret in Secret Manager.",
+          "type": "string"
+        },
+        "oauthSecretVersionName": {
+          "description": "The resource name for the OAuth secret secret version in Secret Manager.",
+          "type": "string"
+        },
+        "privateKeyName": {
+          "description": "The resource name for the private key secret.",
+          "type": "string"
+        },
+        "privateKeyVersionName": {
+          "description": "The resource name for the private key secret version.",
+          "type": "string"
+        },
+        "webhookSecretName": {
+          "description": "The resource name for the webhook secret in Secret Manager.",
+          "type": "string"
+        },
+        "webhookSecretVersionName": {
+          "description": "The resource name for the webhook secret secret version in Secret Manager.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "GitHubEventsConfig": {
-      "description": "GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. This message is experimental.",
+      "description": "GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received.",
       "id": "GitHubEventsConfig",
       "properties": {
+        "enterpriseConfigResourceName": {
+          "description": "Optional. The resource name of the github enterprise config that should be applied to this installation. For example: \"projects/{$project_id}/githubEnterpriseConfig/{$config_id}\"",
+          "type": "string"
+        },
         "installationId": {
           "description": "The installationID that emits the GitHub event.",
           "format": "int64",
@@ -2236,6 +2732,20 @@
       },
       "type": "object"
     },
+    "ListGithubEnterpriseConfigsResponse": {
+      "description": "RPC response object returned by ListGithubEnterpriseConfigs RPC method.",
+      "id": "ListGithubEnterpriseConfigsResponse",
+      "properties": {
+        "configs": {
+          "description": "A list of GitHubEnterpriseConfigs",
+          "items": {
+            "$ref": "GitHubEnterpriseConfig"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
     "ListWorkerPoolsResponse": {
       "description": "Response containing existing `WorkerPools`.",
       "id": "ListWorkerPoolsResponse",
@@ -2497,6 +3007,27 @@
       },
       "type": "object"
     },
+    "ProcessAppManifestCallbackOperationMetadata": {
+      "description": "Metadata for `ProcessAppManifestCallback` operation.",
+      "id": "ProcessAppManifestCallbackOperationMetadata",
+      "properties": {
+        "completeTime": {
+          "description": "Time the operation was completed.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "createTime": {
+          "description": "Time the operation was created.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "githubEnterpriseConfig": {
+          "description": "The resource name of the GitHubEnterprise to be created. Format: `projects/{project}/locations/{location}/githubEnterpriseConfigs/{id}`.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "PubsubConfig": {
       "description": "PubsubConfig describes the configuration of a trigger that creates a build whenever a Pub/Sub message is published.",
       "id": "PubsubConfig",
@@ -2941,6 +3472,27 @@
       },
       "type": "object"
     },
+    "UpdateGitHubEnterpriseConfigOperationMetadata": {
+      "description": "Metadata for `UpdateGitHubEnterpriseConfig` operation.",
+      "id": "UpdateGitHubEnterpriseConfigOperationMetadata",
+      "properties": {
+        "completeTime": {
+          "description": "Time the operation was completed.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "createTime": {
+          "description": "Time the operation was created.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "githubEnterpriseConfig": {
+          "description": "The resource name of the GitHubEnterprise to be updated. Format: `projects/{project}/locations/{location}/githubEnterpriseConfigs/{id}`.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "UpdateWorkerPoolOperationMetadata": {
       "description": "Metadata for the `UpdateWorkerPool` operation.",
       "id": "UpdateWorkerPoolOperationMetadata",
diff --git a/googleapiclient/discovery_cache/documents/cloudbuild.v1alpha1.json b/googleapiclient/discovery_cache/documents/cloudbuild.v1alpha1.json
index d2f5bc6..e7e3a31 100644
--- a/googleapiclient/discovery_cache/documents/cloudbuild.v1alpha1.json
+++ b/googleapiclient/discovery_cache/documents/cloudbuild.v1alpha1.json
@@ -306,7 +306,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210723",
   "rootUrl": "https://cloudbuild.googleapis.com/",
   "schemas": {
     "ArtifactObjects": {
@@ -535,7 +535,7 @@
           "additionalProperties": {
             "$ref": "TimeSpan"
           },
-          "description": "Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. If the build does not specify source or images, these keys will not be included.",
+          "description": "Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps. * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. * SETUPBUILD: time to set up build. If the build does not specify source or images, these keys will not be included.",
           "readOnly": true,
           "type": "object"
         },
@@ -825,6 +825,27 @@
       "properties": {},
       "type": "object"
     },
+    "CreateGitHubEnterpriseConfigOperationMetadata": {
+      "description": "Metadata for `CreateGithubEnterpriseConfig` operation.",
+      "id": "CreateGitHubEnterpriseConfigOperationMetadata",
+      "properties": {
+        "completeTime": {
+          "description": "Time the operation was completed.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "createTime": {
+          "description": "Time the operation was created.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "githubEnterpriseConfig": {
+          "description": "The resource name of the GitHubEnterprise to be created. Format: `projects/{project}/locations/{location}/githubEnterpriseConfigs/{id}`.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "CreateWorkerPoolOperationMetadata": {
       "description": "Metadata for the `CreateWorkerPool` operation.",
       "id": "CreateWorkerPoolOperationMetadata",
@@ -846,6 +867,27 @@
       },
       "type": "object"
     },
+    "DeleteGitHubEnterpriseConfigOperationMetadata": {
+      "description": "Metadata for `DeleteGitHubEnterpriseConfig` operation.",
+      "id": "DeleteGitHubEnterpriseConfigOperationMetadata",
+      "properties": {
+        "completeTime": {
+          "description": "Time the operation was completed.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "createTime": {
+          "description": "Time the operation was created.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "githubEnterpriseConfig": {
+          "description": "The resource name of the GitHubEnterprise to be deleted. Format: `projects/{project}/locations/{location}/githubEnterpriseConfigs/{id}`.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "DeleteWorkerPoolOperationMetadata": {
       "description": "Metadata for the `DeleteWorkerPool` operation.",
       "id": "DeleteWorkerPoolOperationMetadata",
@@ -1256,6 +1298,27 @@
       },
       "type": "object"
     },
+    "ProcessAppManifestCallbackOperationMetadata": {
+      "description": "Metadata for `ProcessAppManifestCallback` operation.",
+      "id": "ProcessAppManifestCallbackOperationMetadata",
+      "properties": {
+        "completeTime": {
+          "description": "Time the operation was completed.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "createTime": {
+          "description": "Time the operation was created.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "githubEnterpriseConfig": {
+          "description": "The resource name of the GitHubEnterprise to be created. Format: `projects/{project}/locations/{location}/githubEnterpriseConfigs/{id}`.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "RepoSource": {
       "description": "Location of the source in a Google Cloud Source Repository.",
       "id": "RepoSource",
@@ -1570,6 +1633,27 @@
       },
       "type": "object"
     },
+    "UpdateGitHubEnterpriseConfigOperationMetadata": {
+      "description": "Metadata for `UpdateGitHubEnterpriseConfig` operation.",
+      "id": "UpdateGitHubEnterpriseConfigOperationMetadata",
+      "properties": {
+        "completeTime": {
+          "description": "Time the operation was completed.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "createTime": {
+          "description": "Time the operation was created.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "githubEnterpriseConfig": {
+          "description": "The resource name of the GitHubEnterprise to be updated. Format: `projects/{project}/locations/{location}/githubEnterpriseConfigs/{id}`.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "UpdateWorkerPoolOperationMetadata": {
       "description": "Metadata for the `UpdateWorkerPool` operation.",
       "id": "UpdateWorkerPoolOperationMetadata",
diff --git a/googleapiclient/discovery_cache/documents/cloudbuild.v1alpha2.json b/googleapiclient/discovery_cache/documents/cloudbuild.v1alpha2.json
index 91b6b16..0a24b80 100644
--- a/googleapiclient/discovery_cache/documents/cloudbuild.v1alpha2.json
+++ b/googleapiclient/discovery_cache/documents/cloudbuild.v1alpha2.json
@@ -317,7 +317,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210723",
   "rootUrl": "https://cloudbuild.googleapis.com/",
   "schemas": {
     "ArtifactObjects": {
@@ -546,7 +546,7 @@
           "additionalProperties": {
             "$ref": "TimeSpan"
           },
-          "description": "Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. If the build does not specify source or images, these keys will not be included.",
+          "description": "Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps. * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. * SETUPBUILD: time to set up build. If the build does not specify source or images, these keys will not be included.",
           "readOnly": true,
           "type": "object"
         },
@@ -836,6 +836,27 @@
       "properties": {},
       "type": "object"
     },
+    "CreateGitHubEnterpriseConfigOperationMetadata": {
+      "description": "Metadata for `CreateGithubEnterpriseConfig` operation.",
+      "id": "CreateGitHubEnterpriseConfigOperationMetadata",
+      "properties": {
+        "completeTime": {
+          "description": "Time the operation was completed.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "createTime": {
+          "description": "Time the operation was created.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "githubEnterpriseConfig": {
+          "description": "The resource name of the GitHubEnterprise to be created. Format: `projects/{project}/locations/{location}/githubEnterpriseConfigs/{id}`.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "CreateWorkerPoolOperationMetadata": {
       "description": "Metadata for the `CreateWorkerPool` operation.",
       "id": "CreateWorkerPoolOperationMetadata",
@@ -857,6 +878,27 @@
       },
       "type": "object"
     },
+    "DeleteGitHubEnterpriseConfigOperationMetadata": {
+      "description": "Metadata for `DeleteGitHubEnterpriseConfig` operation.",
+      "id": "DeleteGitHubEnterpriseConfigOperationMetadata",
+      "properties": {
+        "completeTime": {
+          "description": "Time the operation was completed.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "createTime": {
+          "description": "Time the operation was created.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "githubEnterpriseConfig": {
+          "description": "The resource name of the GitHubEnterprise to be deleted. Format: `projects/{project}/locations/{location}/githubEnterpriseConfigs/{id}`.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "DeleteWorkerPoolOperationMetadata": {
       "description": "Metadata for the `DeleteWorkerPool` operation.",
       "id": "DeleteWorkerPoolOperationMetadata",
@@ -1259,6 +1301,27 @@
       },
       "type": "object"
     },
+    "ProcessAppManifestCallbackOperationMetadata": {
+      "description": "Metadata for `ProcessAppManifestCallback` operation.",
+      "id": "ProcessAppManifestCallbackOperationMetadata",
+      "properties": {
+        "completeTime": {
+          "description": "Time the operation was completed.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "createTime": {
+          "description": "Time the operation was created.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "githubEnterpriseConfig": {
+          "description": "The resource name of the GitHubEnterprise to be created. Format: `projects/{project}/locations/{location}/githubEnterpriseConfigs/{id}`.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "RepoSource": {
       "description": "Location of the source in a Google Cloud Source Repository.",
       "id": "RepoSource",
@@ -1573,6 +1636,27 @@
       },
       "type": "object"
     },
+    "UpdateGitHubEnterpriseConfigOperationMetadata": {
+      "description": "Metadata for `UpdateGitHubEnterpriseConfig` operation.",
+      "id": "UpdateGitHubEnterpriseConfigOperationMetadata",
+      "properties": {
+        "completeTime": {
+          "description": "Time the operation was completed.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "createTime": {
+          "description": "Time the operation was created.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "githubEnterpriseConfig": {
+          "description": "The resource name of the GitHubEnterprise to be updated. Format: `projects/{project}/locations/{location}/githubEnterpriseConfigs/{id}`.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "UpdateWorkerPoolOperationMetadata": {
       "description": "Metadata for the `UpdateWorkerPool` operation.",
       "id": "UpdateWorkerPoolOperationMetadata",
diff --git a/googleapiclient/discovery_cache/documents/cloudbuild.v1beta1.json b/googleapiclient/discovery_cache/documents/cloudbuild.v1beta1.json
index 60fc26e..8846789 100644
--- a/googleapiclient/discovery_cache/documents/cloudbuild.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/cloudbuild.v1beta1.json
@@ -317,7 +317,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210723",
   "rootUrl": "https://cloudbuild.googleapis.com/",
   "schemas": {
     "ArtifactObjects": {
@@ -546,7 +546,7 @@
           "additionalProperties": {
             "$ref": "TimeSpan"
           },
-          "description": "Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. If the build does not specify source or images, these keys will not be included.",
+          "description": "Output only. Stores timing information for phases of the build. Valid keys are: * BUILD: time to execute all build steps. * PUSH: time to push all specified images. * FETCHSOURCE: time to fetch source. * SETUPBUILD: time to set up build. If the build does not specify source or images, these keys will not be included.",
           "readOnly": true,
           "type": "object"
         },
@@ -836,6 +836,27 @@
       "properties": {},
       "type": "object"
     },
+    "CreateGitHubEnterpriseConfigOperationMetadata": {
+      "description": "Metadata for `CreateGithubEnterpriseConfig` operation.",
+      "id": "CreateGitHubEnterpriseConfigOperationMetadata",
+      "properties": {
+        "completeTime": {
+          "description": "Time the operation was completed.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "createTime": {
+          "description": "Time the operation was created.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "githubEnterpriseConfig": {
+          "description": "The resource name of the GitHubEnterprise to be created. Format: `projects/{project}/locations/{location}/githubEnterpriseConfigs/{id}`.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "CreateWorkerPoolOperationMetadata": {
       "description": "Metadata for the `CreateWorkerPool` operation.",
       "id": "CreateWorkerPoolOperationMetadata",
@@ -857,6 +878,27 @@
       },
       "type": "object"
     },
+    "DeleteGitHubEnterpriseConfigOperationMetadata": {
+      "description": "Metadata for `DeleteGitHubEnterpriseConfig` operation.",
+      "id": "DeleteGitHubEnterpriseConfigOperationMetadata",
+      "properties": {
+        "completeTime": {
+          "description": "Time the operation was completed.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "createTime": {
+          "description": "Time the operation was created.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "githubEnterpriseConfig": {
+          "description": "The resource name of the GitHubEnterprise to be deleted. Format: `projects/{project}/locations/{location}/githubEnterpriseConfigs/{id}`.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "DeleteWorkerPoolOperationMetadata": {
       "description": "Metadata for the `DeleteWorkerPool` operation.",
       "id": "DeleteWorkerPoolOperationMetadata",
@@ -1259,6 +1301,27 @@
       },
       "type": "object"
     },
+    "ProcessAppManifestCallbackOperationMetadata": {
+      "description": "Metadata for `ProcessAppManifestCallback` operation.",
+      "id": "ProcessAppManifestCallbackOperationMetadata",
+      "properties": {
+        "completeTime": {
+          "description": "Time the operation was completed.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "createTime": {
+          "description": "Time the operation was created.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "githubEnterpriseConfig": {
+          "description": "The resource name of the GitHubEnterprise to be created. Format: `projects/{project}/locations/{location}/githubEnterpriseConfigs/{id}`.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "RepoSource": {
       "description": "Location of the source in a Google Cloud Source Repository.",
       "id": "RepoSource",
@@ -1573,6 +1636,27 @@
       },
       "type": "object"
     },
+    "UpdateGitHubEnterpriseConfigOperationMetadata": {
+      "description": "Metadata for `UpdateGitHubEnterpriseConfig` operation.",
+      "id": "UpdateGitHubEnterpriseConfigOperationMetadata",
+      "properties": {
+        "completeTime": {
+          "description": "Time the operation was completed.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "createTime": {
+          "description": "Time the operation was created.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "githubEnterpriseConfig": {
+          "description": "The resource name of the GitHubEnterprise to be updated. Format: `projects/{project}/locations/{location}/githubEnterpriseConfigs/{id}`.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "UpdateWorkerPoolOperationMetadata": {
       "description": "Metadata for the `UpdateWorkerPool` operation.",
       "id": "UpdateWorkerPoolOperationMetadata",
diff --git a/googleapiclient/discovery_cache/documents/cloudchannel.v1.json b/googleapiclient/discovery_cache/documents/cloudchannel.v1.json
index c54d5fa..cb701c7 100644
--- a/googleapiclient/discovery_cache/documents/cloudchannel.v1.json
+++ b/googleapiclient/discovery_cache/documents/cloudchannel.v1.json
@@ -12,7 +12,7 @@
   "baseUrl": "https://cloudchannel.googleapis.com/",
   "batchPath": "batch",
   "canonicalName": "Cloudchannel",
-  "description": "",
+  "description": "The Cloud Channel API enables Google Cloud partners to have a single unified resale platform and APIs across all of Google Cloud including GCP, Workspace, Maps and Chrome.",
   "discoveryVersion": "v1",
   "documentationLink": "https://cloud.google.com/channel",
   "fullyEncodeReservedExpansion": true,
@@ -1533,7 +1533,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://cloudchannel.googleapis.com/",
   "schemas": {
     "GoogleCloudChannelV1ActivateEntitlementRequest": {
diff --git a/googleapiclient/discovery_cache/documents/clouddebugger.v2.json b/googleapiclient/discovery_cache/documents/clouddebugger.v2.json
index f230c90..8727d1c 100644
--- a/googleapiclient/discovery_cache/documents/clouddebugger.v2.json
+++ b/googleapiclient/discovery_cache/documents/clouddebugger.v2.json
@@ -448,7 +448,7 @@
       }
     }
   },
-  "revision": "20210716",
+  "revision": "20210723",
   "rootUrl": "https://clouddebugger.googleapis.com/",
   "schemas": {
     "AliasContext": {
diff --git a/googleapiclient/discovery_cache/documents/clouderrorreporting.v1beta1.json b/googleapiclient/discovery_cache/documents/clouderrorreporting.v1beta1.json
index 2202230..e3e6e15 100644
--- a/googleapiclient/discovery_cache/documents/clouderrorreporting.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/clouderrorreporting.v1beta1.json
@@ -430,7 +430,7 @@
       }
     }
   },
-  "revision": "20210714",
+  "revision": "20210722",
   "rootUrl": "https://clouderrorreporting.googleapis.com/",
   "schemas": {
     "DeleteEventsResponse": {
diff --git a/googleapiclient/discovery_cache/documents/cloudfunctions.v1.json b/googleapiclient/discovery_cache/documents/cloudfunctions.v1.json
index 87d0095..b92392e 100644
--- a/googleapiclient/discovery_cache/documents/cloudfunctions.v1.json
+++ b/googleapiclient/discovery_cache/documents/cloudfunctions.v1.json
@@ -546,7 +546,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210726",
   "rootUrl": "https://cloudfunctions.googleapis.com/",
   "schemas": {
     "AuditConfig": {
diff --git a/googleapiclient/discovery_cache/documents/cloudidentity.v1.json b/googleapiclient/discovery_cache/documents/cloudidentity.v1.json
index 60ddf81..55c586a 100644
--- a/googleapiclient/discovery_cache/documents/cloudidentity.v1.json
+++ b/googleapiclient/discovery_cache/documents/cloudidentity.v1.json
@@ -1273,7 +1273,7 @@
       }
     }
   },
-  "revision": "20210720",
+  "revision": "20210727",
   "rootUrl": "https://cloudidentity.googleapis.com/",
   "schemas": {
     "CheckTransitiveMembershipResponse": {
diff --git a/googleapiclient/discovery_cache/documents/cloudidentity.v1beta1.json b/googleapiclient/discovery_cache/documents/cloudidentity.v1beta1.json
index 9bc59db..d9e8629 100644
--- a/googleapiclient/discovery_cache/documents/cloudidentity.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/cloudidentity.v1beta1.json
@@ -1336,7 +1336,7 @@
       }
     }
   },
-  "revision": "20210720",
+  "revision": "20210727",
   "rootUrl": "https://cloudidentity.googleapis.com/",
   "schemas": {
     "AndroidAttributes": {
diff --git a/googleapiclient/discovery_cache/documents/cloudiot.v1.json b/googleapiclient/discovery_cache/documents/cloudiot.v1.json
index e6155ec..16182d3 100644
--- a/googleapiclient/discovery_cache/documents/cloudiot.v1.json
+++ b/googleapiclient/discovery_cache/documents/cloudiot.v1.json
@@ -938,7 +938,7 @@
       }
     }
   },
-  "revision": "20210713",
+  "revision": "20210721",
   "rootUrl": "https://cloudiot.googleapis.com/",
   "schemas": {
     "BindDeviceToGatewayRequest": {
diff --git a/googleapiclient/discovery_cache/documents/cloudkms.v1.json b/googleapiclient/discovery_cache/documents/cloudkms.v1.json
index b59cbed..cccf1ab 100644
--- a/googleapiclient/discovery_cache/documents/cloudkms.v1.json
+++ b/googleapiclient/discovery_cache/documents/cloudkms.v1.json
@@ -983,6 +983,64 @@
                             "https://www.googleapis.com/auth/cloudkms"
                           ]
                         },
+                        "macSign": {
+                          "description": "Signs data using a CryptoKeyVersion with CryptoKey.purpose MAC, producing a tag that can be verified by another source with the same key.",
+                          "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/keyRings/{keyRingsId}/cryptoKeys/{cryptoKeysId}/cryptoKeyVersions/{cryptoKeyVersionsId}:macSign",
+                          "httpMethod": "POST",
+                          "id": "cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.macSign",
+                          "parameterOrder": [
+                            "name"
+                          ],
+                          "parameters": {
+                            "name": {
+                              "description": "Required. The resource name of the CryptoKeyVersion to use for signing.",
+                              "location": "path",
+                              "pattern": "^projects/[^/]+/locations/[^/]+/keyRings/[^/]+/cryptoKeys/[^/]+/cryptoKeyVersions/[^/]+$",
+                              "required": true,
+                              "type": "string"
+                            }
+                          },
+                          "path": "v1/{+name}:macSign",
+                          "request": {
+                            "$ref": "MacSignRequest"
+                          },
+                          "response": {
+                            "$ref": "MacSignResponse"
+                          },
+                          "scopes": [
+                            "https://www.googleapis.com/auth/cloud-platform",
+                            "https://www.googleapis.com/auth/cloudkms"
+                          ]
+                        },
+                        "macVerify": {
+                          "description": "Verifies MAC tag using a CryptoKeyVersion with CryptoKey.purpose MAC, and returns a response that indicates whether or not the verification was successful.",
+                          "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/keyRings/{keyRingsId}/cryptoKeys/{cryptoKeysId}/cryptoKeyVersions/{cryptoKeyVersionsId}:macVerify",
+                          "httpMethod": "POST",
+                          "id": "cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.macVerify",
+                          "parameterOrder": [
+                            "name"
+                          ],
+                          "parameters": {
+                            "name": {
+                              "description": "Required. The resource name of the CryptoKeyVersion to use for verification.",
+                              "location": "path",
+                              "pattern": "^projects/[^/]+/locations/[^/]+/keyRings/[^/]+/cryptoKeys/[^/]+/cryptoKeyVersions/[^/]+$",
+                              "required": true,
+                              "type": "string"
+                            }
+                          },
+                          "path": "v1/{+name}:macVerify",
+                          "request": {
+                            "$ref": "MacVerifyRequest"
+                          },
+                          "response": {
+                            "$ref": "MacVerifyResponse"
+                          },
+                          "scopes": [
+                            "https://www.googleapis.com/auth/cloud-platform",
+                            "https://www.googleapis.com/auth/cloudkms"
+                          ]
+                        },
                         "patch": {
                           "description": "Update a CryptoKeyVersion's metadata. state may be changed between ENABLED and DISABLED using this method. See DestroyCryptoKeyVersion and RestoreCryptoKeyVersion to move between other states.",
                           "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/keyRings/{keyRingsId}/cryptoKeys/{cryptoKeysId}/cryptoKeyVersions/{cryptoKeyVersionsId}",
@@ -1259,7 +1317,7 @@
       }
     }
   },
-  "revision": "20210713",
+  "revision": "20210723",
   "rootUrl": "https://cloudkms.googleapis.com/",
   "schemas": {
     "AsymmetricDecryptRequest": {
@@ -1509,13 +1567,15 @@
             "CRYPTO_KEY_PURPOSE_UNSPECIFIED",
             "ENCRYPT_DECRYPT",
             "ASYMMETRIC_SIGN",
-            "ASYMMETRIC_DECRYPT"
+            "ASYMMETRIC_DECRYPT",
+            "MAC"
           ],
           "enumDescriptions": [
             "Not specified.",
             "CryptoKeys with this purpose may be used with Encrypt and Decrypt.",
             "CryptoKeys with this purpose may be used with AsymmetricSign and GetPublicKey.",
-            "CryptoKeys with this purpose may be used with AsymmetricDecrypt and GetPublicKey."
+            "CryptoKeys with this purpose may be used with AsymmetricDecrypt and GetPublicKey.",
+            "CryptoKeys with this purpose may be used with MacSign."
           ],
           "type": "string"
         },
@@ -1555,6 +1615,7 @@
             "EC_SIGN_P256_SHA256",
             "EC_SIGN_P384_SHA384",
             "EC_SIGN_SECP256K1_SHA256",
+            "HMAC_SHA256",
             "EXTERNAL_SYMMETRIC_ENCRYPTION"
           ],
           "enumDescriptions": [
@@ -1575,6 +1636,7 @@
             "ECDSA on the NIST P-256 curve with a SHA256 digest.",
             "ECDSA on the NIST P-384 curve with a SHA384 digest.",
             "ECDSA on the non-NIST secp256k1 curve. This curve is only supported for HSM protection level.",
+            "HMAC-SHA256 signing with a 256 bit key.",
             "Algorithm representing symmetric encryption by an external key manager."
           ],
           "readOnly": true,
@@ -1702,6 +1764,7 @@
             "EC_SIGN_P256_SHA256",
             "EC_SIGN_P384_SHA384",
             "EC_SIGN_SECP256K1_SHA256",
+            "HMAC_SHA256",
             "EXTERNAL_SYMMETRIC_ENCRYPTION"
           ],
           "enumDescriptions": [
@@ -1722,6 +1785,7 @@
             "ECDSA on the NIST P-256 curve with a SHA256 digest.",
             "ECDSA on the NIST P-384 curve with a SHA384 digest.",
             "ECDSA on the non-NIST secp256k1 curve. This curve is only supported for HSM protection level.",
+            "HMAC-SHA256 signing with a 256 bit key.",
             "Algorithm representing symmetric encryption by an external key manager."
           ],
           "type": "string"
@@ -1967,6 +2031,7 @@
             "EC_SIGN_P256_SHA256",
             "EC_SIGN_P384_SHA384",
             "EC_SIGN_SECP256K1_SHA256",
+            "HMAC_SHA256",
             "EXTERNAL_SYMMETRIC_ENCRYPTION"
           ],
           "enumDescriptions": [
@@ -1987,6 +2052,7 @@
             "ECDSA on the NIST P-256 curve with a SHA256 digest.",
             "ECDSA on the NIST P-384 curve with a SHA384 digest.",
             "ECDSA on the non-NIST secp256k1 curve. This curve is only supported for HSM protection level.",
+            "HMAC-SHA256 signing with a 256 bit key.",
             "Algorithm representing symmetric encryption by an external key manager."
           ],
           "type": "string"
@@ -2306,6 +2372,134 @@
       },
       "type": "object"
     },
+    "MacSignRequest": {
+      "description": "Request message for KeyManagementService.MacSign.",
+      "id": "MacSignRequest",
+      "properties": {
+        "data": {
+          "description": "Required. The data to sign. The MAC tag is computed over this data field based on the specific algorithm.",
+          "format": "byte",
+          "type": "string"
+        },
+        "dataCrc32c": {
+          "description": "Optional. An optional CRC32C checksum of the MacSignRequest.data. If specified, KeyManagementService will verify the integrity of the received MacSignRequest.data using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(MacSignRequest.data) is equal to MacSignRequest.data_crc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.",
+          "format": "int64",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "MacSignResponse": {
+      "description": "Response message for KeyManagementService.MacSign.",
+      "id": "MacSignResponse",
+      "properties": {
+        "mac": {
+          "description": "The created signature.",
+          "format": "byte",
+          "type": "string"
+        },
+        "macCrc32c": {
+          "description": "Integrity verification field. A CRC32C checksum of the returned MacSignResponse.mac. An integrity check of MacSignResponse.mac can be performed by computing the CRC32C checksum of MacSignResponse.mac and comparing your results to this field. Discard the response in case of non-matching checksum values, and perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.",
+          "format": "int64",
+          "type": "string"
+        },
+        "name": {
+          "description": "The resource name of the CryptoKeyVersion used for signing. Check this field to verify that the intended resource was used for signing.",
+          "type": "string"
+        },
+        "protectionLevel": {
+          "description": "The ProtectionLevel of the CryptoKeyVersion used for signing.",
+          "enum": [
+            "PROTECTION_LEVEL_UNSPECIFIED",
+            "SOFTWARE",
+            "HSM",
+            "EXTERNAL"
+          ],
+          "enumDescriptions": [
+            "Not specified.",
+            "Crypto operations are performed in software.",
+            "Crypto operations are performed in a Hardware Security Module.",
+            "Crypto operations are performed by an external key manager."
+          ],
+          "type": "string"
+        },
+        "verifiedDataCrc32c": {
+          "description": "Integrity verification field. A flag indicating whether MacSignRequest.data_crc32c was received by KeyManagementService and used for the integrity verification of the data. A false value of this field indicates either that MacSignRequest.data_crc32c was left unset or that it was not delivered to KeyManagementService. If you've set MacSignRequest.data_crc32c but this field is still false, discard the response and perform a limited number of retries.",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "MacVerifyRequest": {
+      "description": "Request message for KeyManagementService.MacVerify.",
+      "id": "MacVerifyRequest",
+      "properties": {
+        "data": {
+          "description": "Required. The data used previously as a MacSignRequest.data to generate the MAC tag.",
+          "format": "byte",
+          "type": "string"
+        },
+        "dataCrc32c": {
+          "description": "Optional. An optional CRC32C checksum of the MacVerifyRequest.data. If specified, KeyManagementService will verify the integrity of the received MacVerifyRequest.data using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(MacVerifyRequest.data) is equal to MacVerifyRequest.data_crc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.",
+          "format": "int64",
+          "type": "string"
+        },
+        "mac": {
+          "description": "Required. The signature to verify.",
+          "format": "byte",
+          "type": "string"
+        },
+        "macCrc32c": {
+          "description": "Optional. An optional CRC32C checksum of the MacVerifyRequest.mac. If specified, KeyManagementService will verify the integrity of the received MacVerifyRequest.mac using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(MacVerifyRequest.tag) is equal to MacVerifyRequest.mac_crc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.",
+          "format": "int64",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "MacVerifyResponse": {
+      "description": "Response message for KeyManagementService.MacVerify.",
+      "id": "MacVerifyResponse",
+      "properties": {
+        "name": {
+          "description": "The resource name of the CryptoKeyVersion used for verification. Check this field to verify that the intended resource was used for verification.",
+          "type": "string"
+        },
+        "protectionLevel": {
+          "description": "The ProtectionLevel of the CryptoKeyVersion used for verification.",
+          "enum": [
+            "PROTECTION_LEVEL_UNSPECIFIED",
+            "SOFTWARE",
+            "HSM",
+            "EXTERNAL"
+          ],
+          "enumDescriptions": [
+            "Not specified.",
+            "Crypto operations are performed in software.",
+            "Crypto operations are performed in a Hardware Security Module.",
+            "Crypto operations are performed by an external key manager."
+          ],
+          "type": "string"
+        },
+        "success": {
+          "description": "This field indicates whether or not the verification operation for MacVerifyRequest.mac over MacVerifyRequest.data was successful.",
+          "type": "boolean"
+        },
+        "verifiedDataCrc32c": {
+          "description": "Integrity verification field. A flag indicating whether MacVerifyRequest.data_crc32c was received by KeyManagementService and used for the integrity verification of the data. A false value of this field indicates either that MacVerifyRequest.data_crc32c was left unset or that it was not delivered to KeyManagementService. If you've set MacVerifyRequest.data_crc32c but this field is still false, discard the response and perform a limited number of retries.",
+          "type": "boolean"
+        },
+        "verifiedMacCrc32c": {
+          "description": "Integrity verification field. A flag indicating whether MacVerifyRequest.mac_crc32c was received by KeyManagementService and used for the integrity verification of the data. A false value of this field indicates either that MacVerifyRequest.mac_crc32c was left unset or that it was not delivered to KeyManagementService. If you've set MacVerifyRequest.mac_crc32c but this field is still false, discard the response and perform a limited number of retries.",
+          "type": "boolean"
+        },
+        "verifiedSuccessIntegrity": {
+          "description": "Integrity verification field. This value is used for the integrity verification of [MacVerifyResponse.success]. If the value of this field contradicts the value of [MacVerifyResponse.success], discard the response and perform a limited number of retries.",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
     "Policy": {
       "description": "An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { \"bindings\": [ { \"role\": \"roles/resourcemanager.organizationAdmin\", \"members\": [ \"user:mike@example.com\", \"group:admins@example.com\", \"domain:google.com\", \"serviceAccount:my-project-id@appspot.gserviceaccount.com\" ] }, { \"role\": \"roles/resourcemanager.organizationViewer\", \"members\": [ \"user:eve@example.com\" ], \"condition\": { \"title\": \"expirable access\", \"description\": \"Does not grant access after Sep 2020\", \"expression\": \"request.time < timestamp('2020-10-01T00:00:00.000Z')\", } } ], \"etag\": \"BwWWja0YfJA=\", \"version\": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).",
       "id": "Policy",
@@ -2361,6 +2555,7 @@
             "EC_SIGN_P256_SHA256",
             "EC_SIGN_P384_SHA384",
             "EC_SIGN_SECP256K1_SHA256",
+            "HMAC_SHA256",
             "EXTERNAL_SYMMETRIC_ENCRYPTION"
           ],
           "enumDescriptions": [
@@ -2381,6 +2576,7 @@
             "ECDSA on the NIST P-256 curve with a SHA256 digest.",
             "ECDSA on the NIST P-384 curve with a SHA384 digest.",
             "ECDSA on the non-NIST secp256k1 curve. This curve is only supported for HSM protection level.",
+            "HMAC-SHA256 signing with a 256 bit key.",
             "Algorithm representing symmetric encryption by an external key manager."
           ],
           "type": "string"
diff --git a/googleapiclient/discovery_cache/documents/cloudprofiler.v2.json b/googleapiclient/discovery_cache/documents/cloudprofiler.v2.json
index a717af2..e00941b 100644
--- a/googleapiclient/discovery_cache/documents/cloudprofiler.v2.json
+++ b/googleapiclient/discovery_cache/documents/cloudprofiler.v2.json
@@ -216,7 +216,7 @@
       }
     }
   },
-  "revision": "20210717",
+  "revision": "20210723",
   "rootUrl": "https://cloudprofiler.googleapis.com/",
   "schemas": {
     "CreateProfileRequest": {
diff --git a/googleapiclient/discovery_cache/documents/cloudresourcemanager.v1.json b/googleapiclient/discovery_cache/documents/cloudresourcemanager.v1.json
index 9b1bd34..9c5e0ac 100644
--- a/googleapiclient/discovery_cache/documents/cloudresourcemanager.v1.json
+++ b/googleapiclient/discovery_cache/documents/cloudresourcemanager.v1.json
@@ -1171,7 +1171,7 @@
       }
     }
   },
-  "revision": "20210718",
+  "revision": "20210725",
   "rootUrl": "https://cloudresourcemanager.googleapis.com/",
   "schemas": {
     "Ancestor": {
diff --git a/googleapiclient/discovery_cache/documents/cloudresourcemanager.v1beta1.json b/googleapiclient/discovery_cache/documents/cloudresourcemanager.v1beta1.json
index 75c6bf1..7123c36 100644
--- a/googleapiclient/discovery_cache/documents/cloudresourcemanager.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/cloudresourcemanager.v1beta1.json
@@ -566,7 +566,7 @@
       }
     }
   },
-  "revision": "20210718",
+  "revision": "20210725",
   "rootUrl": "https://cloudresourcemanager.googleapis.com/",
   "schemas": {
     "Ancestor": {
diff --git a/googleapiclient/discovery_cache/documents/cloudresourcemanager.v2.json b/googleapiclient/discovery_cache/documents/cloudresourcemanager.v2.json
index 9a6345a..aa562b1 100644
--- a/googleapiclient/discovery_cache/documents/cloudresourcemanager.v2.json
+++ b/googleapiclient/discovery_cache/documents/cloudresourcemanager.v2.json
@@ -450,7 +450,7 @@
       }
     }
   },
-  "revision": "20210718",
+  "revision": "20210725",
   "rootUrl": "https://cloudresourcemanager.googleapis.com/",
   "schemas": {
     "AuditConfig": {
diff --git a/googleapiclient/discovery_cache/documents/cloudresourcemanager.v2beta1.json b/googleapiclient/discovery_cache/documents/cloudresourcemanager.v2beta1.json
index a120f79..d099aef 100644
--- a/googleapiclient/discovery_cache/documents/cloudresourcemanager.v2beta1.json
+++ b/googleapiclient/discovery_cache/documents/cloudresourcemanager.v2beta1.json
@@ -450,7 +450,7 @@
       }
     }
   },
-  "revision": "20210718",
+  "revision": "20210725",
   "rootUrl": "https://cloudresourcemanager.googleapis.com/",
   "schemas": {
     "AuditConfig": {
diff --git a/googleapiclient/discovery_cache/documents/cloudresourcemanager.v3.json b/googleapiclient/discovery_cache/documents/cloudresourcemanager.v3.json
index 8714f98..3c63e69 100644
--- a/googleapiclient/discovery_cache/documents/cloudresourcemanager.v3.json
+++ b/googleapiclient/discovery_cache/documents/cloudresourcemanager.v3.json
@@ -1612,7 +1612,7 @@
       }
     }
   },
-  "revision": "20210718",
+  "revision": "20210725",
   "rootUrl": "https://cloudresourcemanager.googleapis.com/",
   "schemas": {
     "AuditConfig": {
diff --git a/googleapiclient/discovery_cache/documents/cloudsearch.v1.json b/googleapiclient/discovery_cache/documents/cloudsearch.v1.json
index 011701d..63e6e42 100644
--- a/googleapiclient/discovery_cache/documents/cloudsearch.v1.json
+++ b/googleapiclient/discovery_cache/documents/cloudsearch.v1.json
@@ -1916,7 +1916,7 @@
       }
     }
   },
-  "revision": "20210713",
+  "revision": "20210719",
   "rootUrl": "https://cloudsearch.googleapis.com/",
   "schemas": {
     "AuditLoggingSettings": {
diff --git a/googleapiclient/discovery_cache/documents/cloudshell.v1.json b/googleapiclient/discovery_cache/documents/cloudshell.v1.json
index ca26e2a..33d1c8a 100644
--- a/googleapiclient/discovery_cache/documents/cloudshell.v1.json
+++ b/googleapiclient/discovery_cache/documents/cloudshell.v1.json
@@ -374,7 +374,7 @@
       }
     }
   },
-  "revision": "20210712",
+  "revision": "20210726",
   "rootUrl": "https://cloudshell.googleapis.com/",
   "schemas": {
     "AddPublicKeyMetadata": {
diff --git a/googleapiclient/discovery_cache/documents/composer.v1.json b/googleapiclient/discovery_cache/documents/composer.v1.json
index 464d715..2661858 100644
--- a/googleapiclient/discovery_cache/documents/composer.v1.json
+++ b/googleapiclient/discovery_cache/documents/composer.v1.json
@@ -406,7 +406,7 @@
       }
     }
   },
-  "revision": "20210721",
+  "revision": "20210728",
   "rootUrl": "https://composer.googleapis.com/",
   "schemas": {
     "AllowedIpRange": {
diff --git a/googleapiclient/discovery_cache/documents/composer.v1beta1.json b/googleapiclient/discovery_cache/documents/composer.v1beta1.json
index fbe0609..a718524 100644
--- a/googleapiclient/discovery_cache/documents/composer.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/composer.v1beta1.json
@@ -270,7 +270,7 @@
                       "type": "string"
                     },
                     "updateMask": {
-                      "description": "Required. A comma-separated list of paths, relative to `Environment`, of fields to update. For example, to set the version of scikit-learn to install in the environment to 0.19.0 and to remove an existing installation of argparse, the `updateMask` parameter would include the following two `paths` values: \"config.softwareConfig.pypiPackages.scikit-learn\" and \"config.softwareConfig.pypiPackages.argparse\". The included patch environment would specify the scikit-learn version as follows: { \"config\":{ \"softwareConfig\":{ \"pypiPackages\":{ \"scikit-learn\":\"==0.19.0\" } } } } Note that in the above example, any existing PyPI packages other than scikit-learn and argparse will be unaffected. Only one update type may be included in a single request's `updateMask`. For example, one cannot update both the PyPI packages and labels in the same request. However, it is possible to update multiple members of a map field simultaneously in the same request. For example, to set the labels \"label1\" and \"label2\" while clearing \"label3\" (assuming it already exists), one can provide the paths \"labels.label1\", \"labels.label2\", and \"labels.label3\" and populate the patch environment as follows: { \"labels\":{ \"label1\":\"new-label1-value\" \"label2\":\"new-label2-value\" } } Note that in the above example, any existing labels that are not included in the `updateMask` will be unaffected. It is also possible to replace an entire map field by providing the map field's path in the `updateMask`. The new value of the field will be that which is provided in the patch environment. For example, to delete all pre-existing user-specified PyPI packages and install botocore at version 1.7.14, the `updateMask` would contain the path \"config.softwareConfig.pypiPackages\", and the patch environment would be the following: { \"config\":{ \"softwareConfig\":{ \"pypiPackages\":{ \"botocore\":\"==1.7.14\" } } } } **Note:** Only the following fields can be updated: * `config.softwareConfig.pypiPackages` * Replace all custom custom PyPI packages. If a replacement package map is not included in `environment`, all custom PyPI packages are cleared. It is an error to provide both this mask and a mask specifying an individual package. * `config.softwareConfig.pypiPackages.`packagename * Update the custom PyPI package *packagename*, preserving other packages. To delete the package, include it in `updateMask`, and omit the mapping for it in `environment.config.softwareConfig.pypiPackages`. It is an error to provide both a mask of this form and the `config.softwareConfig.pypiPackages` mask. * `labels` * Replace all environment labels. If a replacement labels map is not included in `environment`, all labels are cleared. It is an error to provide both this mask and a mask specifying one or more individual labels. * `labels.`labelName * Set the label named *labelName*, while preserving other labels. To delete the label, include it in `updateMask` and omit its mapping in `environment.labels`. It is an error to provide both a mask of this form and the `labels` mask. * `config.nodeCount` * Horizontally scale the number of nodes in the environment. An integer greater than or equal to 3 must be provided in the `config.nodeCount` field. * `config.webServerNetworkAccessControl` * Replace the environment's current WebServerNetworkAccessControl. * `config.softwareConfig.airflowConfigOverrides` * Replace all Apache Airflow config overrides. If a replacement config overrides map is not included in `environment`, all config overrides are cleared. It is an error to provide both this mask and a mask specifying one or more individual config overrides. * `config.softwareConfig.airflowConfigOverrides.`section-name * Override the Apache Airflow config property *name* in the section named *section*, preserving other properties. To delete the property override, include it in `updateMask` and omit its mapping in `environment.config.softwareConfig.airflowConfigOverrides`. It is an error to provide both a mask of this form and the `config.softwareConfig.airflowConfigOverrides` mask. * `config.softwareConfig.envVariables` * Replace all environment variables. If a replacement environment variable map is not included in `environment`, all custom environment variables are cleared. It is an error to provide both this mask and a mask specifying one or more individual environment variables. * `config.softwareConfig.imageVersion` * Upgrade the version of the environment in-place. Refer to `SoftwareConfig.image_version` for information on how to format the new image version. Additionally, the new image version cannot effect a version downgrade and must match the current image version's Composer major version and Airflow major and minor versions. Consult the [Cloud Composer Version List](https://cloud.google.com/composer/docs/concepts/versioning/composer-versions) for valid values. * `config.softwareConfig.schedulerCount` * Horizontally scale the number of schedulers in Airflow. A positive integer not greater than the number of nodes must be provided in the `config.softwareConfig.schedulerCount` field. * `config.databaseConfig.machineType` * Cloud SQL machine type used by Airflow database. It has to be one of: db-n1-standard-2, db-n1-standard-4, db-n1-standard-8 or db-n1-standard-16. * `config.webServerConfig.machineType` * Machine type on which Airflow web server is running. It has to be one of: composer-n1-webserver-2, composer-n1-webserver-4 or composer-n1-webserver-8. * `config.maintenanceWindow` * Maintenance window during which Cloud Composer components may be under maintenance.",
+                      "description": "Required. A comma-separated list of paths, relative to `Environment`, of fields to update. For example, to set the version of scikit-learn to install in the environment to 0.19.0 and to remove an existing installation of argparse, the `updateMask` parameter would include the following two `paths` values: \"config.softwareConfig.pypiPackages.scikit-learn\" and \"config.softwareConfig.pypiPackages.argparse\". The included patch environment would specify the scikit-learn version as follows: { \"config\":{ \"softwareConfig\":{ \"pypiPackages\":{ \"scikit-learn\":\"==0.19.0\" } } } } Note that in the above example, any existing PyPI packages other than scikit-learn and argparse will be unaffected. Only one update type may be included in a single request's `updateMask`. For example, one cannot update both the PyPI packages and labels in the same request. However, it is possible to update multiple members of a map field simultaneously in the same request. For example, to set the labels \"label1\" and \"label2\" while clearing \"label3\" (assuming it already exists), one can provide the paths \"labels.label1\", \"labels.label2\", and \"labels.label3\" and populate the patch environment as follows: { \"labels\":{ \"label1\":\"new-label1-value\" \"label2\":\"new-label2-value\" } } Note that in the above example, any existing labels that are not included in the `updateMask` will be unaffected. It is also possible to replace an entire map field by providing the map field's path in the `updateMask`. The new value of the field will be that which is provided in the patch environment. For example, to delete all pre-existing user-specified PyPI packages and install botocore at version 1.7.14, the `updateMask` would contain the path \"config.softwareConfig.pypiPackages\", and the patch environment would be the following: { \"config\":{ \"softwareConfig\":{ \"pypiPackages\":{ \"botocore\":\"==1.7.14\" } } } } **Note:** Only the following fields can be updated: * `config.softwareConfig.pypiPackages` * Replace all custom custom PyPI packages. If a replacement package map is not included in `environment`, all custom PyPI packages are cleared. It is an error to provide both this mask and a mask specifying an individual package. * `config.softwareConfig.pypiPackages.`packagename * Update the custom PyPI package *packagename*, preserving other packages. To delete the package, include it in `updateMask`, and omit the mapping for it in `environment.config.softwareConfig.pypiPackages`. It is an error to provide both a mask of this form and the `config.softwareConfig.pypiPackages` mask. * `labels` * Replace all environment labels. If a replacement labels map is not included in `environment`, all labels are cleared. It is an error to provide both this mask and a mask specifying one or more individual labels. * `labels.`labelName * Set the label named *labelName*, while preserving other labels. To delete the label, include it in `updateMask` and omit its mapping in `environment.labels`. It is an error to provide both a mask of this form and the `labels` mask. * `config.nodeCount` * Horizontally scale the number of nodes in the environment. An integer greater than or equal to 3 must be provided in the `config.nodeCount` field. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. * `config.webServerNetworkAccessControl` * Replace the environment's current WebServerNetworkAccessControl. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. * `config.softwareConfig.airflowConfigOverrides` * Replace all Apache Airflow config overrides. If a replacement config overrides map is not included in `environment`, all config overrides are cleared. It is an error to provide both this mask and a mask specifying one or more individual config overrides. * `config.softwareConfig.airflowConfigOverrides.`section-name * Override the Apache Airflow config property *name* in the section named *section*, preserving other properties. To delete the property override, include it in `updateMask` and omit its mapping in `environment.config.softwareConfig.airflowConfigOverrides`. It is an error to provide both a mask of this form and the `config.softwareConfig.airflowConfigOverrides` mask. * `config.softwareConfig.envVariables` * Replace all environment variables. If a replacement environment variable map is not included in `environment`, all custom environment variables are cleared. It is an error to provide both this mask and a mask specifying one or more individual environment variables. * `config.softwareConfig.imageVersion` * Upgrade the version of the environment in-place. Refer to `SoftwareConfig.image_version` for information on how to format the new image version. Additionally, the new image version cannot effect a version downgrade and must match the current image version's Composer major version and Airflow major and minor versions. Consult the [Cloud Composer Version List](https://cloud.google.com/composer/docs/concepts/versioning/composer-versions) for valid values. * `config.softwareConfig.schedulerCount` * Horizontally scale the number of schedulers in Airflow. A positive integer not greater than the number of nodes must be provided in the `config.softwareConfig.schedulerCount` field. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-2.*.*. * `config.databaseConfig.machineType` * Cloud SQL machine type used by Airflow database. It has to be one of: db-n1-standard-2, db-n1-standard-4, db-n1-standard-8 or db-n1-standard-16. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. * `config.webServerConfig.machineType` * Machine type on which Airflow web server is running. It has to be one of: composer-n1-webserver-2, composer-n1-webserver-4 or composer-n1-webserver-8. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. * `config.maintenanceWindow` * Maintenance window during which Cloud Composer components may be under maintenance. * `config.workloadsConfig` * The workloads configuration settings for the GKE cluster associated with the Cloud Composer environment. Supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer. * `config.environmentSize` * The size of the Cloud Composer environment. Supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer.",
                       "format": "google-fieldmask",
                       "location": "query",
                       "type": "string"
@@ -462,7 +462,7 @@
       }
     }
   },
-  "revision": "20210721",
+  "revision": "20210728",
   "rootUrl": "https://composer.googleapis.com/",
   "schemas": {
     "AllowedIpRange": {
@@ -535,7 +535,7 @@
       "type": "object"
     },
     "DatabaseConfig": {
-      "description": "The configuration of Cloud SQL instance that is used by the Apache Airflow software.",
+      "description": "The configuration of Cloud SQL instance that is used by the Apache Airflow software. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.",
       "id": "DatabaseConfig",
       "properties": {
         "machineType": {
@@ -574,7 +574,7 @@
       "type": "object"
     },
     "EncryptionConfig": {
-      "description": "The encryption options for the Cloud Composer environment and its dependencies.",
+      "description": "The encryption options for the Cloud Composer environment and its dependencies. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.",
       "id": "EncryptionConfig",
       "properties": {
         "kmsKeyName": {
@@ -659,11 +659,11 @@
         },
         "databaseConfig": {
           "$ref": "DatabaseConfig",
-          "description": "Optional. The configuration settings for Cloud SQL instance used internally by Apache Airflow software."
+          "description": "Optional. The configuration settings for Cloud SQL instance used internally by Apache Airflow software. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*."
         },
         "encryptionConfig": {
           "$ref": "EncryptionConfig",
-          "description": "Optional. The encryption options for the Cloud Composer environment and its dependencies. Cannot be updated."
+          "description": "Optional. The encryption options for the Cloud Composer environment and its dependencies. Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*."
         },
         "environmentSize": {
           "description": "Optional. The size of the Cloud Composer environment. This field is supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer.",
@@ -695,7 +695,7 @@
           "description": "The configuration used for the Kubernetes Engine cluster."
         },
         "nodeCount": {
-          "description": "The number of nodes in the Kubernetes Engine cluster that will be used to run this environment.",
+          "description": "The number of nodes in the Kubernetes Engine cluster that will be used to run this environment. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.",
           "format": "int32",
           "type": "integer"
         },
@@ -709,11 +709,11 @@
         },
         "webServerConfig": {
           "$ref": "WebServerConfig",
-          "description": "Optional. The configuration settings for the Airflow web server App Engine instance."
+          "description": "Optional. The configuration settings for the Airflow web server App Engine instance. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*."
         },
         "webServerNetworkAccessControl": {
           "$ref": "WebServerNetworkAccessControl",
-          "description": "Optional. The network-level access control policy for the Airflow web server. If unspecified, no network-level access restrictions will be applied."
+          "description": "Optional. The network-level access control policy for the Airflow web server. If unspecified, no network-level access restrictions will be applied. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*."
         },
         "workloadsConfig": {
           "$ref": "WorkloadsConfig",
@@ -727,23 +727,23 @@
       "id": "IPAllocationPolicy",
       "properties": {
         "clusterIpv4CidrBlock": {
-          "description": "Optional. The IP address range used to allocate IP addresses to pods in the cluster. This field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use. Specify `cluster_secondary_range_name` or `cluster_ipv4_cidr_block` but not both.",
+          "description": "Optional. The IP address range used to allocate IP addresses to pods in the cluster. This field is applicable only when `use_ip_aliases` is true. For Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*, this field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use. Specify `cluster_secondary_range_name` or `cluster_ipv4_cidr_block` but not both.",
           "type": "string"
         },
         "clusterSecondaryRangeName": {
-          "description": "Optional. The name of the cluster's secondary range used to allocate IP addresses to pods. Specify either `cluster_secondary_range_name` or `cluster_ipv4_cidr_block` but not both. This field is applicable only when `use_ip_aliases` is true.",
+          "description": "Optional. The name of the cluster's secondary range used to allocate IP addresses to pods. Specify either `cluster_secondary_range_name` or `cluster_ipv4_cidr_block` but not both. This field is applicable only when `use_ip_aliases` is true. For Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*, this field is applicable only when `use_ip_aliases` is true.",
           "type": "string"
         },
         "servicesIpv4CidrBlock": {
-          "description": "Optional. The IP address range of the services IP addresses in this cluster. This field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use. Specify `services_secondary_range_name` or `services_ipv4_cidr_block` but not both.",
+          "description": "Optional. The IP address range of the services IP addresses in this cluster. This field is applicable only when `use_ip_aliases` is true. For Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*, this field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use. Specify `services_secondary_range_name` or `services_ipv4_cidr_block` but not both.",
           "type": "string"
         },
         "servicesSecondaryRangeName": {
-          "description": "Optional. The name of the services' secondary range used to allocate IP addresses to the cluster. Specify either `services_secondary_range_name` or `services_ipv4_cidr_block` but not both. This field is applicable only when `use_ip_aliases` is true.",
+          "description": "Optional. The name of the services' secondary range used to allocate IP addresses to the cluster. Specify either `services_secondary_range_name` or `services_ipv4_cidr_block` but not both. This field is applicable only when `use_ip_aliases` is true. For Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*, this field is applicable only when `use_ip_aliases` is true.",
           "type": "string"
         },
         "useIpAliases": {
-          "description": "Optional. Whether or not to enable Alias IPs in the GKE cluster. If `true`, a VPC-native cluster is created.",
+          "description": "Optional. Whether or not to enable Alias IPs in the GKE cluster. If `true`, a VPC-native cluster is created. This field is only supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. Environments in newer versions always use VPC-native GKE clusters.",
           "type": "boolean"
         }
       },
@@ -863,7 +863,7 @@
       "id": "NodeConfig",
       "properties": {
         "diskSizeGb": {
-          "description": "Optional. The disk size in GB used for node VMs. Minimum size is 20GB. If unspecified, defaults to 100GB. Cannot be updated.",
+          "description": "Optional. The disk size in GB used for node VMs. Minimum size is 20GB. If unspecified, defaults to 100GB. Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.",
           "format": "int32",
           "type": "integer"
         },
@@ -872,15 +872,15 @@
           "description": "Optional. The IPAllocationPolicy fields for the GKE cluster."
         },
         "location": {
-          "description": "Optional. The Compute Engine [zone](/compute/docs/regions-zones) in which to deploy the VMs used to run the Apache Airflow software, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: \"projects/{projectId}/zones/{zoneId}\". This `location` must belong to the enclosing environment's project and location. If both this field and `nodeConfig.machineType` are specified, `nodeConfig.machineType` must belong to this `location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If only one field (`location` or `nodeConfig.machineType`) is specified, the location information from the specified field will be propagated to the unspecified field.",
+          "description": "Optional. The Compute Engine [zone](/compute/docs/regions-zones) in which to deploy the VMs used to run the Apache Airflow software, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: \"projects/{projectId}/zones/{zoneId}\". This `location` must belong to the enclosing environment's project and location. If both this field and `nodeConfig.machineType` are specified, `nodeConfig.machineType` must belong to this `location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If only one field (`location` or `nodeConfig.machineType`) is specified, the location information from the specified field will be propagated to the unspecified field. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.",
           "type": "string"
         },
         "machineType": {
-          "description": "Optional. The Compute Engine [machine type](/compute/docs/machine-types) used for cluster instances, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: \"projects/{projectId}/zones/{zoneId}/machineTypes/{machineTypeId}\". The `machineType` must belong to the enclosing environment's project and location. If both this field and `nodeConfig.location` are specified, this `machineType` must belong to the `nodeConfig.location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If exactly one of this field and `nodeConfig.location` is specified, the location information from the specified field will be propagated to the unspecified field. The `machineTypeId` must not be a [shared-core machine type](/compute/docs/machine-types#sharedcore). If this field is unspecified, the `machineTypeId` defaults to \"n1-standard-1\".",
+          "description": "Optional. The Compute Engine [machine type](/compute/docs/machine-types) used for cluster instances, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: \"projects/{projectId}/zones/{zoneId}/machineTypes/{machineTypeId}\". The `machineType` must belong to the enclosing environment's project and location. If both this field and `nodeConfig.location` are specified, this `machineType` must belong to the `nodeConfig.location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If exactly one of this field and `nodeConfig.location` is specified, the location information from the specified field will be propagated to the unspecified field. The `machineTypeId` must not be a [shared-core machine type](/compute/docs/machine-types#sharedcore). If this field is unspecified, the `machineTypeId` defaults to \"n1-standard-1\". This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.",
           "type": "string"
         },
         "maxPodsPerNode": {
-          "description": "Optional. The maximum number of pods per node in the Cloud Composer GKE cluster. The value must be between 8 and 110 and it can be set only if the environment is VPC-native. The default value is 32. Values of this field will be propagated both to the `default-pool` node pool of the newly created GKE cluster, and to the default \"Maximum Pods per Node\" value which is used for newly created node pools if their value is not explicitly set during node pool creation. For more information, see [Optimizing IP address allocation] (https://cloud.google.com/kubernetes-engine/docs/how-to/flexible-pod-cidr). Cannot be updated.",
+          "description": "Optional. The maximum number of pods per node in the Cloud Composer GKE cluster. The value must be between 8 and 110 and it can be set only if the environment is VPC-native. The default value is 32. Values of this field will be propagated both to the `default-pool` node pool of the newly created GKE cluster, and to the default \"Maximum Pods per Node\" value which is used for newly created node pools if their value is not explicitly set during node pool creation. For more information, see [Optimizing IP address allocation] (https://cloud.google.com/kubernetes-engine/docs/how-to/flexible-pod-cidr). Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.",
           "format": "int32",
           "type": "integer"
         },
@@ -889,7 +889,7 @@
           "type": "string"
         },
         "oauthScopes": {
-          "description": "Optional. The set of Google API scopes to be made available on all node VMs. If `oauth_scopes` is empty, defaults to [\"https://www.googleapis.com/auth/cloud-platform\"]. Cannot be updated.",
+          "description": "Optional. The set of Google API scopes to be made available on all node VMs. If `oauth_scopes` is empty, defaults to [\"https://www.googleapis.com/auth/cloud-platform\"]. Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.",
           "items": {
             "type": "string"
           },
@@ -904,7 +904,7 @@
           "type": "string"
         },
         "tags": {
-          "description": "Optional. The list of instance tags applied to all node VMs. Tags are used to identify valid sources or targets for network firewalls. Each tag within the list must comply with [RFC1035](https://www.ietf.org/rfc/rfc1035.txt). Cannot be updated.",
+          "description": "Optional. The list of instance tags applied to all node VMs. Tags are used to identify valid sources or targets for network firewalls. Each tag within the list must comply with [RFC1035](https://www.ietf.org/rfc/rfc1035.txt). Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.",
           "items": {
             "type": "string"
           },
@@ -1047,7 +1047,7 @@
           "type": "string"
         },
         "enablePrivateEnvironment": {
-          "description": "Optional. If `true`, a Private IP Cloud Composer environment is created. If this field is set to true, `IPAllocationPolicy.use_ip_aliases` must be set to true .",
+          "description": "Optional. If `true`, a Private IP Cloud Composer environment is created. If this field is set to true, `IPAllocationPolicy.use_ip_aliases` must be set to true for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.",
           "type": "boolean"
         },
         "privateClusterConfig": {
@@ -1055,11 +1055,11 @@
           "description": "Optional. Configuration for the private GKE cluster for a Private IP Cloud Composer environment."
         },
         "webServerIpv4CidrBlock": {
-          "description": "Optional. The CIDR block from which IP range for web server will be reserved. Needs to be disjoint from private_cluster_config.master_ipv4_cidr_block and cloud_sql_ipv4_cidr_block.",
+          "description": "Optional. The CIDR block from which IP range for web server will be reserved. Needs to be disjoint from private_cluster_config.master_ipv4_cidr_block and cloud_sql_ipv4_cidr_block. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.",
           "type": "string"
         },
         "webServerIpv4ReservedRange": {
-          "description": "Output only. The IP range reserved for the tenant project's App Engine VMs.",
+          "description": "Output only. The IP range reserved for the tenant project's App Engine VMs. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.",
           "readOnly": true,
           "type": "string"
         }
@@ -1129,11 +1129,11 @@
           "type": "object"
         },
         "pythonVersion": {
-          "description": "Optional. The major version of Python used to run the Apache Airflow scheduler, worker, and webserver processes. Can be set to '2' or '3'. If not specified, the default is '3'. Cannot be updated.",
+          "description": "Optional. The major version of Python used to run the Apache Airflow scheduler, worker, and webserver processes. Can be set to '2' or '3'. If not specified, the default is '3'. Cannot be updated. This field is only supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. Environments in newer versions always use Python major version 3.",
           "type": "string"
         },
         "schedulerCount": {
-          "description": "Optional. The number of schedulers for Airflow.",
+          "description": "Optional. The number of schedulers for Airflow. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-2.*.*.",
           "format": "int32",
           "type": "integer"
         }
@@ -1168,7 +1168,7 @@
       "type": "object"
     },
     "WebServerConfig": {
-      "description": "The configuration settings for the Airflow web server App Engine instance.",
+      "description": "The configuration settings for the Airflow web server App Engine instance. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.",
       "id": "WebServerConfig",
       "properties": {
         "machineType": {
@@ -1179,7 +1179,7 @@
       "type": "object"
     },
     "WebServerNetworkAccessControl": {
-      "description": "Network-level access control policy for the Airflow web server.",
+      "description": "Network-level access control policy for the Airflow web server. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.",
       "id": "WebServerNetworkAccessControl",
       "properties": {
         "allowedIpRanges": {
diff --git a/googleapiclient/discovery_cache/documents/container.v1.json b/googleapiclient/discovery_cache/documents/container.v1.json
index 9bfed38..3631435 100644
--- a/googleapiclient/discovery_cache/documents/container.v1.json
+++ b/googleapiclient/discovery_cache/documents/container.v1.json
@@ -2459,7 +2459,7 @@
       }
     }
   },
-  "revision": "20210708",
+  "revision": "20210714",
   "rootUrl": "https://container.googleapis.com/",
   "schemas": {
     "AcceleratorConfig": {
diff --git a/googleapiclient/discovery_cache/documents/container.v1beta1.json b/googleapiclient/discovery_cache/documents/container.v1beta1.json
index 92cc60f..c6c42fd 100644
--- a/googleapiclient/discovery_cache/documents/container.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/container.v1beta1.json
@@ -2484,7 +2484,7 @@
       }
     }
   },
-  "revision": "20210708",
+  "revision": "20210714",
   "rootUrl": "https://container.googleapis.com/",
   "schemas": {
     "AcceleratorConfig": {
diff --git a/googleapiclient/discovery_cache/documents/containeranalysis.v1alpha1.json b/googleapiclient/discovery_cache/documents/containeranalysis.v1alpha1.json
index f4e76e0..56301c7 100644
--- a/googleapiclient/discovery_cache/documents/containeranalysis.v1alpha1.json
+++ b/googleapiclient/discovery_cache/documents/containeranalysis.v1alpha1.json
@@ -604,7 +604,11 @@
                     "DISCOVERY",
                     "ATTESTATION_AUTHORITY",
                     "UPGRADE",
-                    "COMPLIANCE"
+                    "COMPLIANCE",
+                    "SBOM",
+                    "SPDX_PACKAGE",
+                    "SPDX_FILE",
+                    "SPDX_RELATIONSHIP"
                   ],
                   "enumDescriptions": [
                     "Unknown",
@@ -616,7 +620,11 @@
                     "The note and occurrence track the initial discovery status of a resource.",
                     "This represents a logical \"role\" that can attest to artifacts.",
                     "This represents an available software upgrade.",
-                    "This represents a compliance check that can be applied to a resource."
+                    "This represents a compliance check that can be applied to a resource.",
+                    "This represents a software bill of materials.",
+                    "This represents an SPDX Package.",
+                    "This represents an SPDX File.",
+                    "This represents an SPDX Relationship."
                   ],
                   "location": "query",
                   "type": "string"
@@ -1219,7 +1227,7 @@
       }
     }
   },
-  "revision": "20210714",
+  "revision": "20210723",
   "rootUrl": "https://containeranalysis.googleapis.com/",
   "schemas": {
     "Artifact": {
@@ -1822,7 +1830,11 @@
             "DISCOVERY",
             "ATTESTATION_AUTHORITY",
             "UPGRADE",
-            "COMPLIANCE"
+            "COMPLIANCE",
+            "SBOM",
+            "SPDX_PACKAGE",
+            "SPDX_FILE",
+            "SPDX_RELATIONSHIP"
           ],
           "enumDescriptions": [
             "Unknown",
@@ -1834,7 +1846,11 @@
             "The note and occurrence track the initial discovery status of a resource.",
             "This represents a logical \"role\" that can attest to artifacts.",
             "This represents an available software upgrade.",
-            "This represents a compliance check that can be applied to a resource."
+            "This represents a compliance check that can be applied to a resource.",
+            "This represents a software bill of materials.",
+            "This represents an SPDX Package.",
+            "This represents an SPDX File.",
+            "This represents an SPDX Relationship."
           ],
           "type": "string"
         }
@@ -1882,6 +1898,71 @@
       },
       "type": "object"
     },
+    "DocumentNote": {
+      "description": "DocumentNote represents an SPDX Document Creation Infromation section: https://spdx.github.io/spdx-spec/2-document-creation-information/",
+      "id": "DocumentNote",
+      "properties": {
+        "dataLicence": {
+          "description": "Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (\"SPDX-Metadata\")",
+          "type": "string"
+        },
+        "spdxVersion": {
+          "description": "Provide a reference number that can be used to understand how to parse and interpret the rest of the file",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "DocumentOccurrence": {
+      "description": "DocumentOccurrence represents an SPDX Document Creation Information section: https://spdx.github.io/spdx-spec/2-document-creation-information/",
+      "id": "DocumentOccurrence",
+      "properties": {
+        "createTime": {
+          "description": "Identify when the SPDX file was originally created. The date is to be specified according to combined date and time in UTC format as specified in ISO 8601 standard",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "creatorComment": {
+          "description": "A field for creators of the SPDX file to provide general comments about the creation of the SPDX file or any other relevant comment not included in the other fields",
+          "type": "string"
+        },
+        "creators": {
+          "description": "Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an individual, indicate the person's name",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "documentComment": {
+          "description": "A field for creators of the SPDX file content to provide comments to the consumers of the SPDX document",
+          "type": "string"
+        },
+        "externalDocumentRefs": {
+          "description": "Identify any external SPDX documents referenced within this SPDX document",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "id": {
+          "description": "Identify the current SPDX document which may be referenced in relationships by other files, packages internally and documents externally",
+          "type": "string"
+        },
+        "licenseListVersion": {
+          "description": "A field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created",
+          "type": "string"
+        },
+        "namespace": {
+          "description": "Provide an SPDX document specific namespace as a unique absolute Uniform Resource Identifier (URI) as specified in RFC-3986, with the exception of the \u2018#\u2019 delimiter",
+          "type": "string"
+        },
+        "title": {
+          "description": "Identify name of this document as designated by creator",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "Empty": {
       "description": "A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); } The JSON representation for `Empty` is empty JSON object `{}`.",
       "id": "Empty",
@@ -1911,6 +1992,43 @@
       },
       "type": "object"
     },
+    "ExternalRef": {
+      "description": "An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package",
+      "id": "ExternalRef",
+      "properties": {
+        "category": {
+          "description": "An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package",
+          "enum": [
+            "CATEGORY_UNSPECIFIED",
+            "SECURITY",
+            "PACKAGE_MANAGER",
+            "PERSISTENT_ID",
+            "OTHER"
+          ],
+          "enumDescriptions": [
+            "Unspecified",
+            "Security (e.g. cpe22Type, cpe23Type)",
+            "Package Manager (e.g. maven-central, npm, nuget, bower, purl)",
+            "Persistent-Id (e.g. swh)",
+            "Other"
+          ],
+          "type": "string"
+        },
+        "comment": {
+          "description": "Human-readable information about the purpose and target of the reference",
+          "type": "string"
+        },
+        "locator": {
+          "description": "The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location",
+          "type": "string"
+        },
+        "type": {
+          "description": "Type of category (e.g. 'npm' for the PACKAGE_MANAGER category)",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "FileHashes": {
       "description": "Container message for hashes of byte content of files, used in Source messages to verify integrity of source input to the build.",
       "id": "FileHashes",
@@ -1925,6 +2043,108 @@
       },
       "type": "object"
     },
+    "FileNote": {
+      "description": "FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/",
+      "id": "FileNote",
+      "properties": {
+        "checksum": {
+          "description": "Provide a unique identifier to match analysis information on each specific file in a package",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "fileType": {
+          "description": "This field provides information about the type of file identified",
+          "enum": [
+            "FILE_TYPE_UNSPECIFIED",
+            "SOURCE",
+            "BINARY",
+            "ARCHIVE",
+            "APPLICATION",
+            "AUDIO",
+            "IMAGE",
+            "TEXT",
+            "VIDEO",
+            "DOCUMENTATION",
+            "SPDX",
+            "OTHER"
+          ],
+          "enumDescriptions": [
+            "Unspecified",
+            "The file is human readable source code (.c, .html, etc.)",
+            "The file is a compiled object, target image or binary executable (.o, .a, etc.)",
+            "The file represents an archive (.tar, .jar, etc.)",
+            "The file is associated with a specific application type (MIME type of application/*)",
+            "The file is associated with an audio file (MIME type of audio/* , e.g. .mp3)",
+            "The file is associated with an picture image file (MIME type of image/*, e.g., .jpg, .gif)",
+            "The file is human readable text file (MIME type of text/*)",
+            "The file is associated with a video file type (MIME type of video/*)",
+            "The file serves as documentation",
+            "The file is an SPDX document",
+            "The file doesn't fit into the above categories (generated artifacts, data files, etc.)"
+          ],
+          "type": "string"
+        },
+        "title": {
+          "description": "Identify the full path and filename that corresponds to the file information in this section",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "FileOccurrence": {
+      "description": "FileOccurrence represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/",
+      "id": "FileOccurrence",
+      "properties": {
+        "attributions": {
+          "description": "This field provides a place for the SPDX data creator to record, at the file level, acknowledgements that may be needed to be communicated in some contexts",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "comment": {
+          "description": "This field provides a place for the SPDX file creator to record any general comments about the file",
+          "type": "string"
+        },
+        "contributors": {
+          "description": "This field provides a place for the SPDX file creator to record file contributors",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "copyright": {
+          "description": "Identify the copyright holder of the file, as well as any dates present",
+          "type": "string"
+        },
+        "filesLicenseInfo": {
+          "description": "This field contains the license information actually found in the file, if any",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "id": {
+          "description": "Uniquely identify any element in an SPDX document which may be referenced by other elements",
+          "type": "string"
+        },
+        "licenseComments": {
+          "description": "This field provides a place for the SPDX file creator to record any relevant background references or analysis that went in to arriving at the Concluded License for a file",
+          "type": "string"
+        },
+        "licenseConcluded": {
+          "description": "This field contains the license the SPDX file creator has concluded as governing the file or alternative values if the governing license cannot be determined",
+          "type": "string"
+        },
+        "notice": {
+          "description": "This field provides a place for the SPDX file creator to record license notices or other such related notices found in the file",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "Fingerprint": {
       "description": "A set of properties that uniquely identify a given Docker image.",
       "id": "Fingerprint",
@@ -2398,7 +2618,11 @@
             "DISCOVERY",
             "ATTESTATION_AUTHORITY",
             "UPGRADE",
-            "COMPLIANCE"
+            "COMPLIANCE",
+            "SBOM",
+            "SPDX_PACKAGE",
+            "SPDX_FILE",
+            "SPDX_RELATIONSHIP"
           ],
           "enumDescriptions": [
             "Unknown",
@@ -2410,7 +2634,11 @@
             "The note and occurrence track the initial discovery status of a resource.",
             "This represents a logical \"role\" that can attest to artifacts.",
             "This represents an available software upgrade.",
-            "This represents a compliance check that can be applied to a resource."
+            "This represents a compliance check that can be applied to a resource.",
+            "This represents a software bill of materials.",
+            "This represents an SPDX Package.",
+            "This represents an SPDX File.",
+            "This represents an SPDX Relationship."
           ],
           "type": "string"
         },
@@ -2433,10 +2661,26 @@
           },
           "type": "array"
         },
+        "sbom": {
+          "$ref": "DocumentNote",
+          "description": "A note describing a software bill of materials."
+        },
         "shortDescription": {
           "description": "A one sentence description of this `Note`.",
           "type": "string"
         },
+        "spdxFile": {
+          "$ref": "FileNote",
+          "description": "A note describing an SPDX File."
+        },
+        "spdxPackage": {
+          "$ref": "PackageNote",
+          "description": "A note describing an SPDX Package."
+        },
+        "spdxRelationship": {
+          "$ref": "RelationshipNote",
+          "description": "A note describing a relationship between SPDX elements."
+        },
         "updateTime": {
           "description": "Output only. The time this note was last updated. This field can be used as a filter in list requests.",
           "format": "google-datetime",
@@ -2502,7 +2746,11 @@
             "DISCOVERY",
             "ATTESTATION_AUTHORITY",
             "UPGRADE",
-            "COMPLIANCE"
+            "COMPLIANCE",
+            "SBOM",
+            "SPDX_PACKAGE",
+            "SPDX_FILE",
+            "SPDX_RELATIONSHIP"
           ],
           "enumDescriptions": [
             "Unknown",
@@ -2514,7 +2762,11 @@
             "The note and occurrence track the initial discovery status of a resource.",
             "This represents a logical \"role\" that can attest to artifacts.",
             "This represents an available software upgrade.",
-            "This represents a compliance check that can be applied to a resource."
+            "This represents a compliance check that can be applied to a resource.",
+            "This represents a software bill of materials.",
+            "This represents an SPDX Package.",
+            "This represents an SPDX File.",
+            "This represents an SPDX Relationship."
           ],
           "type": "string"
         },
@@ -2538,6 +2790,22 @@
           "description": "The unique URL of the image or the container for which the `Occurrence` applies. For example, https://gcr.io/project/image@sha256:foo This field can be used as a filter in list requests.",
           "type": "string"
         },
+        "sbom": {
+          "$ref": "DocumentOccurrence",
+          "description": "Describes a specific software bill of materials document."
+        },
+        "spdxFile": {
+          "$ref": "FileOccurrence",
+          "description": "Describes a specific SPDX File."
+        },
+        "spdxPackage": {
+          "$ref": "PackageOccurrence",
+          "description": "Describes a specific SPDX Package."
+        },
+        "spdxRelationship": {
+          "$ref": "RelationshipOccurrence",
+          "description": "Describes a specific relationship between SPDX elements."
+        },
         "updateTime": {
           "description": "Output only. The time this `Occurrence` was last updated.",
           "format": "google-datetime",
@@ -2625,6 +2893,114 @@
       },
       "type": "object"
     },
+    "PackageNote": {
+      "description": "PackageNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/",
+      "id": "PackageNote",
+      "properties": {
+        "analyzed": {
+          "description": "Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document",
+          "type": "boolean"
+        },
+        "attribution": {
+          "description": "A place for the SPDX data creator to record, at the package level, acknowledgements that may be needed to be communicated in some contexts",
+          "type": "string"
+        },
+        "checksum": {
+          "description": "Provide an independently reproducible mechanism that permits unique identification of a specific package that correlates to the data in this SPDX file",
+          "type": "string"
+        },
+        "copyright": {
+          "description": "Identify the copyright holders of the package, as well as any dates present",
+          "type": "string"
+        },
+        "detailedDescription": {
+          "description": "A more detailed description of the package",
+          "type": "string"
+        },
+        "downloadLocation": {
+          "description": "This section identifies the download Universal Resource Locator (URL), or a specific location within a version control system (VCS) for the package at the time that the SPDX file was created",
+          "type": "string"
+        },
+        "externalRefs": {
+          "description": "ExternalRef",
+          "items": {
+            "$ref": "ExternalRef"
+          },
+          "type": "array"
+        },
+        "filesLicenseInfo": {
+          "description": "Contain the license the SPDX file creator has concluded as governing the This field is to contain a list of all licenses found in the package. The relationship between licenses (i.e., conjunctive, disjunctive) is not specified in this field \u2013 it is simply a listing of all licenses found",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "homePage": {
+          "description": "Provide a place for the SPDX file creator to record a web site that serves as the package's home page",
+          "type": "string"
+        },
+        "licenseDeclared": {
+          "description": "List the licenses that have been declared by the authors of the package",
+          "type": "string"
+        },
+        "originator": {
+          "description": "If the package identified in the SPDX file originated from a different person or organization than identified as Package Supplier, this field identifies from where or whom the package originally came",
+          "type": "string"
+        },
+        "summaryDescription": {
+          "description": "A short description of the package",
+          "type": "string"
+        },
+        "supplier": {
+          "description": "Identify the actual distribution source for the package/directory identified in the SPDX file",
+          "type": "string"
+        },
+        "title": {
+          "description": "Identify the full name of the package as given by the Package Originator",
+          "type": "string"
+        },
+        "verificationCode": {
+          "description": "This field provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX file itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX file",
+          "type": "string"
+        },
+        "version": {
+          "description": "Identify the version of the package",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "PackageOccurrence": {
+      "description": "PackageOccurrence represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/",
+      "id": "PackageOccurrence",
+      "properties": {
+        "comment": {
+          "description": "A place for the SPDX file creator to record any general comments about the package being described",
+          "type": "string"
+        },
+        "filename": {
+          "description": "Provide the actual file name of the package, or path of the directory being treated as a package",
+          "type": "string"
+        },
+        "id": {
+          "description": "Uniquely identify any element in an SPDX document which may be referenced by other elements",
+          "type": "string"
+        },
+        "licenseComments": {
+          "description": "This field provides a place for the SPDX file creator to record any relevant background information or analysis that went in to arriving at the Concluded License for a package",
+          "type": "string"
+        },
+        "licenseConcluded": {
+          "description": "package or alternative values, if the governing license cannot be determined",
+          "type": "string"
+        },
+        "sourceInfo": {
+          "description": "Provide a place for the SPDX file creator to record any relevant background information or additional comments about the origin of the package",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "PgpSignedAttestation": {
       "description": "An attestation wrapper with a PGP-compatible signature. This message only supports `ATTACHED` signatures, where the payload that is signed is included alongside the signature itself in the same file.",
       "id": "PgpSignedAttestation",
@@ -2691,6 +3067,127 @@
       },
       "type": "object"
     },
+    "RelationshipNote": {
+      "description": "RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/",
+      "id": "RelationshipNote",
+      "properties": {},
+      "type": "object"
+    },
+    "RelationshipOccurrence": {
+      "description": "RelationshipOccurrence represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/",
+      "id": "RelationshipOccurrence",
+      "properties": {
+        "comment": {
+          "description": "A place for the SPDX file creator to record any general comments about the relationship",
+          "type": "string"
+        },
+        "source": {
+          "description": "Also referred to as SPDXRef-A The source SPDX element (file, package, etc)",
+          "type": "string"
+        },
+        "target": {
+          "description": "Also referred to as SPDXRef-B The target SPDC element (file, package, etc) In cases where there are \"known unknowns\", the use of the keyword NOASSERTION can be used The keywords NONE can be used to indicate that an SPDX element (package/file/snippet) has no other elements connected by some relationship to it",
+          "type": "string"
+        },
+        "type": {
+          "description": "The type of relationship between the source and target SPDX elements",
+          "enum": [
+            "TYPE_UNSPECIFIED",
+            "DESCRIBES",
+            "DESCRIBED_BY",
+            "CONTAINS",
+            "CONTAINED_BY",
+            "DEPENDS_ON",
+            "DEPENDENCY_OF",
+            "DEPENDENCY_MANIFEST_OF",
+            "BUILD_DEPENDENCY_OF",
+            "DEV_DEPENDENCY_OF",
+            "OPTIONAL_DEPENDENCY_OF",
+            "PROVIDED_DEPENDENCY_OF",
+            "TEST_DEPENDENCY_OF",
+            "RUNTIME_DEPENDENCY_OF",
+            "EXAMPLE_OF",
+            "GENERATES",
+            "GENERATED_FROM",
+            "ANCESTOR_OF",
+            "DESCENDANT_OF",
+            "VARIANT_OF",
+            "DISTRIBUTION_ARTIFACT",
+            "PATCH_FOR",
+            "PATCH_APPLIED",
+            "COPY_OF",
+            "FILE_ADDED",
+            "FILE_DELETED",
+            "FILE_MODIFIED",
+            "EXPANDED_FROM_ARCHIVE",
+            "DYNAMIC_LINK",
+            "STATIC_LINK",
+            "DATA_FILE_OF",
+            "TEST_CASE_OF",
+            "BUILD_TOOL_OF",
+            "DEV_TOOL_OF",
+            "TEST_OF",
+            "TEST_TOOL_OF",
+            "DOCUMENTATION_OF",
+            "OPTIONAL_COMPONENT_OF",
+            "METAFILE_OF",
+            "PACKAGE_OF",
+            "AMENDS",
+            "PREREQUISITE_FOR",
+            "HAS_PREREQUISITE",
+            "OTHER"
+          ],
+          "enumDescriptions": [
+            "Unspecified",
+            "Is to be used when SPDXRef-DOCUMENT describes SPDXRef-A",
+            "Is to be used when SPDXRef-A is described by SPDXREF-Document",
+            "Is to be used when SPDXRef-A contains SPDXRef-B",
+            "Is to be used when SPDXRef-A is contained by SPDXRef-B",
+            "Is to be used when SPDXRef-A depends on SPDXRef-B",
+            "Is to be used when SPDXRef-A is dependency of SPDXRef-B",
+            "Is to be used when SPDXRef-A is a manifest file that lists a set of dependencies for SPDXRef-B",
+            "Is to be used when SPDXRef-A is a build dependency of SPDXRef-B",
+            "Is to be used when SPDXRef-A is a development dependency of SPDXRef-B",
+            "Is to be used when SPDXRef-A is an optional dependency of SPDXRef-B",
+            "Is to be used when SPDXRef-A is a to be provided dependency of SPDXRef-B",
+            "Is to be used when SPDXRef-A is a test dependency of SPDXRef-B",
+            "Is to be used when SPDXRef-A is a dependency required for the execution of SPDXRef-B",
+            "Is to be used when SPDXRef-A is an example of SPDXRef-B",
+            "Is to be used when SPDXRef-A generates SPDXRef-B",
+            "Is to be used when SPDXRef-A was generated from SPDXRef-B",
+            "Is to be used when SPDXRef-A is an ancestor (same lineage but pre-dates) SPDXRef-B",
+            "Is to be used when SPDXRef-A is a descendant of (same lineage but postdates) SPDXRef-B",
+            "Is to be used when SPDXRef-A is a variant of (same lineage but not clear which came first) SPDXRef-B",
+            "Is to be used when distributing SPDXRef-A requires that SPDXRef-B also be distributed",
+            "Is to be used when SPDXRef-A is a patch file for (to be applied to) SPDXRef-B",
+            "Is to be used when SPDXRef-A is a patch file that has been applied to SPDXRef-B",
+            "Is to be used when SPDXRef-A is an exact copy of SPDXRef-B",
+            "Is to be used when SPDXRef-A is a file that was added to SPDXRef-B",
+            "Is to be used when SPDXRef-A is a file that was deleted from SPDXRef-B",
+            "Is to be used when SPDXRef-A is a file that was modified from SPDXRef-B",
+            "Is to be used when SPDXRef-A is expanded from the archive SPDXRef-B",
+            "Is to be used when SPDXRef-A dynamically links to SPDXRef-B",
+            "Is to be used when SPDXRef-A statically links to SPDXRef-B",
+            "Is to be used when SPDXRef-A is a data file used in SPDXRef-B",
+            "Is to be used when SPDXRef-A is a test case used in testing SPDXRef-B",
+            "Is to be used when SPDXRef-A is used to build SPDXRef-B",
+            "Is to be used when SPDXRef-A is used as a development tool for SPDXRef-B",
+            "Is to be used when SPDXRef-A is used for testing SPDXRef-B",
+            "Is to be used when SPDXRef-A is used as a test tool for SPDXRef-B",
+            "Is to be used when SPDXRef-A provides documentation of SPDXRef-B",
+            "Is to be used when SPDXRef-A is an optional component of SPDXRef-B",
+            "Is to be used when SPDXRef-A is a metafile of SPDXRef-B",
+            "Is to be used when SPDXRef-A is used as a package as part of SPDXRef-B",
+            "Is to be used when (current) SPDXRef-DOCUMENT amends the SPDX information in SPDXRef-B",
+            "Is to be used when SPDXRef-A is a prerequisite for SPDXRef-B",
+            "Is to be used when SPDXRef-A has as a prerequisite SPDXRef-B",
+            "Is to be used for a relationship which has not been defined in the formal SPDX specification. A description of the relationship should be included in the Relationship comments field"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "RepoSource": {
       "description": "RepoSource describes the location of the source in a Google Cloud Source Repository.",
       "id": "RepoSource",
diff --git a/googleapiclient/discovery_cache/documents/containeranalysis.v1beta1.json b/googleapiclient/discovery_cache/documents/containeranalysis.v1beta1.json
index 026b342..625b8cd 100644
--- a/googleapiclient/discovery_cache/documents/containeranalysis.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/containeranalysis.v1beta1.json
@@ -853,7 +853,7 @@
       }
     }
   },
-  "revision": "20210714",
+  "revision": "20210723",
   "rootUrl": "https://containeranalysis.googleapis.com/",
   "schemas": {
     "AliasContext": {
@@ -1600,7 +1600,10 @@
             "DEPLOYMENT",
             "DISCOVERY",
             "ATTESTATION",
-            "INTOTO"
+            "INTOTO",
+            "SBOM",
+            "SPDX_PACKAGE",
+            "SPDX_FILE"
           ],
           "enumDescriptions": [
             "Default value. This value is unused.",
@@ -1611,7 +1614,10 @@
             "The note and occurrence track deployment events.",
             "The note and occurrence track the initial discovery status of a resource.",
             "This represents a logical \"role\" that can attest to artifacts.",
-            "This represents an in-toto link."
+            "This represents an in-toto link.",
+            "This represents a software bill of materials.",
+            "This represents an SPDX Package.",
+            "This represents an SPDX File."
           ],
           "type": "string"
         }
@@ -1659,6 +1665,71 @@
       },
       "type": "object"
     },
+    "DocumentNote": {
+      "description": "DocumentNote represents an SPDX Document Creation Infromation section: https://spdx.github.io/spdx-spec/2-document-creation-information/",
+      "id": "DocumentNote",
+      "properties": {
+        "dataLicence": {
+          "description": "Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (\"SPDX-Metadata\")",
+          "type": "string"
+        },
+        "spdxVersion": {
+          "description": "Provide a reference number that can be used to understand how to parse and interpret the rest of the file",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "DocumentOccurrence": {
+      "description": "DocumentOccurrence represents an SPDX Document Creation Information section: https://spdx.github.io/spdx-spec/2-document-creation-information/",
+      "id": "DocumentOccurrence",
+      "properties": {
+        "createTime": {
+          "description": "Identify when the SPDX file was originally created. The date is to be specified according to combined date and time in UTC format as specified in ISO 8601 standard",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "creatorComment": {
+          "description": "A field for creators of the SPDX file to provide general comments about the creation of the SPDX file or any other relevant comment not included in the other fields",
+          "type": "string"
+        },
+        "creators": {
+          "description": "Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an individual, indicate the person's name",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "documentComment": {
+          "description": "A field for creators of the SPDX file content to provide comments to the consumers of the SPDX document",
+          "type": "string"
+        },
+        "externalDocumentRefs": {
+          "description": "Identify any external SPDX documents referenced within this SPDX document",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "id": {
+          "description": "Identify the current SPDX document which may be referenced in relationships by other files, packages internally and documents externally",
+          "type": "string"
+        },
+        "licenseListVersion": {
+          "description": "A field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created",
+          "type": "string"
+        },
+        "namespace": {
+          "description": "Provide an SPDX document specific namespace as a unique absolute Uniform Resource Identifier (URI) as specified in RFC-3986, with the exception of the \u2018#\u2019 delimiter",
+          "type": "string"
+        },
+        "title": {
+          "description": "Identify name of this document as designated by creator",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "Empty": {
       "description": "A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); } The JSON representation for `Empty` is empty JSON object `{}`.",
       "id": "Empty",
@@ -1701,6 +1772,43 @@
       },
       "type": "object"
     },
+    "ExternalRef": {
+      "description": "An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package",
+      "id": "ExternalRef",
+      "properties": {
+        "category": {
+          "description": "An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package",
+          "enum": [
+            "CATEGORY_UNSPECIFIED",
+            "SECURITY",
+            "PACKAGE_MANAGER",
+            "PERSISTENT_ID",
+            "OTHER"
+          ],
+          "enumDescriptions": [
+            "Unspecified",
+            "Security (e.g. cpe22Type, cpe23Type)",
+            "Package Manager (e.g. maven-central, npm, nuget, bower, purl)",
+            "Persistent-Id (e.g. swh)",
+            "Other"
+          ],
+          "type": "string"
+        },
+        "comment": {
+          "description": "Human-readable information about the purpose and target of the reference",
+          "type": "string"
+        },
+        "locator": {
+          "description": "The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location",
+          "type": "string"
+        },
+        "type": {
+          "description": "Type of category (e.g. 'npm' for the PACKAGE_MANAGER category)",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "FileHashes": {
       "description": "Container message for hashes of byte content of files, used in source messages to verify integrity of source input to the build.",
       "id": "FileHashes",
@@ -1715,6 +1823,108 @@
       },
       "type": "object"
     },
+    "FileNote": {
+      "description": "FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/",
+      "id": "FileNote",
+      "properties": {
+        "checksum": {
+          "description": "Provide a unique identifier to match analysis information on each specific file in a package",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "fileType": {
+          "description": "This field provides information about the type of file identified",
+          "enum": [
+            "FILE_TYPE_UNSPECIFIED",
+            "SOURCE",
+            "BINARY",
+            "ARCHIVE",
+            "APPLICATION",
+            "AUDIO",
+            "IMAGE",
+            "TEXT",
+            "VIDEO",
+            "DOCUMENTATION",
+            "SPDX",
+            "OTHER"
+          ],
+          "enumDescriptions": [
+            "Unspecified",
+            "The file is human readable source code (.c, .html, etc.)",
+            "The file is a compiled object, target image or binary executable (.o, .a, etc.)",
+            "The file represents an archive (.tar, .jar, etc.)",
+            "The file is associated with a specific application type (MIME type of application/*)",
+            "The file is associated with an audio file (MIME type of audio/* , e.g. .mp3)",
+            "The file is associated with an picture image file (MIME type of image/*, e.g., .jpg, .gif)",
+            "The file is human readable text file (MIME type of text/*)",
+            "The file is associated with a video file type (MIME type of video/*)",
+            "The file serves as documentation",
+            "The file is an SPDX document",
+            "The file doesn't fit into the above categories (generated artifacts, data files, etc.)"
+          ],
+          "type": "string"
+        },
+        "title": {
+          "description": "Identify the full path and filename that corresponds to the file information in this section",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "FileOccurrence": {
+      "description": "FileOccurrence represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/",
+      "id": "FileOccurrence",
+      "properties": {
+        "attributions": {
+          "description": "This field provides a place for the SPDX data creator to record, at the file level, acknowledgements that may be needed to be communicated in some contexts",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "comment": {
+          "description": "This field provides a place for the SPDX file creator to record any general comments about the file",
+          "type": "string"
+        },
+        "contributors": {
+          "description": "This field provides a place for the SPDX file creator to record file contributors",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "copyright": {
+          "description": "Identify the copyright holder of the file, as well as any dates present",
+          "type": "string"
+        },
+        "filesLicenseInfo": {
+          "description": "This field contains the license information actually found in the file, if any",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "id": {
+          "description": "Uniquely identify any element in an SPDX document which may be referenced by other elements",
+          "type": "string"
+        },
+        "licenseComments": {
+          "description": "This field provides a place for the SPDX file creator to record any relevant background references or analysis that went in to arriving at the Concluded License for a file",
+          "type": "string"
+        },
+        "licenseConcluded": {
+          "description": "This field contains the license the SPDX file creator has concluded as governing the file or alternative values if the governing license cannot be determined",
+          "type": "string"
+        },
+        "notice": {
+          "description": "This field provides a place for the SPDX file creator to record license notices or other such related notices found in the file",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "Fingerprint": {
       "description": "A set of properties that uniquely identify a given Docker image.",
       "id": "Fingerprint",
@@ -2406,7 +2616,10 @@
             "DEPLOYMENT",
             "DISCOVERY",
             "ATTESTATION",
-            "INTOTO"
+            "INTOTO",
+            "SBOM",
+            "SPDX_PACKAGE",
+            "SPDX_FILE"
           ],
           "enumDescriptions": [
             "Default value. This value is unused.",
@@ -2417,7 +2630,10 @@
             "The note and occurrence track deployment events.",
             "The note and occurrence track the initial discovery status of a resource.",
             "This represents a logical \"role\" that can attest to artifacts.",
-            "This represents an in-toto link."
+            "This represents an in-toto link.",
+            "This represents a software bill of materials.",
+            "This represents an SPDX Package.",
+            "This represents an SPDX File."
           ],
           "type": "string"
         },
@@ -2447,10 +2663,26 @@
           },
           "type": "array"
         },
+        "sbom": {
+          "$ref": "DocumentNote",
+          "description": "A note describing SPDX Document which represents SBOM."
+        },
         "shortDescription": {
           "description": "A one sentence description of this note.",
           "type": "string"
         },
+        "spdxFile": {
+          "$ref": "FileNote",
+          "description": "A note describing SPDX File."
+        },
+        "spdxPackage": {
+          "$ref": "PackageNote",
+          "description": "A note describing SPDX Package."
+        },
+        "spdxRelationship": {
+          "$ref": "RelationshipNote",
+          "description": "A note describing SPDX Relationship."
+        },
         "updateTime": {
           "description": "Output only. The time this note was last updated. This field can be used as a filter in list requests.",
           "format": "google-datetime",
@@ -2511,7 +2743,10 @@
             "DEPLOYMENT",
             "DISCOVERY",
             "ATTESTATION",
-            "INTOTO"
+            "INTOTO",
+            "SBOM",
+            "SPDX_PACKAGE",
+            "SPDX_FILE"
           ],
           "enumDescriptions": [
             "Default value. This value is unused.",
@@ -2522,7 +2757,10 @@
             "The note and occurrence track deployment events.",
             "The note and occurrence track the initial discovery status of a resource.",
             "This represents a logical \"role\" that can attest to artifacts.",
-            "This represents an in-toto link."
+            "This represents an in-toto link.",
+            "This represents a software bill of materials.",
+            "This represents an SPDX Package.",
+            "This represents an SPDX File."
           ],
           "type": "string"
         },
@@ -2542,6 +2780,22 @@
           "$ref": "Resource",
           "description": "Required. Immutable. The resource for which the occurrence applies."
         },
+        "sbom": {
+          "$ref": "DocumentOccurrence",
+          "description": "Describes a specific SPDX Document."
+        },
+        "spdxFile": {
+          "$ref": "FileOccurrence",
+          "description": "Describes a specific SPDX File."
+        },
+        "spdxPackage": {
+          "$ref": "PackageOccurrence",
+          "description": "Describes a specific SPDX Package."
+        },
+        "spdxRelationship": {
+          "$ref": "RelationshipOccurrence",
+          "description": "Describes a specific SPDX Relationship."
+        },
         "updateTime": {
           "description": "Output only. The time this occurrence was last updated.",
           "format": "google-datetime",
@@ -2591,6 +2845,114 @@
       },
       "type": "object"
     },
+    "PackageNote": {
+      "description": "PackageNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/",
+      "id": "PackageNote",
+      "properties": {
+        "analyzed": {
+          "description": "Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document",
+          "type": "boolean"
+        },
+        "attribution": {
+          "description": "A place for the SPDX data creator to record, at the package level, acknowledgements that may be needed to be communicated in some contexts",
+          "type": "string"
+        },
+        "checksum": {
+          "description": "Provide an independently reproducible mechanism that permits unique identification of a specific package that correlates to the data in this SPDX file",
+          "type": "string"
+        },
+        "copyright": {
+          "description": "Identify the copyright holders of the package, as well as any dates present",
+          "type": "string"
+        },
+        "detailedDescription": {
+          "description": "A more detailed description of the package",
+          "type": "string"
+        },
+        "downloadLocation": {
+          "description": "This section identifies the download Universal Resource Locator (URL), or a specific location within a version control system (VCS) for the package at the time that the SPDX file was created",
+          "type": "string"
+        },
+        "externalRefs": {
+          "description": "ExternalRef",
+          "items": {
+            "$ref": "ExternalRef"
+          },
+          "type": "array"
+        },
+        "filesLicenseInfo": {
+          "description": "Contain the license the SPDX file creator has concluded as governing the This field is to contain a list of all licenses found in the package. The relationship between licenses (i.e., conjunctive, disjunctive) is not specified in this field \u2013 it is simply a listing of all licenses found",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "homePage": {
+          "description": "Provide a place for the SPDX file creator to record a web site that serves as the package's home page",
+          "type": "string"
+        },
+        "licenseDeclared": {
+          "description": "List the licenses that have been declared by the authors of the package",
+          "type": "string"
+        },
+        "originator": {
+          "description": "If the package identified in the SPDX file originated from a different person or organization than identified as Package Supplier, this field identifies from where or whom the package originally came",
+          "type": "string"
+        },
+        "summaryDescription": {
+          "description": "A short description of the package",
+          "type": "string"
+        },
+        "supplier": {
+          "description": "Identify the actual distribution source for the package/directory identified in the SPDX file",
+          "type": "string"
+        },
+        "title": {
+          "description": "Identify the full name of the package as given by the Package Originator",
+          "type": "string"
+        },
+        "verificationCode": {
+          "description": "This field provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX file itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX file",
+          "type": "string"
+        },
+        "version": {
+          "description": "Identify the version of the package",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "PackageOccurrence": {
+      "description": "PackageOccurrence represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/",
+      "id": "PackageOccurrence",
+      "properties": {
+        "comment": {
+          "description": "A place for the SPDX file creator to record any general comments about the package being described",
+          "type": "string"
+        },
+        "filename": {
+          "description": "Provide the actual file name of the package, or path of the directory being treated as a package",
+          "type": "string"
+        },
+        "id": {
+          "description": "Uniquely identify any element in an SPDX document which may be referenced by other elements",
+          "type": "string"
+        },
+        "licenseComments": {
+          "description": "This field provides a place for the SPDX file creator to record any relevant background information or analysis that went in to arriving at the Concluded License for a package",
+          "type": "string"
+        },
+        "licenseConcluded": {
+          "description": "package or alternative values, if the governing license cannot be determined",
+          "type": "string"
+        },
+        "sourceInfo": {
+          "description": "Provide a place for the SPDX file creator to record any relevant background information or additional comments about the origin of the package",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "PgpSignedAttestation": {
       "description": "An attestation wrapper with a PGP-compatible signature. This message only supports `ATTACHED` signatures, where the payload that is signed is included alongside the signature itself in the same file.",
       "id": "PgpSignedAttestation",
@@ -2672,6 +3034,127 @@
       },
       "type": "object"
     },
+    "RelationshipNote": {
+      "description": "RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/",
+      "id": "RelationshipNote",
+      "properties": {},
+      "type": "object"
+    },
+    "RelationshipOccurrence": {
+      "description": "RelationshipOccurrence represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/",
+      "id": "RelationshipOccurrence",
+      "properties": {
+        "comment": {
+          "description": "A place for the SPDX file creator to record any general comments about the relationship",
+          "type": "string"
+        },
+        "source": {
+          "description": "Also referred to as SPDXRef-A The source SPDX element (file, package, etc)",
+          "type": "string"
+        },
+        "target": {
+          "description": "Also referred to as SPDXRef-B The target SPDC element (file, package, etc) In cases where there are \"known unknowns\", the use of the keyword NOASSERTION can be used The keywords NONE can be used to indicate that an SPDX element (package/file/snippet) has no other elements connected by some relationship to it",
+          "type": "string"
+        },
+        "type": {
+          "description": "The type of relationship between the source and target SPDX elements",
+          "enum": [
+            "TYPE_UNSPECIFIED",
+            "DESCRIBES",
+            "DESCRIBED_BY",
+            "CONTAINS",
+            "CONTAINED_BY",
+            "DEPENDS_ON",
+            "DEPENDENCY_OF",
+            "DEPENDENCY_MANIFEST_OF",
+            "BUILD_DEPENDENCY_OF",
+            "DEV_DEPENDENCY_OF",
+            "OPTIONAL_DEPENDENCY_OF",
+            "PROVIDED_DEPENDENCY_OF",
+            "TEST_DEPENDENCY_OF",
+            "RUNTIME_DEPENDENCY_OF",
+            "EXAMPLE_OF",
+            "GENERATES",
+            "GENERATED_FROM",
+            "ANCESTOR_OF",
+            "DESCENDANT_OF",
+            "VARIANT_OF",
+            "DISTRIBUTION_ARTIFACT",
+            "PATCH_FOR",
+            "PATCH_APPLIED",
+            "COPY_OF",
+            "FILE_ADDED",
+            "FILE_DELETED",
+            "FILE_MODIFIED",
+            "EXPANDED_FROM_ARCHIVE",
+            "DYNAMIC_LINK",
+            "STATIC_LINK",
+            "DATA_FILE_OF",
+            "TEST_CASE_OF",
+            "BUILD_TOOL_OF",
+            "DEV_TOOL_OF",
+            "TEST_OF",
+            "TEST_TOOL_OF",
+            "DOCUMENTATION_OF",
+            "OPTIONAL_COMPONENT_OF",
+            "METAFILE_OF",
+            "PACKAGE_OF",
+            "AMENDS",
+            "PREREQUISITE_FOR",
+            "HAS_PREREQUISITE",
+            "OTHER"
+          ],
+          "enumDescriptions": [
+            "Unspecified",
+            "Is to be used when SPDXRef-DOCUMENT describes SPDXRef-A",
+            "Is to be used when SPDXRef-A is described by SPDXREF-Document",
+            "Is to be used when SPDXRef-A contains SPDXRef-B",
+            "Is to be used when SPDXRef-A is contained by SPDXRef-B",
+            "Is to be used when SPDXRef-A depends on SPDXRef-B",
+            "Is to be used when SPDXRef-A is dependency of SPDXRef-B",
+            "Is to be used when SPDXRef-A is a manifest file that lists a set of dependencies for SPDXRef-B",
+            "Is to be used when SPDXRef-A is a build dependency of SPDXRef-B",
+            "Is to be used when SPDXRef-A is a development dependency of SPDXRef-B",
+            "Is to be used when SPDXRef-A is an optional dependency of SPDXRef-B",
+            "Is to be used when SPDXRef-A is a to be provided dependency of SPDXRef-B",
+            "Is to be used when SPDXRef-A is a test dependency of SPDXRef-B",
+            "Is to be used when SPDXRef-A is a dependency required for the execution of SPDXRef-B",
+            "Is to be used when SPDXRef-A is an example of SPDXRef-B",
+            "Is to be used when SPDXRef-A generates SPDXRef-B",
+            "Is to be used when SPDXRef-A was generated from SPDXRef-B",
+            "Is to be used when SPDXRef-A is an ancestor (same lineage but pre-dates) SPDXRef-B",
+            "Is to be used when SPDXRef-A is a descendant of (same lineage but postdates) SPDXRef-B",
+            "Is to be used when SPDXRef-A is a variant of (same lineage but not clear which came first) SPDXRef-B",
+            "Is to be used when distributing SPDXRef-A requires that SPDXRef-B also be distributed",
+            "Is to be used when SPDXRef-A is a patch file for (to be applied to) SPDXRef-B",
+            "Is to be used when SPDXRef-A is a patch file that has been applied to SPDXRef-B",
+            "Is to be used when SPDXRef-A is an exact copy of SPDXRef-B",
+            "Is to be used when SPDXRef-A is a file that was added to SPDXRef-B",
+            "Is to be used when SPDXRef-A is a file that was deleted from SPDXRef-B",
+            "Is to be used when SPDXRef-A is a file that was modified from SPDXRef-B",
+            "Is to be used when SPDXRef-A is expanded from the archive SPDXRef-B",
+            "Is to be used when SPDXRef-A dynamically links to SPDXRef-B",
+            "Is to be used when SPDXRef-A statically links to SPDXRef-B",
+            "Is to be used when SPDXRef-A is a data file used in SPDXRef-B",
+            "Is to be used when SPDXRef-A is a test case used in testing SPDXRef-B",
+            "Is to be used when SPDXRef-A is used to build SPDXRef-B",
+            "Is to be used when SPDXRef-A is used as a development tool for SPDXRef-B",
+            "Is to be used when SPDXRef-A is used for testing SPDXRef-B",
+            "Is to be used when SPDXRef-A is used as a test tool for SPDXRef-B",
+            "Is to be used when SPDXRef-A provides documentation of SPDXRef-B",
+            "Is to be used when SPDXRef-A is an optional component of SPDXRef-B",
+            "Is to be used when SPDXRef-A is a metafile of SPDXRef-B",
+            "Is to be used when SPDXRef-A is used as a package as part of SPDXRef-B",
+            "Is to be used when (current) SPDXRef-DOCUMENT amends the SPDX information in SPDXRef-B",
+            "Is to be used when SPDXRef-A is a prerequisite for SPDXRef-B",
+            "Is to be used when SPDXRef-A has as a prerequisite SPDXRef-B",
+            "Is to be used for a relationship which has not been defined in the formal SPDX specification. A description of the relationship should be included in the Relationship comments field"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "RepoId": {
       "description": "A unique identifier for a Cloud Repo.",
       "id": "RepoId",
diff --git a/googleapiclient/discovery_cache/documents/content.v2.1.json b/googleapiclient/discovery_cache/documents/content.v2.1.json
index 114451f..ce5d7c3 100644
--- a/googleapiclient/discovery_cache/documents/content.v2.1.json
+++ b/googleapiclient/discovery_cache/documents/content.v2.1.json
@@ -5675,7 +5675,7 @@
       }
     }
   },
-  "revision": "20210722",
+  "revision": "20210728",
   "rootUrl": "https://shoppingcontent.googleapis.com/",
   "schemas": {
     "Account": {
diff --git a/googleapiclient/discovery_cache/documents/content.v2.json b/googleapiclient/discovery_cache/documents/content.v2.json
index bbd5fde..70ee012 100644
--- a/googleapiclient/discovery_cache/documents/content.v2.json
+++ b/googleapiclient/discovery_cache/documents/content.v2.json
@@ -3298,7 +3298,7 @@
       }
     }
   },
-  "revision": "20210722",
+  "revision": "20210728",
   "rootUrl": "https://shoppingcontent.googleapis.com/",
   "schemas": {
     "Account": {
diff --git a/googleapiclient/discovery_cache/documents/customsearch.v1.json b/googleapiclient/discovery_cache/documents/customsearch.v1.json
index f5dafa7..2b18a6e 100644
--- a/googleapiclient/discovery_cache/documents/customsearch.v1.json
+++ b/googleapiclient/discovery_cache/documents/customsearch.v1.json
@@ -674,7 +674,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://customsearch.googleapis.com/",
   "schemas": {
     "Promotion": {
diff --git a/googleapiclient/discovery_cache/documents/datacatalog.v1.json b/googleapiclient/discovery_cache/documents/datacatalog.v1.json
index a8527d1..62646c0 100644
--- a/googleapiclient/discovery_cache/documents/datacatalog.v1.json
+++ b/googleapiclient/discovery_cache/documents/datacatalog.v1.json
@@ -147,7 +147,7 @@
               "type": "string"
             },
             "sqlResource": {
-              "description": "The SQL name of the entry. SQL names are case-sensitive. Examples: * `pubsub.{PROJECT_ID}.{TOPIC_ID}` * `pubsub.{PROJECT_ID}.{TOPIC.ID.SEPARATED.WITH.DOTS}` * `bigquery.table.{PROJECT_ID}.{DATASET_ID}.{TABLE_ID}` * `bigquery.dataset.{PROJECT_ID}.{DATASET_ID}` * `datacatalog.entry.{PROJECT_ID}.{LOCATION_ID}.{ENTRY_GROUP_ID}.{ENTRY_ID}` Identifiers (`*_ID`) should comply with the [Lexical structure in Standard SQL] (https://cloud.google.com/bigquery/docs/reference/standard-sql/lexical).",
+              "description": "The SQL name of the entry. SQL names are case-sensitive. Examples: * `pubsub.topic.{PROJECT_ID}.{TOPIC_ID}` * `pubsub.topic.{PROJECT_ID}.`\\``{TOPIC.ID.SEPARATED.WITH.DOTS}`\\` * `bigquery.table.{PROJECT_ID}.{DATASET_ID}.{TABLE_ID}` * `bigquery.dataset.{PROJECT_ID}.{DATASET_ID}` * `datacatalog.entry.{PROJECT_ID}.{LOCATION_ID}.{ENTRY_GROUP_ID}.{ENTRY_ID}` Identifiers (`*_ID`) should comply with the [Lexical structure in Standard SQL] (https://cloud.google.com/bigquery/docs/reference/standard-sql/lexical).",
               "location": "query",
               "type": "string"
             }
@@ -1841,7 +1841,7 @@
       }
     }
   },
-  "revision": "20210712",
+  "revision": "20210721",
   "rootUrl": "https://datacatalog.googleapis.com/",
   "schemas": {
     "Binding": {
@@ -3047,7 +3047,7 @@
           "type": "object"
         },
         "isPubliclyReadable": {
-          "description": "Indicates whether this is a public tag template. Every user has view access to a *public* tag template by default. This means that: * Every user can use this tag template to tag an entry. * If an entry is tagged using the tag template, the tag is always shown in the response to ``ListTags`` called on the entry. * To get the template using the GetTagTemplate method, you need view access either on the project or the organization the tag template resides in but no other permission is needed. * Operations on the tag template other than viewing (for example, editing IAM policies) follow standard IAM structures. Tags created with a public tag template are referred to as public tags. You can search for a public tag by value with a simple search query instead of using a ``tag:`` predicate. Public tag templates may not appear in search results depending on scope, see: include_public_tag_templates",
+          "description": "Indicates whether this is a public tag template. Every user has view access to a *public* tag template by default. This means that: * Every user can use this tag template to tag an entry. * If an entry is tagged using the tag template, the tag is always shown in the response to ``ListTags`` called on the entry. * To get the template using the GetTagTemplate method, you need view access either on the project or the organization the tag template resides in but no other permission is needed. * Operations on the tag template other than viewing (for example, editing IAM policies) follow standard IAM structures. Tags created with a public tag template are referred to as public tags. You can search for a public tag by value with a simple search query instead of using a ``tag:`` predicate. Public tag templates may not appear in search results depending on scope, see: include_public_tag_templates Note: If an [IAM domain restriction](https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains) is configured in the tag template's location, the public access will not be enabled but the simple search for tag values will still work.",
           "type": "boolean"
         },
         "name": {
diff --git a/googleapiclient/discovery_cache/documents/datacatalog.v1beta1.json b/googleapiclient/discovery_cache/documents/datacatalog.v1beta1.json
index 1b59ceb..5ce17b5 100644
--- a/googleapiclient/discovery_cache/documents/datacatalog.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/datacatalog.v1beta1.json
@@ -1808,7 +1808,7 @@
       }
     }
   },
-  "revision": "20210712",
+  "revision": "20210721",
   "rootUrl": "https://datacatalog.googleapis.com/",
   "schemas": {
     "Binding": {
diff --git a/googleapiclient/discovery_cache/documents/datalabeling.v1beta1.json b/googleapiclient/discovery_cache/documents/datalabeling.v1beta1.json
index 2d0d40b..c1f0387 100644
--- a/googleapiclient/discovery_cache/documents/datalabeling.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/datalabeling.v1beta1.json
@@ -1596,7 +1596,7 @@
       }
     }
   },
-  "revision": "20210719",
+  "revision": "20210724",
   "rootUrl": "https://datalabeling.googleapis.com/",
   "schemas": {
     "GoogleCloudDatalabelingV1alpha1CreateInstructionMetadata": {
diff --git a/googleapiclient/discovery_cache/documents/deploymentmanager.alpha.json b/googleapiclient/discovery_cache/documents/deploymentmanager.alpha.json
index 002ff92..2f4a497 100644
--- a/googleapiclient/discovery_cache/documents/deploymentmanager.alpha.json
+++ b/googleapiclient/discovery_cache/documents/deploymentmanager.alpha.json
@@ -1588,7 +1588,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210722",
   "rootUrl": "https://deploymentmanager.googleapis.com/",
   "schemas": {
     "AsyncOptions": {
diff --git a/googleapiclient/discovery_cache/documents/deploymentmanager.v2.json b/googleapiclient/discovery_cache/documents/deploymentmanager.v2.json
index c6fd561..c8dd473 100644
--- a/googleapiclient/discovery_cache/documents/deploymentmanager.v2.json
+++ b/googleapiclient/discovery_cache/documents/deploymentmanager.v2.json
@@ -988,7 +988,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210722",
   "rootUrl": "https://deploymentmanager.googleapis.com/",
   "schemas": {
     "AuditConfig": {
diff --git a/googleapiclient/discovery_cache/documents/deploymentmanager.v2beta.json b/googleapiclient/discovery_cache/documents/deploymentmanager.v2beta.json
index dd53e9e..60a0631 100644
--- a/googleapiclient/discovery_cache/documents/deploymentmanager.v2beta.json
+++ b/googleapiclient/discovery_cache/documents/deploymentmanager.v2beta.json
@@ -1552,7 +1552,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210722",
   "rootUrl": "https://deploymentmanager.googleapis.com/",
   "schemas": {
     "AsyncOptions": {
diff --git a/googleapiclient/discovery_cache/documents/dialogflow.v2.json b/googleapiclient/discovery_cache/documents/dialogflow.v2.json
index 0c9b078..42a6c5c 100644
--- a/googleapiclient/discovery_cache/documents/dialogflow.v2.json
+++ b/googleapiclient/discovery_cache/documents/dialogflow.v2.json
@@ -6915,7 +6915,7 @@
       }
     }
   },
-  "revision": "20210709",
+  "revision": "20210727",
   "rootUrl": "https://dialogflow.googleapis.com/",
   "schemas": {
     "GoogleCloudDialogflowCxV3AudioInput": {
@@ -13649,7 +13649,7 @@
           "type": "array"
         },
         "errorMessage": {
-          "description": "The detailed error messsage.",
+          "description": "The detailed error message.",
           "type": "string"
         },
         "severity": {
diff --git a/googleapiclient/discovery_cache/documents/dialogflow.v2beta1.json b/googleapiclient/discovery_cache/documents/dialogflow.v2beta1.json
index 3e3e829..9147059 100644
--- a/googleapiclient/discovery_cache/documents/dialogflow.v2beta1.json
+++ b/googleapiclient/discovery_cache/documents/dialogflow.v2beta1.json
@@ -7247,7 +7247,7 @@
       }
     }
   },
-  "revision": "20210709",
+  "revision": "20210727",
   "rootUrl": "https://dialogflow.googleapis.com/",
   "schemas": {
     "GoogleCloudDialogflowCxV3AudioInput": {
@@ -12876,7 +12876,7 @@
           "description": "Configuration for connecting to a live agent. Currently, this feature is not general available, please contact Google to get access."
         },
         "languageCode": {
-          "description": "Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages.",
+          "description": "Language code for the conversation profile. If not specified, the language is en-US. Language at ConversationProfile should be set for all non en-us languages. This should be a [BCP-47](https://www.rfc-editor.org/rfc/bcp/bcp47.txt) language tag. Example: \"en-US\".",
           "type": "string"
         },
         "loggingConfig": {
@@ -12895,10 +12895,18 @@
           "$ref": "GoogleCloudDialogflowV2beta1NotificationConfig",
           "description": "Configuration for publishing conversation lifecycle events."
         },
+        "securitySettings": {
+          "description": "Name of the CX SecuritySettings reference for the agent. Format: `projects//locations//securitySettings/`.",
+          "type": "string"
+        },
         "sttConfig": {
           "$ref": "GoogleCloudDialogflowV2beta1SpeechToTextConfig",
           "description": "Settings for speech transcription."
         },
+        "timeZone": {
+          "description": "The time zone of this conversational profile from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York, Europe/Paris. Defaults to America/New_York.",
+          "type": "string"
+        },
         "updateTime": {
           "description": "Output only. Update time of the conversation profile.",
           "format": "google-datetime",
@@ -16563,7 +16571,7 @@
           "type": "array"
         },
         "errorMessage": {
-          "description": "The detailed error messsage.",
+          "description": "The detailed error message.",
           "type": "string"
         },
         "severity": {
diff --git a/googleapiclient/discovery_cache/documents/dialogflow.v3.json b/googleapiclient/discovery_cache/documents/dialogflow.v3.json
index 7641404..c872885 100644
--- a/googleapiclient/discovery_cache/documents/dialogflow.v3.json
+++ b/googleapiclient/discovery_cache/documents/dialogflow.v3.json
@@ -3553,13 +3553,43 @@
       }
     }
   },
-  "revision": "20210709",
+  "revision": "20210727",
   "rootUrl": "https://dialogflow.googleapis.com/",
   "schemas": {
+    "GoogleCloudDialogflowCxV3AdvancedSettings": {
+      "description": "Hierarchical advanced settings for agent/flow/page/fulfillment/parameter. Settings exposed at lower level overrides the settings exposed at higher level. Hierarchy: Agent->Flow->Page->Fulfillment/Parameter.",
+      "id": "GoogleCloudDialogflowCxV3AdvancedSettings",
+      "properties": {
+        "loggingSettings": {
+          "$ref": "GoogleCloudDialogflowCxV3AdvancedSettingsLoggingSettings",
+          "description": "Settings for logging. Settings for Dialogflow History, Contact Center messages, StackDriver logs, and speech logging. Exposed at the following levels: - Agent level."
+        }
+      },
+      "type": "object"
+    },
+    "GoogleCloudDialogflowCxV3AdvancedSettingsLoggingSettings": {
+      "description": "Define behaviors on logging.",
+      "id": "GoogleCloudDialogflowCxV3AdvancedSettingsLoggingSettings",
+      "properties": {
+        "enableInteractionLogging": {
+          "description": "If true, DF Interaction logging is currently enabled.",
+          "type": "boolean"
+        },
+        "enableStackdriverLogging": {
+          "description": "If true, StackDriver logging is currently enabled.",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
     "GoogleCloudDialogflowCxV3Agent": {
       "description": "Agents are best described as Natural Language Understanding (NLU) modules that transform user requests into actionable data. You can include agents in your app, product, or service to determine user intent and respond to the user in a natural way. After you create an agent, you can add Intents, Entity Types, Flows, Fulfillments, Webhooks, and so on to manage the conversation flows..",
       "id": "GoogleCloudDialogflowCxV3Agent",
       "properties": {
+        "advancedSettings": {
+          "$ref": "GoogleCloudDialogflowCxV3AdvancedSettings",
+          "description": "Hierarchical advanced settings for this agent. The settings exposed at the lower level overrides the settings exposed at the higher level."
+        },
         "avatarUri": {
           "description": "The URI of the agent's avatar. Avatars are used throughout the Dialogflow console and in the self-hosted [Web Demo](https://cloud.google.com/dialogflow/docs/integrations/web-demo) integration.",
           "type": "string"
@@ -3581,7 +3611,7 @@
           "type": "boolean"
         },
         "enableStackdriverLogging": {
-          "description": "Indicates if stackdriver logging is enabled for the agent.",
+          "description": "Indicates if stackdriver logging is enabled for the agent. Please use agent.advanced_settings instead.",
           "type": "boolean"
         },
         "name": {
@@ -5752,6 +5782,13 @@
           "description": "Whether to disable webhook calls for this request.",
           "type": "boolean"
         },
+        "flowVersions": {
+          "description": "A list of flow versions to override for the request. Format: `projects//locations//agents//flows//versions/`. If version 1 of flow X is included in this list, the traffic of flow X will go through version 1 regardless of the version configuration in the environment. Each flow can have at most one version specified in this list.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
         "geoLocation": {
           "$ref": "GoogleTypeLatLng",
           "description": "The geo location of this conversational query."
@@ -6176,6 +6213,10 @@
           "description": "Required. The human-readable name of the security settings, unique within the location.",
           "type": "string"
         },
+        "insightsExportSettings": {
+          "$ref": "GoogleCloudDialogflowCxV3SecuritySettingsInsightsExportSettings",
+          "description": "Optional. Controls conversation exporting settings to Insights after conversation is completed. If retention_strategy is set to REMOVE_AFTER_CONVERSATION, Insights export is disabled no matter what you configure here."
+        },
         "inspectTemplate": {
           "description": "[DLP](https://cloud.google.com/dlp/docs) inspect template name. Use this template to define inspect base settings. If empty, we use the default DLP inspect config. The template name will have one of the following formats: `projects//inspectTemplates/` OR `projects//locations//inspectTemplates/` OR `organizations//inspectTemplates/`",
           "type": "string"
@@ -6231,6 +6272,17 @@
       },
       "type": "object"
     },
+    "GoogleCloudDialogflowCxV3SecuritySettingsInsightsExportSettings": {
+      "description": "Settings for exporting conversations to [Insights](https://cloud.google.com/dialogflow/priv/docs/insights).",
+      "id": "GoogleCloudDialogflowCxV3SecuritySettingsInsightsExportSettings",
+      "properties": {
+        "enableInsightsExport": {
+          "description": "If enabled, we will automatically exports conversations to Insights and Insights runs its analyzers.",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
     "GoogleCloudDialogflowCxV3SentimentAnalysisResult": {
       "description": "The result of sentiment analysis. Sentiment analysis inspects user input and identifies the prevailing subjective opinion, especially to determine a user's attitude as positive, negative, or neutral.",
       "id": "GoogleCloudDialogflowCxV3SentimentAnalysisResult",
diff --git a/googleapiclient/discovery_cache/documents/dialogflow.v3beta1.json b/googleapiclient/discovery_cache/documents/dialogflow.v3beta1.json
index 47f49af..fd1d737 100644
--- a/googleapiclient/discovery_cache/documents/dialogflow.v3beta1.json
+++ b/googleapiclient/discovery_cache/documents/dialogflow.v3beta1.json
@@ -3553,7 +3553,7 @@
       }
     }
   },
-  "revision": "20210709",
+  "revision": "20210727",
   "rootUrl": "https://dialogflow.googleapis.com/",
   "schemas": {
     "GoogleCloudDialogflowCxV3AudioInput": {
@@ -5127,10 +5127,40 @@
       },
       "type": "object"
     },
+    "GoogleCloudDialogflowCxV3beta1AdvancedSettings": {
+      "description": "Hierarchical advanced settings for agent/flow/page/fulfillment/parameter. Settings exposed at lower level overrides the settings exposed at higher level. Hierarchy: Agent->Flow->Page->Fulfillment/Parameter.",
+      "id": "GoogleCloudDialogflowCxV3beta1AdvancedSettings",
+      "properties": {
+        "loggingSettings": {
+          "$ref": "GoogleCloudDialogflowCxV3beta1AdvancedSettingsLoggingSettings",
+          "description": "Settings for logging. Settings for Dialogflow History, Contact Center messages, StackDriver logs, and speech logging. Exposed at the following levels: - Agent level."
+        }
+      },
+      "type": "object"
+    },
+    "GoogleCloudDialogflowCxV3beta1AdvancedSettingsLoggingSettings": {
+      "description": "Define behaviors on logging.",
+      "id": "GoogleCloudDialogflowCxV3beta1AdvancedSettingsLoggingSettings",
+      "properties": {
+        "enableInteractionLogging": {
+          "description": "If true, DF Interaction logging is currently enabled.",
+          "type": "boolean"
+        },
+        "enableStackdriverLogging": {
+          "description": "If true, StackDriver logging is currently enabled.",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
     "GoogleCloudDialogflowCxV3beta1Agent": {
       "description": "Agents are best described as Natural Language Understanding (NLU) modules that transform user requests into actionable data. You can include agents in your app, product, or service to determine user intent and respond to the user in a natural way. After you create an agent, you can add Intents, Entity Types, Flows, Fulfillments, Webhooks, and so on to manage the conversation flows..",
       "id": "GoogleCloudDialogflowCxV3beta1Agent",
       "properties": {
+        "advancedSettings": {
+          "$ref": "GoogleCloudDialogflowCxV3beta1AdvancedSettings",
+          "description": "Hierarchical advanced settings for this agent. The settings exposed at the lower level overrides the settings exposed at the higher level."
+        },
         "avatarUri": {
           "description": "The URI of the agent's avatar. Avatars are used throughout the Dialogflow console and in the self-hosted [Web Demo](https://cloud.google.com/dialogflow/docs/integrations/web-demo) integration.",
           "type": "string"
@@ -5152,7 +5182,7 @@
           "type": "boolean"
         },
         "enableStackdriverLogging": {
-          "description": "Indicates if stackdriver logging is enabled for the agent.",
+          "description": "Indicates if stackdriver logging is enabled for the agent. Please use agent.advanced_settings instead.",
           "type": "boolean"
         },
         "name": {
@@ -7323,6 +7353,13 @@
           "description": "Whether to disable webhook calls for this request.",
           "type": "boolean"
         },
+        "flowVersions": {
+          "description": "A list of flow versions to override for the request. Format: `projects//locations//agents//flows//versions/`. If version 1 of flow X is included in this list, the traffic of flow X will go through version 1 regardless of the version configuration in the environment. Each flow can have at most one version specified in this list.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
         "geoLocation": {
           "$ref": "GoogleTypeLatLng",
           "description": "The geo location of this conversational query."
@@ -7747,6 +7784,10 @@
           "description": "Required. The human-readable name of the security settings, unique within the location.",
           "type": "string"
         },
+        "insightsExportSettings": {
+          "$ref": "GoogleCloudDialogflowCxV3beta1SecuritySettingsInsightsExportSettings",
+          "description": "Optional. Controls conversation exporting settings to Insights after conversation is completed. If retention_strategy is set to REMOVE_AFTER_CONVERSATION, Insights export is disabled no matter what you configure here."
+        },
         "inspectTemplate": {
           "description": "[DLP](https://cloud.google.com/dlp/docs) inspect template name. Use this template to define inspect base settings. If empty, we use the default DLP inspect config. The template name will have one of the following formats: `projects//inspectTemplates/` OR `projects//locations//inspectTemplates/` OR `organizations//inspectTemplates/`",
           "type": "string"
@@ -7802,6 +7843,17 @@
       },
       "type": "object"
     },
+    "GoogleCloudDialogflowCxV3beta1SecuritySettingsInsightsExportSettings": {
+      "description": "Settings for exporting conversations to [Insights](https://cloud.google.com/dialogflow/priv/docs/insights).",
+      "id": "GoogleCloudDialogflowCxV3beta1SecuritySettingsInsightsExportSettings",
+      "properties": {
+        "enableInsightsExport": {
+          "description": "If enabled, we will automatically exports conversations to Insights and Insights runs its analyzers.",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
     "GoogleCloudDialogflowCxV3beta1SentimentAnalysisResult": {
       "description": "The result of sentiment analysis. Sentiment analysis inspects user input and identifies the prevailing subjective opinion, especially to determine a user's attitude as positive, negative, or neutral.",
       "id": "GoogleCloudDialogflowCxV3beta1SentimentAnalysisResult",
diff --git a/googleapiclient/discovery_cache/documents/digitalassetlinks.v1.json b/googleapiclient/discovery_cache/documents/digitalassetlinks.v1.json
index 0357a3e..ba4a026 100644
--- a/googleapiclient/discovery_cache/documents/digitalassetlinks.v1.json
+++ b/googleapiclient/discovery_cache/documents/digitalassetlinks.v1.json
@@ -184,7 +184,7 @@
       }
     }
   },
-  "revision": "20210720",
+  "revision": "20210727",
   "rootUrl": "https://digitalassetlinks.googleapis.com/",
   "schemas": {
     "AndroidAppAsset": {
diff --git a/googleapiclient/discovery_cache/documents/displayvideo.v1.json b/googleapiclient/discovery_cache/documents/displayvideo.v1.json
index 2a442c2..5b7caa6 100644
--- a/googleapiclient/discovery_cache/documents/displayvideo.v1.json
+++ b/googleapiclient/discovery_cache/documents/displayvideo.v1.json
@@ -7317,7 +7317,7 @@
       }
     }
   },
-  "revision": "20210722",
+  "revision": "20210727",
   "rootUrl": "https://displayvideo.googleapis.com/",
   "schemas": {
     "ActivateManualTriggerRequest": {
diff --git a/googleapiclient/discovery_cache/documents/dlp.v2.json b/googleapiclient/discovery_cache/documents/dlp.v2.json
index fc70e28..8228501 100644
--- a/googleapiclient/discovery_cache/documents/dlp.v2.json
+++ b/googleapiclient/discovery_cache/documents/dlp.v2.json
@@ -3412,7 +3412,7 @@
       }
     }
   },
-  "revision": "20210717",
+  "revision": "20210723",
   "rootUrl": "https://dlp.googleapis.com/",
   "schemas": {
     "GooglePrivacyDlpV2Action": {
@@ -4253,12 +4253,12 @@
       "type": "object"
     },
     "GooglePrivacyDlpV2CryptoKey": {
-      "description": "This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key.",
+      "description": "This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK.",
       "id": "GooglePrivacyDlpV2CryptoKey",
       "properties": {
         "kmsWrapped": {
           "$ref": "GooglePrivacyDlpV2KmsWrappedCryptoKey",
-          "description": "Kms wrapped key"
+          "description": "Key wrapped using Cloud KMS"
         },
         "transient": {
           "$ref": "GooglePrivacyDlpV2TransientCryptoKey",
@@ -5889,7 +5889,7 @@
       "type": "object"
     },
     "GooglePrivacyDlpV2KmsWrappedCryptoKey": {
-      "description": "Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key).",
+      "description": "Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt For more information, see [Creating a wrapped key] (https://cloud.google.com/dlp/docs/create-wrapped-key). Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing).",
       "id": "GooglePrivacyDlpV2KmsWrappedCryptoKey",
       "properties": {
         "cryptoKeyName": {
diff --git a/googleapiclient/discovery_cache/documents/dns.v1.json b/googleapiclient/discovery_cache/documents/dns.v1.json
index f7a872b..4ec025f 100644
--- a/googleapiclient/discovery_cache/documents/dns.v1.json
+++ b/googleapiclient/discovery_cache/documents/dns.v1.json
@@ -1235,7 +1235,7 @@
       }
     }
   },
-  "revision": "20210717",
+  "revision": "20210728",
   "rootUrl": "https://dns.googleapis.com/",
   "schemas": {
     "Change": {
diff --git a/googleapiclient/discovery_cache/documents/dns.v1beta2.json b/googleapiclient/discovery_cache/documents/dns.v1beta2.json
index fd02903..a3df4a8 100644
--- a/googleapiclient/discovery_cache/documents/dns.v1beta2.json
+++ b/googleapiclient/discovery_cache/documents/dns.v1beta2.json
@@ -1730,7 +1730,7 @@
       }
     }
   },
-  "revision": "20210717",
+  "revision": "20210728",
   "rootUrl": "https://dns.googleapis.com/",
   "schemas": {
     "Change": {
diff --git a/googleapiclient/discovery_cache/documents/docs.v1.json b/googleapiclient/discovery_cache/documents/docs.v1.json
index de77ebf..a3c2c9d 100644
--- a/googleapiclient/discovery_cache/documents/docs.v1.json
+++ b/googleapiclient/discovery_cache/documents/docs.v1.json
@@ -216,7 +216,7 @@
       }
     }
   },
-  "revision": "20210720",
+  "revision": "20210727",
   "rootUrl": "https://docs.googleapis.com/",
   "schemas": {
     "AutoText": {
diff --git a/googleapiclient/discovery_cache/documents/documentai.v1.json b/googleapiclient/discovery_cache/documents/documentai.v1.json
index 33093ec..b4af4f0 100644
--- a/googleapiclient/discovery_cache/documents/documentai.v1.json
+++ b/googleapiclient/discovery_cache/documents/documentai.v1.json
@@ -664,7 +664,7 @@
       }
     }
   },
-  "revision": "20210719",
+  "revision": "20210730",
   "rootUrl": "https://documentai.googleapis.com/",
   "schemas": {
     "GoogleCloudDocumentaiUiv1beta3CommonOperationMetadata": {
diff --git a/googleapiclient/discovery_cache/documents/documentai.v1beta2.json b/googleapiclient/discovery_cache/documents/documentai.v1beta2.json
index 2458f79..216cfba 100644
--- a/googleapiclient/discovery_cache/documents/documentai.v1beta2.json
+++ b/googleapiclient/discovery_cache/documents/documentai.v1beta2.json
@@ -292,7 +292,7 @@
       }
     }
   },
-  "revision": "20210719",
+  "revision": "20210730",
   "rootUrl": "https://documentai.googleapis.com/",
   "schemas": {
     "GoogleCloudDocumentaiUiv1beta3CommonOperationMetadata": {
diff --git a/googleapiclient/discovery_cache/documents/documentai.v1beta3.json b/googleapiclient/discovery_cache/documents/documentai.v1beta3.json
index 30e6d7e..cd9785d 100644
--- a/googleapiclient/discovery_cache/documents/documentai.v1beta3.json
+++ b/googleapiclient/discovery_cache/documents/documentai.v1beta3.json
@@ -601,7 +601,7 @@
       }
     }
   },
-  "revision": "20210719",
+  "revision": "20210730",
   "rootUrl": "https://documentai.googleapis.com/",
   "schemas": {
     "GoogleCloudDocumentaiUiv1beta3CommonOperationMetadata": {
diff --git a/googleapiclient/discovery_cache/documents/domainsrdap.v1.json b/googleapiclient/discovery_cache/documents/domainsrdap.v1.json
index bdc4507..f737e58 100644
--- a/googleapiclient/discovery_cache/documents/domainsrdap.v1.json
+++ b/googleapiclient/discovery_cache/documents/domainsrdap.v1.json
@@ -289,7 +289,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://domainsrdap.googleapis.com/",
   "schemas": {
     "HttpBody": {
diff --git a/googleapiclient/discovery_cache/documents/doubleclickbidmanager.v1.1.json b/googleapiclient/discovery_cache/documents/doubleclickbidmanager.v1.1.json
index 3878513..d6efafd 100644
--- a/googleapiclient/discovery_cache/documents/doubleclickbidmanager.v1.1.json
+++ b/googleapiclient/discovery_cache/documents/doubleclickbidmanager.v1.1.json
@@ -280,7 +280,7 @@
       }
     }
   },
-  "revision": "20210721",
+  "revision": "20210722",
   "rootUrl": "https://doubleclickbidmanager.googleapis.com/",
   "schemas": {
     "ChannelGrouping": {
diff --git a/googleapiclient/discovery_cache/documents/doubleclickbidmanager.v1.json b/googleapiclient/discovery_cache/documents/doubleclickbidmanager.v1.json
index 29df71e..fa11a76 100644
--- a/googleapiclient/discovery_cache/documents/doubleclickbidmanager.v1.json
+++ b/googleapiclient/discovery_cache/documents/doubleclickbidmanager.v1.json
@@ -96,7 +96,7 @@
   },
   "protocol": "rest",
   "resources": {},
-  "revision": "20210721",
+  "revision": "20210722",
   "rootUrl": "https://doubleclickbidmanager.googleapis.com/",
   "schemas": {},
   "servicePath": "doubleclickbidmanager/v1/",
diff --git a/googleapiclient/discovery_cache/documents/drive.v2.json b/googleapiclient/discovery_cache/documents/drive.v2.json
index 9462a6e..2225774 100644
--- a/googleapiclient/discovery_cache/documents/drive.v2.json
+++ b/googleapiclient/discovery_cache/documents/drive.v2.json
@@ -38,7 +38,7 @@
   "description": "Manages files in Drive including uploading, downloading, searching, detecting changes, and updating sharing permissions.",
   "discoveryVersion": "v1",
   "documentationLink": "https://developers.google.com/drive/",
-  "etag": "\"uWj2hSb4GVjzdDlAnRd2gbM1ZQ8/3C2SqaIsGtaKNfA_Qui6Cbm4VKo\"",
+  "etag": "\"uWj2hSb4GVjzdDlAnRd2gbM1ZQ8/lVkL1iAjZ206vD5MP5b_zRIFlo8\"",
   "icons": {
     "x16": "https://ssl.gstatic.com/docs/doclist/images/drive_icon_16.png",
     "x32": "https://ssl.gstatic.com/docs/doclist/images/drive_icon_32.png"
@@ -1621,7 +1621,7 @@
               "type": "string"
             },
             "spaces": {
-              "description": "A comma-separated list of spaces to query. Supported values are 'drive', 'appDataFolder' and 'photos'.",
+              "description": "A comma-separated list of spaces to query. Supported values are 'drive' and 'appDataFolder'.",
               "location": "query",
               "type": "string"
             },
@@ -3527,7 +3527,7 @@
       }
     }
   },
-  "revision": "20210719",
+  "revision": "20210725",
   "rootUrl": "https://www.googleapis.com/",
   "schemas": {
     "About": {
@@ -4850,7 +4850,7 @@
           "type": "string"
         },
         "folderColorRgb": {
-          "description": "Folder color as an RGB hex string if the file is a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette. Not populated for items in shared drives.",
+          "description": "Folder color as an RGB hex string if the file is a folder or a shortcut to a folder. The list of supported colors is available in the folderColorPalette field of the About resource. If an unsupported color is specified, it will be changed to the closest color in the palette.",
           "type": "string"
         },
         "fullFileExtension": {
diff --git a/googleapiclient/discovery_cache/documents/drive.v3.json b/googleapiclient/discovery_cache/documents/drive.v3.json
index ff63d9f..0c6e715 100644
--- a/googleapiclient/discovery_cache/documents/drive.v3.json
+++ b/googleapiclient/discovery_cache/documents/drive.v3.json
@@ -35,7 +35,7 @@
   "description": "Manages files in Drive including uploading, downloading, searching, detecting changes, and updating sharing permissions.",
   "discoveryVersion": "v1",
   "documentationLink": "https://developers.google.com/drive/",
-  "etag": "\"uWj2hSb4GVjzdDlAnRd2gbM1ZQ8/_Lvps3-KgyI7_IwBA-9lM1tZSh4\"",
+  "etag": "\"uWj2hSb4GVjzdDlAnRd2gbM1ZQ8/cDkyqNRv2qPUIdairtszLrnCcP8\"",
   "icons": {
     "x16": "https://ssl.gstatic.com/docs/doclist/images/drive_icon_16.png",
     "x32": "https://ssl.gstatic.com/docs/doclist/images/drive_icon_32.png"
@@ -1174,7 +1174,7 @@
             },
             "spaces": {
               "default": "drive",
-              "description": "A comma-separated list of spaces to query within the corpus. Supported values are 'drive', 'appDataFolder' and 'photos'.",
+              "description": "A comma-separated list of spaces to query within the corpus. Supported values are 'drive' and 'appDataFolder'.",
               "location": "query",
               "type": "string"
             },
@@ -2191,7 +2191,7 @@
       }
     }
   },
-  "revision": "20210719",
+  "revision": "20210725",
   "rootUrl": "https://www.googleapis.com/",
   "schemas": {
     "About": {
@@ -3004,7 +3004,7 @@
           "type": "string"
         },
         "folderColorRgb": {
-          "description": "The color for a folder as an RGB hex string. The supported colors are published in the folderColorPalette field of the About resource.\nIf an unsupported color is specified, the closest color in the palette will be used instead.",
+          "description": "The color for a folder or shortcut to a folder as an RGB hex string. The supported colors are published in the folderColorPalette field of the About resource.\nIf an unsupported color is specified, the closest color in the palette will be used instead.",
           "type": "string"
         },
         "fullFileExtension": {
diff --git a/googleapiclient/discovery_cache/documents/driveactivity.v2.json b/googleapiclient/discovery_cache/documents/driveactivity.v2.json
index a4f3f1c..4fba04b 100644
--- a/googleapiclient/discovery_cache/documents/driveactivity.v2.json
+++ b/googleapiclient/discovery_cache/documents/driveactivity.v2.json
@@ -132,7 +132,7 @@
       }
     }
   },
-  "revision": "20210720",
+  "revision": "20210727",
   "rootUrl": "https://driveactivity.googleapis.com/",
   "schemas": {
     "Action": {
diff --git a/googleapiclient/discovery_cache/documents/essentialcontacts.v1.json b/googleapiclient/discovery_cache/documents/essentialcontacts.v1.json
index 8d7da23..5b54961 100644
--- a/googleapiclient/discovery_cache/documents/essentialcontacts.v1.json
+++ b/googleapiclient/discovery_cache/documents/essentialcontacts.v1.json
@@ -850,7 +850,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://essentialcontacts.googleapis.com/",
   "schemas": {
     "GoogleCloudEssentialcontactsV1ComputeContactsResponse": {
diff --git a/googleapiclient/discovery_cache/documents/eventarc.v1beta1.json b/googleapiclient/discovery_cache/documents/eventarc.v1beta1.json
index 8718e60..bbfe2e6 100644
--- a/googleapiclient/discovery_cache/documents/eventarc.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/eventarc.v1beta1.json
@@ -584,7 +584,7 @@
       }
     }
   },
-  "revision": "20210716",
+  "revision": "20210723",
   "rootUrl": "https://eventarc.googleapis.com/",
   "schemas": {
     "AuditConfig": {
diff --git a/googleapiclient/discovery_cache/documents/factchecktools.v1alpha1.json b/googleapiclient/discovery_cache/documents/factchecktools.v1alpha1.json
index ba83ae7..d5e5f35 100644
--- a/googleapiclient/discovery_cache/documents/factchecktools.v1alpha1.json
+++ b/googleapiclient/discovery_cache/documents/factchecktools.v1alpha1.json
@@ -304,7 +304,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://factchecktools.googleapis.com/",
   "schemas": {
     "GoogleFactcheckingFactchecktoolsV1alpha1Claim": {
diff --git a/googleapiclient/discovery_cache/documents/fcm.v1.json b/googleapiclient/discovery_cache/documents/fcm.v1.json
index 99054e1..b439062 100644
--- a/googleapiclient/discovery_cache/documents/fcm.v1.json
+++ b/googleapiclient/discovery_cache/documents/fcm.v1.json
@@ -4,6 +4,9 @@
       "scopes": {
         "https://www.googleapis.com/auth/cloud-platform": {
           "description": "See, edit, configure, and delete your Google Cloud Platform data"
+        },
+        "https://www.googleapis.com/auth/firebase.messaging": {
+          "description": "Send messages and manage messaging subscriptions for your Firebase applications"
         }
       }
     }
@@ -134,7 +137,8 @@
                 "$ref": "Message"
               },
               "scopes": [
-                "https://www.googleapis.com/auth/cloud-platform"
+                "https://www.googleapis.com/auth/cloud-platform",
+                "https://www.googleapis.com/auth/firebase.messaging"
               ]
             }
           }
@@ -142,7 +146,7 @@
       }
     }
   },
-  "revision": "20210719",
+  "revision": "20210726",
   "rootUrl": "https://fcm.googleapis.com/",
   "schemas": {
     "AndroidConfig": {
diff --git a/googleapiclient/discovery_cache/documents/fcmdata.v1beta1.json b/googleapiclient/discovery_cache/documents/fcmdata.v1beta1.json
index c957487..c41cb35 100644
--- a/googleapiclient/discovery_cache/documents/fcmdata.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/fcmdata.v1beta1.json
@@ -154,7 +154,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://fcmdata.googleapis.com/",
   "schemas": {
     "GoogleFirebaseFcmDataV1beta1AndroidDeliveryData": {
diff --git a/googleapiclient/discovery_cache/documents/file.v1.json b/googleapiclient/discovery_cache/documents/file.v1.json
index 09ed407..9ab91e0 100644
--- a/googleapiclient/discovery_cache/documents/file.v1.json
+++ b/googleapiclient/discovery_cache/documents/file.v1.json
@@ -672,7 +672,7 @@
       }
     }
   },
-  "revision": "20210708",
+  "revision": "20210721",
   "rootUrl": "https://file.googleapis.com/",
   "schemas": {
     "Backup": {
@@ -1740,7 +1740,7 @@
           "type": "string"
         },
         "denyMaintenancePeriods": {
-          "description": "Deny Maintenance Period that is applied to resource to indicate when maintenance is forbidden. User can specify zero or more non-overlapping deny periods. For V1, Maximum number of deny_maintenance_periods is expected to be one.",
+          "description": "Deny Maintenance Period that is applied to resource to indicate when maintenance is forbidden. User can specify zero or more non-overlapping deny periods. Maximum number of deny_maintenance_periods expected is one.",
           "items": {
             "$ref": "DenyMaintenancePeriod"
           },
diff --git a/googleapiclient/discovery_cache/documents/firebase.v1beta1.json b/googleapiclient/discovery_cache/documents/firebase.v1beta1.json
index 3138b48..f2c54e2 100644
--- a/googleapiclient/discovery_cache/documents/firebase.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/firebase.v1beta1.json
@@ -1121,7 +1121,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210729",
   "rootUrl": "https://firebase.googleapis.com/",
   "schemas": {
     "AddFirebaseRequest": {
diff --git a/googleapiclient/discovery_cache/documents/firebaseappcheck.v1beta.json b/googleapiclient/discovery_cache/documents/firebaseappcheck.v1beta.json
index 91f8f00..fb2a90a 100644
--- a/googleapiclient/discovery_cache/documents/firebaseappcheck.v1beta.json
+++ b/googleapiclient/discovery_cache/documents/firebaseappcheck.v1beta.json
@@ -1057,7 +1057,7 @@
       }
     }
   },
-  "revision": "20210716",
+  "revision": "20210730",
   "rootUrl": "https://firebaseappcheck.googleapis.com/",
   "schemas": {
     "GoogleFirebaseAppcheckV1betaAppAttestChallengeResponse": {
diff --git a/googleapiclient/discovery_cache/documents/firebasedatabase.v1beta.json b/googleapiclient/discovery_cache/documents/firebasedatabase.v1beta.json
index d1a7348..0b82707 100644
--- a/googleapiclient/discovery_cache/documents/firebasedatabase.v1beta.json
+++ b/googleapiclient/discovery_cache/documents/firebasedatabase.v1beta.json
@@ -317,7 +317,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210729",
   "rootUrl": "https://firebasedatabase.googleapis.com/",
   "schemas": {
     "DatabaseInstance": {
diff --git a/googleapiclient/discovery_cache/documents/firebasedynamiclinks.v1.json b/googleapiclient/discovery_cache/documents/firebasedynamiclinks.v1.json
index 8e4b8f8..4ae7516 100644
--- a/googleapiclient/discovery_cache/documents/firebasedynamiclinks.v1.json
+++ b/googleapiclient/discovery_cache/documents/firebasedynamiclinks.v1.json
@@ -224,7 +224,7 @@
       }
     }
   },
-  "revision": "20210719",
+  "revision": "20210726",
   "rootUrl": "https://firebasedynamiclinks.googleapis.com/",
   "schemas": {
     "AnalyticsInfo": {
diff --git a/googleapiclient/discovery_cache/documents/firebasehosting.v1.json b/googleapiclient/discovery_cache/documents/firebasehosting.v1.json
index 0d94e9b..554a457 100644
--- a/googleapiclient/discovery_cache/documents/firebasehosting.v1.json
+++ b/googleapiclient/discovery_cache/documents/firebasehosting.v1.json
@@ -186,7 +186,7 @@
       }
     }
   },
-  "revision": "20210720",
+  "revision": "20210724",
   "rootUrl": "https://firebasehosting.googleapis.com/",
   "schemas": {
     "CancelOperationRequest": {
diff --git a/googleapiclient/discovery_cache/documents/firebasehosting.v1beta1.json b/googleapiclient/discovery_cache/documents/firebasehosting.v1beta1.json
index 31fbade..bd5e3f7 100644
--- a/googleapiclient/discovery_cache/documents/firebasehosting.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/firebasehosting.v1beta1.json
@@ -1939,7 +1939,7 @@
       }
     }
   },
-  "revision": "20210720",
+  "revision": "20210724",
   "rootUrl": "https://firebasehosting.googleapis.com/",
   "schemas": {
     "ActingUser": {
diff --git a/googleapiclient/discovery_cache/documents/firebaseml.v1.json b/googleapiclient/discovery_cache/documents/firebaseml.v1.json
index 25483c3..be9fb1f 100644
--- a/googleapiclient/discovery_cache/documents/firebaseml.v1.json
+++ b/googleapiclient/discovery_cache/documents/firebaseml.v1.json
@@ -204,7 +204,7 @@
       }
     }
   },
-  "revision": "20210721",
+  "revision": "20210728",
   "rootUrl": "https://firebaseml.googleapis.com/",
   "schemas": {
     "CancelOperationRequest": {
diff --git a/googleapiclient/discovery_cache/documents/firebaseml.v1beta2.json b/googleapiclient/discovery_cache/documents/firebaseml.v1beta2.json
index 6576d36..78bb5b1 100644
--- a/googleapiclient/discovery_cache/documents/firebaseml.v1beta2.json
+++ b/googleapiclient/discovery_cache/documents/firebaseml.v1beta2.json
@@ -318,7 +318,7 @@
       }
     }
   },
-  "revision": "20210721",
+  "revision": "20210728",
   "rootUrl": "https://firebaseml.googleapis.com/",
   "schemas": {
     "DownloadModelResponse": {
diff --git a/googleapiclient/discovery_cache/documents/fitness.v1.json b/googleapiclient/discovery_cache/documents/fitness.v1.json
index a088476..0700c4b 100644
--- a/googleapiclient/discovery_cache/documents/fitness.v1.json
+++ b/googleapiclient/discovery_cache/documents/fitness.v1.json
@@ -831,7 +831,7 @@
       }
     }
   },
-  "revision": "20210721",
+  "revision": "20210728",
   "rootUrl": "https://fitness.googleapis.com/",
   "schemas": {
     "AggregateBucket": {
diff --git a/googleapiclient/discovery_cache/documents/gameservices.v1.json b/googleapiclient/discovery_cache/documents/gameservices.v1.json
index 1c28e39..d753ec2 100644
--- a/googleapiclient/discovery_cache/documents/gameservices.v1.json
+++ b/googleapiclient/discovery_cache/documents/gameservices.v1.json
@@ -1357,7 +1357,7 @@
       }
     }
   },
-  "revision": "20210714",
+  "revision": "20210721",
   "rootUrl": "https://gameservices.googleapis.com/",
   "schemas": {
     "AuditConfig": {
diff --git a/googleapiclient/discovery_cache/documents/gameservices.v1beta.json b/googleapiclient/discovery_cache/documents/gameservices.v1beta.json
index 5153409..22d4050 100644
--- a/googleapiclient/discovery_cache/documents/gameservices.v1beta.json
+++ b/googleapiclient/discovery_cache/documents/gameservices.v1beta.json
@@ -1357,7 +1357,7 @@
       }
     }
   },
-  "revision": "20210714",
+  "revision": "20210721",
   "rootUrl": "https://gameservices.googleapis.com/",
   "schemas": {
     "AuditConfig": {
diff --git a/googleapiclient/discovery_cache/documents/genomics.v2alpha1.json b/googleapiclient/discovery_cache/documents/genomics.v2alpha1.json
index 0b8eb11..3cf421d 100644
--- a/googleapiclient/discovery_cache/documents/genomics.v2alpha1.json
+++ b/googleapiclient/discovery_cache/documents/genomics.v2alpha1.json
@@ -301,7 +301,7 @@
       }
     }
   },
-  "revision": "20210720",
+  "revision": "20210727",
   "rootUrl": "https://genomics.googleapis.com/",
   "schemas": {
     "Accelerator": {
diff --git a/googleapiclient/discovery_cache/documents/gkehub.v1.json b/googleapiclient/discovery_cache/documents/gkehub.v1.json
index 01aa654..d3f86fe 100644
--- a/googleapiclient/discovery_cache/documents/gkehub.v1.json
+++ b/googleapiclient/discovery_cache/documents/gkehub.v1.json
@@ -905,7 +905,7 @@
       }
     }
   },
-  "revision": "20210716",
+  "revision": "20210723",
   "rootUrl": "https://gkehub.googleapis.com/",
   "schemas": {
     "AuditConfig": {
diff --git a/googleapiclient/discovery_cache/documents/gkehub.v1alpha2.json b/googleapiclient/discovery_cache/documents/gkehub.v1alpha2.json
index 369ac06..6afad99 100644
--- a/googleapiclient/discovery_cache/documents/gkehub.v1alpha2.json
+++ b/googleapiclient/discovery_cache/documents/gkehub.v1alpha2.json
@@ -652,7 +652,7 @@
       }
     }
   },
-  "revision": "20210716",
+  "revision": "20210723",
   "rootUrl": "https://gkehub.googleapis.com/",
   "schemas": {
     "AuditConfig": {
diff --git a/googleapiclient/discovery_cache/documents/gkehub.v1beta.json b/googleapiclient/discovery_cache/documents/gkehub.v1beta.json
index bbb4fe9..f095808 100644
--- a/googleapiclient/discovery_cache/documents/gkehub.v1beta.json
+++ b/googleapiclient/discovery_cache/documents/gkehub.v1beta.json
@@ -670,7 +670,7 @@
       }
     }
   },
-  "revision": "20210716",
+  "revision": "20210723",
   "rootUrl": "https://gkehub.googleapis.com/",
   "schemas": {
     "AuditConfig": {
diff --git a/googleapiclient/discovery_cache/documents/gkehub.v1beta1.json b/googleapiclient/discovery_cache/documents/gkehub.v1beta1.json
index 63ce4ec..e758efe 100644
--- a/googleapiclient/discovery_cache/documents/gkehub.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/gkehub.v1beta1.json
@@ -706,7 +706,7 @@
       }
     }
   },
-  "revision": "20210716",
+  "revision": "20210723",
   "rootUrl": "https://gkehub.googleapis.com/",
   "schemas": {
     "AuditConfig": {
diff --git a/googleapiclient/discovery_cache/documents/gmail.v1.json b/googleapiclient/discovery_cache/documents/gmail.v1.json
index 6868bb4..733796f 100644
--- a/googleapiclient/discovery_cache/documents/gmail.v1.json
+++ b/googleapiclient/discovery_cache/documents/gmail.v1.json
@@ -2682,7 +2682,7 @@
       }
     }
   },
-  "revision": "20210719",
+  "revision": "20210726",
   "rootUrl": "https://gmail.googleapis.com/",
   "schemas": {
     "AutoForwarding": {
diff --git a/googleapiclient/discovery_cache/documents/gmailpostmastertools.v1.json b/googleapiclient/discovery_cache/documents/gmailpostmastertools.v1.json
index 0882d62..891d5b4 100644
--- a/googleapiclient/discovery_cache/documents/gmailpostmastertools.v1.json
+++ b/googleapiclient/discovery_cache/documents/gmailpostmastertools.v1.json
@@ -265,7 +265,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://gmailpostmastertools.googleapis.com/",
   "schemas": {
     "DeliveryError": {
diff --git a/googleapiclient/discovery_cache/documents/gmailpostmastertools.v1beta1.json b/googleapiclient/discovery_cache/documents/gmailpostmastertools.v1beta1.json
index 78428cc..bac7387 100644
--- a/googleapiclient/discovery_cache/documents/gmailpostmastertools.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/gmailpostmastertools.v1beta1.json
@@ -265,7 +265,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://gmailpostmastertools.googleapis.com/",
   "schemas": {
     "DeliveryError": {
diff --git a/googleapiclient/discovery_cache/documents/groupssettings.v1.json b/googleapiclient/discovery_cache/documents/groupssettings.v1.json
index e5fc517..f369209 100644
--- a/googleapiclient/discovery_cache/documents/groupssettings.v1.json
+++ b/googleapiclient/discovery_cache/documents/groupssettings.v1.json
@@ -152,7 +152,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210727",
   "rootUrl": "https://www.googleapis.com/",
   "schemas": {
     "Groups": {
diff --git a/googleapiclient/discovery_cache/documents/homegraph.v1.json b/googleapiclient/discovery_cache/documents/homegraph.v1.json
index b25d5d2..a7ff32f 100644
--- a/googleapiclient/discovery_cache/documents/homegraph.v1.json
+++ b/googleapiclient/discovery_cache/documents/homegraph.v1.json
@@ -216,7 +216,7 @@
       }
     }
   },
-  "revision": "20210720",
+  "revision": "20210728",
   "rootUrl": "https://homegraph.googleapis.com/",
   "schemas": {
     "AgentDeviceId": {
diff --git a/googleapiclient/discovery_cache/documents/iam.v1.json b/googleapiclient/discovery_cache/documents/iam.v1.json
index fe57b81..f28a54c 100644
--- a/googleapiclient/discovery_cache/documents/iam.v1.json
+++ b/googleapiclient/discovery_cache/documents/iam.v1.json
@@ -1696,7 +1696,7 @@
       }
     }
   },
-  "revision": "20210714",
+  "revision": "20210722",
   "rootUrl": "https://iam.googleapis.com/",
   "schemas": {
     "AdminAuditData": {
@@ -2668,7 +2668,7 @@
       "id": "SignJwtRequest",
       "properties": {
         "payload": {
-          "description": "Required. Deprecated. [Migrate to Service Account Credentials API](https://cloud.google.com/iam/help/credentials/migrate-api). The JWT payload to sign. Must be a serialized JSON object that contains a JWT Claims Set. For example: `{\"sub\": \"user@example.com\", \"iat\": 313435}` If the JWT Claims Set contains an expiration time (`exp`) claim, it must be an integer timestamp that is not in the past and no more than 1 hour in the future. If the JWT Claims Set does not contain an expiration time (`exp`) claim, this claim is added automatically, with a timestamp that is 1 hour in the future.",
+          "description": "Required. Deprecated. [Migrate to Service Account Credentials API](https://cloud.google.com/iam/help/credentials/migrate-api). The JWT payload to sign. Must be a serialized JSON object that contains a JWT Claims Set. For example: `{\"sub\": \"user@example.com\", \"iat\": 313435}` If the JWT Claims Set contains an expiration time (`exp`) claim, it must be an integer timestamp that is not in the past and no more than 12 hours in the future. If the JWT Claims Set does not contain an expiration time (`exp`) claim, this claim is added automatically, with a timestamp that is 1 hour in the future.",
           "type": "string"
         }
       },
diff --git a/googleapiclient/discovery_cache/documents/iamcredentials.v1.json b/googleapiclient/discovery_cache/documents/iamcredentials.v1.json
index b4c5679..233ddbb 100644
--- a/googleapiclient/discovery_cache/documents/iamcredentials.v1.json
+++ b/googleapiclient/discovery_cache/documents/iamcredentials.v1.json
@@ -226,7 +226,7 @@
       }
     }
   },
-  "revision": "20210716",
+  "revision": "20210726",
   "rootUrl": "https://iamcredentials.googleapis.com/",
   "schemas": {
     "GenerateAccessTokenRequest": {
diff --git a/googleapiclient/discovery_cache/documents/iap.v1.json b/googleapiclient/discovery_cache/documents/iap.v1.json
index 801146d..6952f01 100644
--- a/googleapiclient/discovery_cache/documents/iap.v1.json
+++ b/googleapiclient/discovery_cache/documents/iap.v1.json
@@ -487,7 +487,7 @@
       }
     }
   },
-  "revision": "20210716",
+  "revision": "20210723",
   "rootUrl": "https://iap.googleapis.com/",
   "schemas": {
     "AccessDeniedPageSettings": {
diff --git a/googleapiclient/discovery_cache/documents/iap.v1beta1.json b/googleapiclient/discovery_cache/documents/iap.v1beta1.json
index f0823b8..01ed94f 100644
--- a/googleapiclient/discovery_cache/documents/iap.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/iap.v1beta1.json
@@ -194,7 +194,7 @@
       }
     }
   },
-  "revision": "20210716",
+  "revision": "20210723",
   "rootUrl": "https://iap.googleapis.com/",
   "schemas": {
     "Binding": {
diff --git a/googleapiclient/discovery_cache/documents/ideahub.v1alpha.json b/googleapiclient/discovery_cache/documents/ideahub.v1alpha.json
index 5fb85ea..9bff8a5 100644
--- a/googleapiclient/discovery_cache/documents/ideahub.v1alpha.json
+++ b/googleapiclient/discovery_cache/documents/ideahub.v1alpha.json
@@ -371,7 +371,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://ideahub.googleapis.com/",
   "schemas": {
     "GoogleSearchIdeahubV1alphaAvailableLocale": {
@@ -415,7 +415,7 @@
       "description": "An idea activity entry.",
       "id": "GoogleSearchIdeahubV1alphaIdeaActivity",
       "properties": {
-        "ideaIds": {
+        "ideas": {
           "description": "The Idea IDs for this entry.",
           "items": {
             "type": "string"
@@ -426,7 +426,7 @@
           "description": "Unique identifier for the idea activity. Format: platforms/{platform}/properties/{property}/ideaActivities/{idea_activity}",
           "type": "string"
         },
-        "topicIds": {
+        "topics": {
           "description": "The Topic IDs for this entry.",
           "items": {
             "type": "string"
@@ -521,6 +521,10 @@
         "mid": {
           "description": "The mID of the topic.",
           "type": "string"
+        },
+        "name": {
+          "description": "Unique identifier for the topic. Format: topics/{topic}",
+          "type": "string"
         }
       },
       "type": "object"
diff --git a/googleapiclient/discovery_cache/documents/indexing.v3.json b/googleapiclient/discovery_cache/documents/indexing.v3.json
index a66c2ad..d643427 100644
--- a/googleapiclient/discovery_cache/documents/indexing.v3.json
+++ b/googleapiclient/discovery_cache/documents/indexing.v3.json
@@ -149,7 +149,7 @@
       }
     }
   },
-  "revision": "20210713",
+  "revision": "20210720",
   "rootUrl": "https://indexing.googleapis.com/",
   "schemas": {
     "PublishUrlNotificationResponse": {
diff --git a/googleapiclient/discovery_cache/documents/jobs.v3.json b/googleapiclient/discovery_cache/documents/jobs.v3.json
index 4c6bb1e..952b092 100644
--- a/googleapiclient/discovery_cache/documents/jobs.v3.json
+++ b/googleapiclient/discovery_cache/documents/jobs.v3.json
@@ -508,7 +508,7 @@
               ],
               "parameters": {
                 "filter": {
-                  "description": "Required. The filter string specifies the jobs to be enumerated. Supported operator: =, AND The fields eligible for filtering are: * `companyName` (Required) * `requisitionId` (Optional) Sample Query: * companyName = \"projects/api-test-project/companies/123\" * companyName = \"projects/api-test-project/companies/123\" AND requisitionId = \"req-1\"",
+                  "description": "Required. The filter string specifies the jobs to be enumerated. Supported operator: =, AND The fields eligible for filtering are: * `companyName` * `requisitionId` * `status` Available values: OPEN, EXPIRED, ALL. Defaults to OPEN if no value is specified. At least one of `companyName` and `requisitionId` must present or an INVALID_ARGUMENT error is thrown. Sample Query: * companyName = \"projects/api-test-project/companies/123\" * companyName = \"projects/api-test-project/companies/123\" AND requisitionId = \"req-1\" * companyName = \"projects/api-test-project/companies/123\" AND status = \"EXPIRED\" * requisitionId = \"req-1\" * requisitionId = \"req-1\" AND status = \"EXPIRED\"",
                   "location": "query",
                   "type": "string"
                 },
@@ -651,7 +651,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210722",
   "rootUrl": "https://jobs.googleapis.com/",
   "schemas": {
     "ApplicationInfo": {
diff --git a/googleapiclient/discovery_cache/documents/jobs.v3p1beta1.json b/googleapiclient/discovery_cache/documents/jobs.v3p1beta1.json
index e1e86d8..df45caf 100644
--- a/googleapiclient/discovery_cache/documents/jobs.v3p1beta1.json
+++ b/googleapiclient/discovery_cache/documents/jobs.v3p1beta1.json
@@ -508,7 +508,7 @@
               ],
               "parameters": {
                 "filter": {
-                  "description": "Required. The filter string specifies the jobs to be enumerated. Supported operator: =, AND The fields eligible for filtering are: * `companyName` (Required) * `requisitionId` (Optional) Sample Query: * companyName = \"projects/api-test-project/companies/123\" * companyName = \"projects/api-test-project/companies/123\" AND requisitionId = \"req-1\"",
+                  "description": "Required. The filter string specifies the jobs to be enumerated. Supported operator: =, AND The fields eligible for filtering are: * `companyName` * `requisitionId` * `status` Available values: OPEN, EXPIRED, ALL. Defaults to OPEN if no value is specified. At least one of `companyName` and `requisitionId` must present or an INVALID_ARGUMENT error is thrown. Sample Query: * companyName = \"projects/api-test-project/companies/123\" * companyName = \"projects/api-test-project/companies/123\" AND requisitionId = \"req-1\" * companyName = \"projects/api-test-project/companies/123\" AND status = \"EXPIRED\" * requisitionId = \"req-1\" * requisitionId = \"req-1\" AND status = \"EXPIRED\"",
                   "location": "query",
                   "type": "string"
                 },
@@ -681,7 +681,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210722",
   "rootUrl": "https://jobs.googleapis.com/",
   "schemas": {
     "ApplicationInfo": {
diff --git a/googleapiclient/discovery_cache/documents/jobs.v4.json b/googleapiclient/discovery_cache/documents/jobs.v4.json
index 6e4659d..2cd1095 100644
--- a/googleapiclient/discovery_cache/documents/jobs.v4.json
+++ b/googleapiclient/discovery_cache/documents/jobs.v4.json
@@ -752,7 +752,7 @@
                   ],
                   "parameters": {
                     "filter": {
-                      "description": "Required. The filter string specifies the jobs to be enumerated. Supported operator: =, AND The fields eligible for filtering are: * `companyName` (Required) * `requisitionId` * `status` Available values: OPEN, EXPIRED, ALL. Defaults to OPEN if no value is specified. Sample Query: * companyName = \"projects/foo/tenants/bar/companies/baz\" * companyName = \"projects/foo/tenants/bar/companies/baz\" AND requisitionId = \"req-1\" * companyName = \"projects/foo/tenants/bar/companies/baz\" AND status = \"EXPIRED\"",
+                      "description": "Required. The filter string specifies the jobs to be enumerated. Supported operator: =, AND The fields eligible for filtering are: * `companyName` * `requisitionId` * `status` Available values: OPEN, EXPIRED, ALL. Defaults to OPEN if no value is specified. At least one of `companyName` and `requisitionId` must present or an INVALID_ARGUMENT error is thrown. Sample Query: * companyName = \"projects/foo/tenants/bar/companies/baz\" * companyName = \"projects/foo/tenants/bar/companies/baz\" AND requisitionId = \"req-1\" * companyName = \"projects/foo/tenants/bar/companies/baz\" AND status = \"EXPIRED\" * requisitionId = \"req-1\" * requisitionId = \"req-1\" AND status = \"EXPIRED\"",
                       "location": "query",
                       "type": "string"
                     },
@@ -903,7 +903,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210722",
   "rootUrl": "https://jobs.googleapis.com/",
   "schemas": {
     "ApplicationInfo": {
@@ -1124,12 +1124,18 @@
           "enum": [
             "COMMUTE_METHOD_UNSPECIFIED",
             "DRIVING",
-            "TRANSIT"
+            "TRANSIT",
+            "WALKING",
+            "CYCLING",
+            "TRANSIT_ACCESSIBLE"
           ],
           "enumDescriptions": [
             "Commute method isn't specified.",
             "Commute time is calculated based on driving time.",
-            "Commute time is calculated based on public transit including bus, metro, subway, and so on."
+            "Commute time is calculated based on public transit including bus, metro, subway, and so on.",
+            "Commute time is calculated based on walking time.",
+            "Commute time is calculated based on biking time.",
+            "Commute time is calculated based on public transit that is wheelchair accessible."
           ],
           "type": "string"
         },
diff --git a/googleapiclient/discovery_cache/documents/keep.v1.json b/googleapiclient/discovery_cache/documents/keep.v1.json
index 13701ea..3f0246c 100644
--- a/googleapiclient/discovery_cache/documents/keep.v1.json
+++ b/googleapiclient/discovery_cache/documents/keep.v1.json
@@ -314,7 +314,7 @@
       }
     }
   },
-  "revision": "20210720",
+  "revision": "20210727",
   "rootUrl": "https://keep.googleapis.com/",
   "schemas": {
     "Attachment": {
diff --git a/googleapiclient/discovery_cache/documents/language.v1.json b/googleapiclient/discovery_cache/documents/language.v1.json
index 35f1bcc..8166758 100644
--- a/googleapiclient/discovery_cache/documents/language.v1.json
+++ b/googleapiclient/discovery_cache/documents/language.v1.json
@@ -227,7 +227,7 @@
       }
     }
   },
-  "revision": "20210717",
+  "revision": "20210731",
   "rootUrl": "https://language.googleapis.com/",
   "schemas": {
     "AnalyzeEntitiesRequest": {
diff --git a/googleapiclient/discovery_cache/documents/language.v1beta1.json b/googleapiclient/discovery_cache/documents/language.v1beta1.json
index df36603..a99c201 100644
--- a/googleapiclient/discovery_cache/documents/language.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/language.v1beta1.json
@@ -189,7 +189,7 @@
       }
     }
   },
-  "revision": "20210717",
+  "revision": "20210731",
   "rootUrl": "https://language.googleapis.com/",
   "schemas": {
     "AnalyzeEntitiesRequest": {
diff --git a/googleapiclient/discovery_cache/documents/language.v1beta2.json b/googleapiclient/discovery_cache/documents/language.v1beta2.json
index 8186e53..43e0496 100644
--- a/googleapiclient/discovery_cache/documents/language.v1beta2.json
+++ b/googleapiclient/discovery_cache/documents/language.v1beta2.json
@@ -227,7 +227,7 @@
       }
     }
   },
-  "revision": "20210717",
+  "revision": "20210731",
   "rootUrl": "https://language.googleapis.com/",
   "schemas": {
     "AnalyzeEntitiesRequest": {
diff --git a/googleapiclient/discovery_cache/documents/libraryagent.v1.json b/googleapiclient/discovery_cache/documents/libraryagent.v1.json
index 7844635..7efbeaf 100644
--- a/googleapiclient/discovery_cache/documents/libraryagent.v1.json
+++ b/googleapiclient/discovery_cache/documents/libraryagent.v1.json
@@ -279,7 +279,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://libraryagent.googleapis.com/",
   "schemas": {
     "GoogleExampleLibraryagentV1Book": {
diff --git a/googleapiclient/discovery_cache/documents/licensing.v1.json b/googleapiclient/discovery_cache/documents/licensing.v1.json
index edb04a7..8e8cba7 100644
--- a/googleapiclient/discovery_cache/documents/licensing.v1.json
+++ b/googleapiclient/discovery_cache/documents/licensing.v1.json
@@ -400,7 +400,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210726",
   "rootUrl": "https://licensing.googleapis.com/",
   "schemas": {
     "Empty": {
diff --git a/googleapiclient/discovery_cache/documents/lifesciences.v2beta.json b/googleapiclient/discovery_cache/documents/lifesciences.v2beta.json
index 0c0ded1..bb1874d 100644
--- a/googleapiclient/discovery_cache/documents/lifesciences.v2beta.json
+++ b/googleapiclient/discovery_cache/documents/lifesciences.v2beta.json
@@ -312,7 +312,7 @@
       }
     }
   },
-  "revision": "20210709",
+  "revision": "20210723",
   "rootUrl": "https://lifesciences.googleapis.com/",
   "schemas": {
     "Accelerator": {
diff --git a/googleapiclient/discovery_cache/documents/localservices.v1.json b/googleapiclient/discovery_cache/documents/localservices.v1.json
index 1f005bf..e7f80ac 100644
--- a/googleapiclient/discovery_cache/documents/localservices.v1.json
+++ b/googleapiclient/discovery_cache/documents/localservices.v1.json
@@ -250,7 +250,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://localservices.googleapis.com/",
   "schemas": {
     "GoogleAdsHomeservicesLocalservicesV1AccountReport": {
diff --git a/googleapiclient/discovery_cache/documents/logging.v2.json b/googleapiclient/discovery_cache/documents/logging.v2.json
index aaf3245..f3d43bd 100644
--- a/googleapiclient/discovery_cache/documents/logging.v2.json
+++ b/googleapiclient/discovery_cache/documents/logging.v2.json
@@ -5482,7 +5482,7 @@
       }
     }
   },
-  "revision": "20210714",
+  "revision": "20210723",
   "rootUrl": "https://logging.googleapis.com/",
   "schemas": {
     "BigQueryOptions": {
diff --git a/googleapiclient/discovery_cache/documents/manufacturers.v1.json b/googleapiclient/discovery_cache/documents/manufacturers.v1.json
index e62e66b..51e0ab8 100644
--- a/googleapiclient/discovery_cache/documents/manufacturers.v1.json
+++ b/googleapiclient/discovery_cache/documents/manufacturers.v1.json
@@ -287,7 +287,7 @@
       }
     }
   },
-  "revision": "20210721",
+  "revision": "20210728",
   "rootUrl": "https://manufacturers.googleapis.com/",
   "schemas": {
     "Attributes": {
diff --git a/googleapiclient/discovery_cache/documents/metastore.v1alpha.json b/googleapiclient/discovery_cache/documents/metastore.v1alpha.json
index a0e9c9a..bd35356 100644
--- a/googleapiclient/discovery_cache/documents/metastore.v1alpha.json
+++ b/googleapiclient/discovery_cache/documents/metastore.v1alpha.json
@@ -986,7 +986,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210721",
   "rootUrl": "https://metastore.googleapis.com/",
   "schemas": {
     "AuditConfig": {
@@ -1061,6 +1061,14 @@
           "description": "Immutable. The relative resource name of the backup, in the following form:projects/{project_number}/locations/{location_id}/services/{service_id}/backups/{backup_id}",
           "type": "string"
         },
+        "restoringServices": {
+          "description": "Output only. Services that are restoring from the backup.",
+          "items": {
+            "type": "string"
+          },
+          "readOnly": true,
+          "type": "array"
+        },
         "serviceRevision": {
           "$ref": "Service",
           "description": "Output only. The revision of the service at the time of backup.",
diff --git a/googleapiclient/discovery_cache/documents/metastore.v1beta.json b/googleapiclient/discovery_cache/documents/metastore.v1beta.json
index 39018e9..7e83c67 100644
--- a/googleapiclient/discovery_cache/documents/metastore.v1beta.json
+++ b/googleapiclient/discovery_cache/documents/metastore.v1beta.json
@@ -986,7 +986,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210721",
   "rootUrl": "https://metastore.googleapis.com/",
   "schemas": {
     "AuditConfig": {
@@ -1061,6 +1061,14 @@
           "description": "Immutable. The relative resource name of the backup, in the following form:projects/{project_number}/locations/{location_id}/services/{service_id}/backups/{backup_id}",
           "type": "string"
         },
+        "restoringServices": {
+          "description": "Output only. Services that are restoring from the backup.",
+          "items": {
+            "type": "string"
+          },
+          "readOnly": true,
+          "type": "array"
+        },
         "serviceRevision": {
           "$ref": "Service",
           "description": "Output only. The revision of the service at the time of backup.",
diff --git a/googleapiclient/discovery_cache/documents/ml.v1.json b/googleapiclient/discovery_cache/documents/ml.v1.json
index 7d73a39..b92e8ab 100644
--- a/googleapiclient/discovery_cache/documents/ml.v1.json
+++ b/googleapiclient/discovery_cache/documents/ml.v1.json
@@ -1486,7 +1486,7 @@
       }
     }
   },
-  "revision": "20210720",
+  "revision": "20210729",
   "rootUrl": "https://ml.googleapis.com/",
   "schemas": {
     "GoogleApi__HttpBody": {
@@ -2255,7 +2255,7 @@
           "additionalProperties": {
             "type": "string"
           },
-          "description": "The web URIs for the training job. Currently for debug terminal access to the job. Only set for in-progress hyperparameter tuning trials with web access enabled.",
+          "description": "URIs for accessing [interactive shells](https://cloud.google.com/ai-platform/training/docs/monitor-debug-interactive-shell) (one URI for each training node). Only available if this trial is part of a hyperparameter tuning job and the job's training_input.enable_web_access is `true`. The keys are names of each node in the training job; for example, `master-replica-0` for the master node, `worker-replica-0` for the first worker, and `ps-replica-0` for the first parameter server. The values are the URIs for each node's interactive shell.",
           "type": "object"
         }
       },
@@ -3224,7 +3224,7 @@
           "type": "array"
         },
         "enableWebAccess": {
-          "description": "Optional. Whether to enable web access for the training job.",
+          "description": "Optional. Whether you want AI Platform Training to enable [interactive shell access](https://cloud.google.com/ai-platform/training/docs/monitor-debug-interactive-shell) to training containers. If set to `true`, you can access interactive shells at the URIs given by TrainingOutput.web_access_uris or HyperparameterOutput.web_access_uris (within TrainingOutput.trials).",
           "type": "boolean"
         },
         "encryptionConfig": {
@@ -3389,7 +3389,7 @@
           "additionalProperties": {
             "type": "string"
           },
-          "description": "Output only. The web URIs for the training job. Currently for debug terminal access to the job.",
+          "description": "Output only. URIs for accessing [interactive shells](https://cloud.google.com/ai-platform/training/docs/monitor-debug-interactive-shell) (one URI for each training node). Only available if training_input.enable_web_access is `true`. The keys are names of each node in the training job; for example, `master-replica-0` for the master node, `worker-replica-0` for the first worker, and `ps-replica-0` for the first parameter server. The values are the URIs for each node's interactive shell.",
           "readOnly": true,
           "type": "object"
         }
diff --git a/googleapiclient/discovery_cache/documents/monitoring.v1.json b/googleapiclient/discovery_cache/documents/monitoring.v1.json
index b66e4d6..297fef0 100644
--- a/googleapiclient/discovery_cache/documents/monitoring.v1.json
+++ b/googleapiclient/discovery_cache/documents/monitoring.v1.json
@@ -147,11 +147,11 @@
                     "https://www.googleapis.com/auth/monitoring.read"
                   ]
                 },
-                "listMetricScopesByMonitoredProject": {
+                "listMetricsScopesByMonitoredProject": {
                   "description": "Returns a list of every Metrics Scope that a specific MonitoredProject has been added to. The metrics scope representing the specified monitored project will always be the first entry in the response.",
-                  "flatPath": "v1/locations/global/metricsScopes:listMetricScopesByMonitoredProject",
+                  "flatPath": "v1/locations/global/metricsScopes:listMetricsScopesByMonitoredProject",
                   "httpMethod": "GET",
-                  "id": "monitoring.locations.global.metricsScopes.listMetricScopesByMonitoredProject",
+                  "id": "monitoring.locations.global.metricsScopes.listMetricsScopesByMonitoredProject",
                   "parameterOrder": [],
                   "parameters": {
                     "monitoredResourceContainer": {
@@ -160,7 +160,7 @@
                       "type": "string"
                     }
                   },
-                  "path": "v1/locations/global/metricsScopes:listMetricScopesByMonitoredProject",
+                  "path": "v1/locations/global/metricsScopes:listMetricsScopesByMonitoredProject",
                   "response": {
                     "$ref": "ListMetricsScopesByMonitoredProjectResponse"
                   },
@@ -441,7 +441,7 @@
       }
     }
   },
-  "revision": "20210720",
+  "revision": "20210727",
   "rootUrl": "https://monitoring.googleapis.com/",
   "schemas": {
     "Aggregation": {
diff --git a/googleapiclient/discovery_cache/documents/monitoring.v3.json b/googleapiclient/discovery_cache/documents/monitoring.v3.json
index 9c5dd6f..9349ecc 100644
--- a/googleapiclient/discovery_cache/documents/monitoring.v3.json
+++ b/googleapiclient/discovery_cache/documents/monitoring.v3.json
@@ -2541,7 +2541,7 @@
       }
     }
   },
-  "revision": "20210720",
+  "revision": "20210727",
   "rootUrl": "https://monitoring.googleapis.com/",
   "schemas": {
     "Aggregation": {
diff --git a/googleapiclient/discovery_cache/documents/mybusinessaccountmanagement.v1.json b/googleapiclient/discovery_cache/documents/mybusinessaccountmanagement.v1.json
index cb27e6a..b6e3620 100644
--- a/googleapiclient/discovery_cache/documents/mybusinessaccountmanagement.v1.json
+++ b/googleapiclient/discovery_cache/documents/mybusinessaccountmanagement.v1.json
@@ -530,7 +530,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://mybusinessaccountmanagement.googleapis.com/",
   "schemas": {
     "AcceptInvitationRequest": {
diff --git a/googleapiclient/discovery_cache/documents/mybusinesslodging.v1.json b/googleapiclient/discovery_cache/documents/mybusinesslodging.v1.json
index 2fe0a4f..f594486 100644
--- a/googleapiclient/discovery_cache/documents/mybusinesslodging.v1.json
+++ b/googleapiclient/discovery_cache/documents/mybusinesslodging.v1.json
@@ -194,7 +194,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://mybusinesslodging.googleapis.com/",
   "schemas": {
     "Accessibility": {
diff --git a/googleapiclient/discovery_cache/documents/mybusinessnotifications.v1.json b/googleapiclient/discovery_cache/documents/mybusinessnotifications.v1.json
index a3ec63c..201f036 100644
--- a/googleapiclient/discovery_cache/documents/mybusinessnotifications.v1.json
+++ b/googleapiclient/discovery_cache/documents/mybusinessnotifications.v1.json
@@ -154,7 +154,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://mybusinessnotifications.googleapis.com/",
   "schemas": {
     "NotificationSetting": {
diff --git a/googleapiclient/discovery_cache/documents/mybusinessplaceactions.v1.json b/googleapiclient/discovery_cache/documents/mybusinessplaceactions.v1.json
index f0f7447..4d92b37 100644
--- a/googleapiclient/discovery_cache/documents/mybusinessplaceactions.v1.json
+++ b/googleapiclient/discovery_cache/documents/mybusinessplaceactions.v1.json
@@ -281,7 +281,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://mybusinessplaceactions.googleapis.com/",
   "schemas": {
     "Empty": {
diff --git a/googleapiclient/discovery_cache/documents/networkmanagement.v1.json b/googleapiclient/discovery_cache/documents/networkmanagement.v1.json
index f473527..bba5a7c 100644
--- a/googleapiclient/discovery_cache/documents/networkmanagement.v1.json
+++ b/googleapiclient/discovery_cache/documents/networkmanagement.v1.json
@@ -591,7 +591,7 @@
       }
     }
   },
-  "revision": "20210624",
+  "revision": "20210721",
   "rootUrl": "https://networkmanagement.googleapis.com/",
   "schemas": {
     "AbortInfo": {
@@ -1625,7 +1625,8 @@
             "NEXT_HOP_VPN_GATEWAY",
             "NEXT_HOP_INTERNET_GATEWAY",
             "NEXT_HOP_BLACKHOLE",
-            "NEXT_HOP_ILB"
+            "NEXT_HOP_ILB",
+            "NEXT_HOP_ROUTER_APPLIANCE"
           ],
           "enumDescriptions": [
             "Unspecified type. Default value.",
@@ -1638,7 +1639,8 @@
             "Next hop is a VPN gateway. This scenario only happens when tracing connectivity from an on-premises network to Google Cloud through a VPN. The analysis simulates a packet departing from the on-premises network through a VPN tunnel and arriving at a Cloud VPN gateway.",
             "Next hop is an internet gateway.",
             "Next hop is blackhole; that is, the next hop either does not exist or is not running.",
-            "Next hop is the forwarding rule of an Internal Load Balancer."
+            "Next hop is the forwarding rule of an Internal Load Balancer.",
+            "Next hop is a [router appliance instance](https://cloud.google.com/network-connectivity/docs/network-connectivity-center/concepts/ra-overview)."
           ],
           "type": "string"
         },
diff --git a/googleapiclient/discovery_cache/documents/networksecurity.v1beta1.json b/googleapiclient/discovery_cache/documents/networksecurity.v1beta1.json
index 1430c85..982dde0 100644
--- a/googleapiclient/discovery_cache/documents/networksecurity.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/networksecurity.v1beta1.json
@@ -1037,7 +1037,7 @@
       }
     }
   },
-  "revision": "20210709",
+  "revision": "20210721",
   "rootUrl": "https://networksecurity.googleapis.com/",
   "schemas": {
     "AuthorizationPolicy": {
diff --git a/googleapiclient/discovery_cache/documents/networkservices.v1.json b/googleapiclient/discovery_cache/documents/networkservices.v1.json
new file mode 100644
index 0000000..48dd901
--- /dev/null
+++ b/googleapiclient/discovery_cache/documents/networkservices.v1.json
@@ -0,0 +1,945 @@
+{
+  "auth": {
+    "oauth2": {
+      "scopes": {
+        "https://www.googleapis.com/auth/cloud-platform": {
+          "description": "See, edit, configure, and delete your Google Cloud Platform data"
+        }
+      }
+    }
+  },
+  "basePath": "",
+  "baseUrl": "https://networkservices.googleapis.com/",
+  "batchPath": "batch",
+  "canonicalName": "NetworkServices",
+  "description": "",
+  "discoveryVersion": "v1",
+  "documentationLink": "https://cloud.google.com/networking",
+  "fullyEncodeReservedExpansion": true,
+  "icons": {
+    "x16": "http://www.google.com/images/icons/product/search-16.gif",
+    "x32": "http://www.google.com/images/icons/product/search-32.gif"
+  },
+  "id": "networkservices:v1",
+  "kind": "discovery#restDescription",
+  "mtlsRootUrl": "https://networkservices.mtls.googleapis.com/",
+  "name": "networkservices",
+  "ownerDomain": "google.com",
+  "ownerName": "Google",
+  "parameters": {
+    "$.xgafv": {
+      "description": "V1 error format.",
+      "enum": [
+        "1",
+        "2"
+      ],
+      "enumDescriptions": [
+        "v1 error format",
+        "v2 error format"
+      ],
+      "location": "query",
+      "type": "string"
+    },
+    "access_token": {
+      "description": "OAuth access token.",
+      "location": "query",
+      "type": "string"
+    },
+    "alt": {
+      "default": "json",
+      "description": "Data format for response.",
+      "enum": [
+        "json",
+        "media",
+        "proto"
+      ],
+      "enumDescriptions": [
+        "Responses with Content-Type of application/json",
+        "Media download with context-dependent Content-Type",
+        "Responses with Content-Type of application/x-protobuf"
+      ],
+      "location": "query",
+      "type": "string"
+    },
+    "callback": {
+      "description": "JSONP",
+      "location": "query",
+      "type": "string"
+    },
+    "fields": {
+      "description": "Selector specifying which fields to include in a partial response.",
+      "location": "query",
+      "type": "string"
+    },
+    "key": {
+      "description": "API key. Your API key identifies your project and provides you with API access, quota, and reports. Required unless you provide an OAuth 2.0 token.",
+      "location": "query",
+      "type": "string"
+    },
+    "oauth_token": {
+      "description": "OAuth 2.0 token for the current user.",
+      "location": "query",
+      "type": "string"
+    },
+    "prettyPrint": {
+      "default": "true",
+      "description": "Returns response with indentations and line breaks.",
+      "location": "query",
+      "type": "boolean"
+    },
+    "quotaUser": {
+      "description": "Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters.",
+      "location": "query",
+      "type": "string"
+    },
+    "uploadType": {
+      "description": "Legacy upload protocol for media (e.g. \"media\", \"multipart\").",
+      "location": "query",
+      "type": "string"
+    },
+    "upload_protocol": {
+      "description": "Upload protocol for media (e.g. \"raw\", \"multipart\").",
+      "location": "query",
+      "type": "string"
+    }
+  },
+  "protocol": "rest",
+  "resources": {
+    "projects": {
+      "resources": {
+        "locations": {
+          "methods": {
+            "get": {
+              "description": "Gets information about a location.",
+              "flatPath": "v1/projects/{projectsId}/locations/{locationsId}",
+              "httpMethod": "GET",
+              "id": "networkservices.projects.locations.get",
+              "parameterOrder": [
+                "name"
+              ],
+              "parameters": {
+                "name": {
+                  "description": "Resource name for the location.",
+                  "location": "path",
+                  "pattern": "^projects/[^/]+/locations/[^/]+$",
+                  "required": true,
+                  "type": "string"
+                }
+              },
+              "path": "v1/{+name}",
+              "response": {
+                "$ref": "Location"
+              },
+              "scopes": [
+                "https://www.googleapis.com/auth/cloud-platform"
+              ]
+            },
+            "list": {
+              "description": "Lists information about the supported locations for this service.",
+              "flatPath": "v1/projects/{projectsId}/locations",
+              "httpMethod": "GET",
+              "id": "networkservices.projects.locations.list",
+              "parameterOrder": [
+                "name"
+              ],
+              "parameters": {
+                "filter": {
+                  "description": "A filter to narrow down results to a preferred subset. The filtering language accepts strings like \"displayName=tokyo\", and is documented in more detail in [AIP-160](https://google.aip.dev/160).",
+                  "location": "query",
+                  "type": "string"
+                },
+                "name": {
+                  "description": "The resource that owns the locations collection, if applicable.",
+                  "location": "path",
+                  "pattern": "^projects/[^/]+$",
+                  "required": true,
+                  "type": "string"
+                },
+                "pageSize": {
+                  "description": "The maximum number of results to return. If not set, the service selects a default.",
+                  "format": "int32",
+                  "location": "query",
+                  "type": "integer"
+                },
+                "pageToken": {
+                  "description": "A page token received from the `next_page_token` field in the response. Send that page token to receive the subsequent page.",
+                  "location": "query",
+                  "type": "string"
+                }
+              },
+              "path": "v1/{+name}/locations",
+              "response": {
+                "$ref": "ListLocationsResponse"
+              },
+              "scopes": [
+                "https://www.googleapis.com/auth/cloud-platform"
+              ]
+            }
+          },
+          "resources": {
+            "edgeCacheKeysets": {
+              "methods": {
+                "getIamPolicy": {
+                  "description": "Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.",
+                  "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/edgeCacheKeysets/{edgeCacheKeysetsId}:getIamPolicy",
+                  "httpMethod": "GET",
+                  "id": "networkservices.projects.locations.edgeCacheKeysets.getIamPolicy",
+                  "parameterOrder": [
+                    "resource"
+                  ],
+                  "parameters": {
+                    "options.requestedPolicyVersion": {
+                      "description": "Optional. The policy format version to be returned. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Requests for policies with any conditional bindings must specify version 3. Policies without any conditional bindings may specify any valid value or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).",
+                      "format": "int32",
+                      "location": "query",
+                      "type": "integer"
+                    },
+                    "resource": {
+                      "description": "REQUIRED: The resource for which the policy is being requested. See the operation documentation for the appropriate value for this field.",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+/edgeCacheKeysets/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1/{+resource}:getIamPolicy",
+                  "response": {
+                    "$ref": "Policy"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                },
+                "setIamPolicy": {
+                  "description": "Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.",
+                  "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/edgeCacheKeysets/{edgeCacheKeysetsId}:setIamPolicy",
+                  "httpMethod": "POST",
+                  "id": "networkservices.projects.locations.edgeCacheKeysets.setIamPolicy",
+                  "parameterOrder": [
+                    "resource"
+                  ],
+                  "parameters": {
+                    "resource": {
+                      "description": "REQUIRED: The resource for which the policy is being specified. See the operation documentation for the appropriate value for this field.",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+/edgeCacheKeysets/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1/{+resource}:setIamPolicy",
+                  "request": {
+                    "$ref": "SetIamPolicyRequest"
+                  },
+                  "response": {
+                    "$ref": "Policy"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                },
+                "testIamPermissions": {
+                  "description": "Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may \"fail open\" without warning.",
+                  "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/edgeCacheKeysets/{edgeCacheKeysetsId}:testIamPermissions",
+                  "httpMethod": "POST",
+                  "id": "networkservices.projects.locations.edgeCacheKeysets.testIamPermissions",
+                  "parameterOrder": [
+                    "resource"
+                  ],
+                  "parameters": {
+                    "resource": {
+                      "description": "REQUIRED: The resource for which the policy detail is being requested. See the operation documentation for the appropriate value for this field.",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+/edgeCacheKeysets/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1/{+resource}:testIamPermissions",
+                  "request": {
+                    "$ref": "TestIamPermissionsRequest"
+                  },
+                  "response": {
+                    "$ref": "TestIamPermissionsResponse"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                }
+              }
+            },
+            "edgeCacheOrigins": {
+              "methods": {
+                "getIamPolicy": {
+                  "description": "Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.",
+                  "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/edgeCacheOrigins/{edgeCacheOriginsId}:getIamPolicy",
+                  "httpMethod": "GET",
+                  "id": "networkservices.projects.locations.edgeCacheOrigins.getIamPolicy",
+                  "parameterOrder": [
+                    "resource"
+                  ],
+                  "parameters": {
+                    "options.requestedPolicyVersion": {
+                      "description": "Optional. The policy format version to be returned. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Requests for policies with any conditional bindings must specify version 3. Policies without any conditional bindings may specify any valid value or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).",
+                      "format": "int32",
+                      "location": "query",
+                      "type": "integer"
+                    },
+                    "resource": {
+                      "description": "REQUIRED: The resource for which the policy is being requested. See the operation documentation for the appropriate value for this field.",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+/edgeCacheOrigins/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1/{+resource}:getIamPolicy",
+                  "response": {
+                    "$ref": "Policy"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                },
+                "setIamPolicy": {
+                  "description": "Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.",
+                  "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/edgeCacheOrigins/{edgeCacheOriginsId}:setIamPolicy",
+                  "httpMethod": "POST",
+                  "id": "networkservices.projects.locations.edgeCacheOrigins.setIamPolicy",
+                  "parameterOrder": [
+                    "resource"
+                  ],
+                  "parameters": {
+                    "resource": {
+                      "description": "REQUIRED: The resource for which the policy is being specified. See the operation documentation for the appropriate value for this field.",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+/edgeCacheOrigins/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1/{+resource}:setIamPolicy",
+                  "request": {
+                    "$ref": "SetIamPolicyRequest"
+                  },
+                  "response": {
+                    "$ref": "Policy"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                },
+                "testIamPermissions": {
+                  "description": "Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may \"fail open\" without warning.",
+                  "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/edgeCacheOrigins/{edgeCacheOriginsId}:testIamPermissions",
+                  "httpMethod": "POST",
+                  "id": "networkservices.projects.locations.edgeCacheOrigins.testIamPermissions",
+                  "parameterOrder": [
+                    "resource"
+                  ],
+                  "parameters": {
+                    "resource": {
+                      "description": "REQUIRED: The resource for which the policy detail is being requested. See the operation documentation for the appropriate value for this field.",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+/edgeCacheOrigins/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1/{+resource}:testIamPermissions",
+                  "request": {
+                    "$ref": "TestIamPermissionsRequest"
+                  },
+                  "response": {
+                    "$ref": "TestIamPermissionsResponse"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                }
+              }
+            },
+            "edgeCacheServices": {
+              "methods": {
+                "getIamPolicy": {
+                  "description": "Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.",
+                  "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/edgeCacheServices/{edgeCacheServicesId}:getIamPolicy",
+                  "httpMethod": "GET",
+                  "id": "networkservices.projects.locations.edgeCacheServices.getIamPolicy",
+                  "parameterOrder": [
+                    "resource"
+                  ],
+                  "parameters": {
+                    "options.requestedPolicyVersion": {
+                      "description": "Optional. The policy format version to be returned. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Requests for policies with any conditional bindings must specify version 3. Policies without any conditional bindings may specify any valid value or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).",
+                      "format": "int32",
+                      "location": "query",
+                      "type": "integer"
+                    },
+                    "resource": {
+                      "description": "REQUIRED: The resource for which the policy is being requested. See the operation documentation for the appropriate value for this field.",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+/edgeCacheServices/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1/{+resource}:getIamPolicy",
+                  "response": {
+                    "$ref": "Policy"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                },
+                "setIamPolicy": {
+                  "description": "Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.",
+                  "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/edgeCacheServices/{edgeCacheServicesId}:setIamPolicy",
+                  "httpMethod": "POST",
+                  "id": "networkservices.projects.locations.edgeCacheServices.setIamPolicy",
+                  "parameterOrder": [
+                    "resource"
+                  ],
+                  "parameters": {
+                    "resource": {
+                      "description": "REQUIRED: The resource for which the policy is being specified. See the operation documentation for the appropriate value for this field.",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+/edgeCacheServices/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1/{+resource}:setIamPolicy",
+                  "request": {
+                    "$ref": "SetIamPolicyRequest"
+                  },
+                  "response": {
+                    "$ref": "Policy"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                },
+                "testIamPermissions": {
+                  "description": "Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may \"fail open\" without warning.",
+                  "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/edgeCacheServices/{edgeCacheServicesId}:testIamPermissions",
+                  "httpMethod": "POST",
+                  "id": "networkservices.projects.locations.edgeCacheServices.testIamPermissions",
+                  "parameterOrder": [
+                    "resource"
+                  ],
+                  "parameters": {
+                    "resource": {
+                      "description": "REQUIRED: The resource for which the policy detail is being requested. See the operation documentation for the appropriate value for this field.",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+/edgeCacheServices/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1/{+resource}:testIamPermissions",
+                  "request": {
+                    "$ref": "TestIamPermissionsRequest"
+                  },
+                  "response": {
+                    "$ref": "TestIamPermissionsResponse"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                }
+              }
+            },
+            "operations": {
+              "methods": {
+                "cancel": {
+                  "description": "Starts asynchronous cancellation on a long-running operation. The server makes a best effort to cancel the operation, but success is not guaranteed. If the server doesn't support this method, it returns `google.rpc.Code.UNIMPLEMENTED`. Clients can use Operations.GetOperation or other methods to check whether the cancellation succeeded or whether the operation completed despite cancellation. On successful cancellation, the operation is not deleted; instead, it becomes an operation with an Operation.error value with a google.rpc.Status.code of 1, corresponding to `Code.CANCELLED`.",
+                  "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/operations/{operationsId}:cancel",
+                  "httpMethod": "POST",
+                  "id": "networkservices.projects.locations.operations.cancel",
+                  "parameterOrder": [
+                    "name"
+                  ],
+                  "parameters": {
+                    "name": {
+                      "description": "The name of the operation resource to be cancelled.",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+/operations/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1/{+name}:cancel",
+                  "request": {
+                    "$ref": "CancelOperationRequest"
+                  },
+                  "response": {
+                    "$ref": "Empty"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                },
+                "delete": {
+                  "description": "Deletes a long-running operation. This method indicates that the client is no longer interested in the operation result. It does not cancel the operation. If the server doesn't support this method, it returns `google.rpc.Code.UNIMPLEMENTED`.",
+                  "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/operations/{operationsId}",
+                  "httpMethod": "DELETE",
+                  "id": "networkservices.projects.locations.operations.delete",
+                  "parameterOrder": [
+                    "name"
+                  ],
+                  "parameters": {
+                    "name": {
+                      "description": "The name of the operation resource to be deleted.",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+/operations/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1/{+name}",
+                  "response": {
+                    "$ref": "Empty"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                },
+                "get": {
+                  "description": "Gets the latest state of a long-running operation. Clients can use this method to poll the operation result at intervals as recommended by the API service.",
+                  "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/operations/{operationsId}",
+                  "httpMethod": "GET",
+                  "id": "networkservices.projects.locations.operations.get",
+                  "parameterOrder": [
+                    "name"
+                  ],
+                  "parameters": {
+                    "name": {
+                      "description": "The name of the operation resource.",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+/operations/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1/{+name}",
+                  "response": {
+                    "$ref": "Operation"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                },
+                "list": {
+                  "description": "Lists operations that match the specified filter in the request. If the server doesn't support this method, it returns `UNIMPLEMENTED`. NOTE: the `name` binding allows API services to override the binding to use different resource name schemes, such as `users/*/operations`. To override the binding, API services can add a binding such as `\"/v1/{name=users/*}/operations\"` to their service configuration. For backwards compatibility, the default name includes the operations collection id, however overriding users must ensure the name binding is the parent resource, without the operations collection id.",
+                  "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/operations",
+                  "httpMethod": "GET",
+                  "id": "networkservices.projects.locations.operations.list",
+                  "parameterOrder": [
+                    "name"
+                  ],
+                  "parameters": {
+                    "filter": {
+                      "description": "The standard list filter.",
+                      "location": "query",
+                      "type": "string"
+                    },
+                    "name": {
+                      "description": "The name of the operation's parent resource.",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    },
+                    "pageSize": {
+                      "description": "The standard list page size.",
+                      "format": "int32",
+                      "location": "query",
+                      "type": "integer"
+                    },
+                    "pageToken": {
+                      "description": "The standard list page token.",
+                      "location": "query",
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1/{+name}/operations",
+                  "response": {
+                    "$ref": "ListOperationsResponse"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  },
+  "revision": "20210721",
+  "rootUrl": "https://networkservices.googleapis.com/",
+  "schemas": {
+    "AuditConfig": {
+      "description": "Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { \"audit_configs\": [ { \"service\": \"allServices\", \"audit_log_configs\": [ { \"log_type\": \"DATA_READ\", \"exempted_members\": [ \"user:jose@example.com\" ] }, { \"log_type\": \"DATA_WRITE\" }, { \"log_type\": \"ADMIN_READ\" } ] }, { \"service\": \"sampleservice.googleapis.com\", \"audit_log_configs\": [ { \"log_type\": \"DATA_READ\" }, { \"log_type\": \"DATA_WRITE\", \"exempted_members\": [ \"user:aliya@example.com\" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.",
+      "id": "AuditConfig",
+      "properties": {
+        "auditLogConfigs": {
+          "description": "The configuration for logging of each type of permission.",
+          "items": {
+            "$ref": "AuditLogConfig"
+          },
+          "type": "array"
+        },
+        "service": {
+          "description": "Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "AuditLogConfig": {
+      "description": "Provides the configuration for logging a type of permissions. Example: { \"audit_log_configs\": [ { \"log_type\": \"DATA_READ\", \"exempted_members\": [ \"user:jose@example.com\" ] }, { \"log_type\": \"DATA_WRITE\" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.",
+      "id": "AuditLogConfig",
+      "properties": {
+        "exemptedMembers": {
+          "description": "Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "logType": {
+          "description": "The log type that this config enables.",
+          "enum": [
+            "LOG_TYPE_UNSPECIFIED",
+            "ADMIN_READ",
+            "DATA_WRITE",
+            "DATA_READ"
+          ],
+          "enumDescriptions": [
+            "Default case. Should never be this.",
+            "Admin reads. Example: CloudIAM getIamPolicy",
+            "Data writes. Example: CloudSQL Users create",
+            "Data reads. Example: CloudSQL Users list"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "Binding": {
+      "description": "Associates `members` with a `role`.",
+      "id": "Binding",
+      "properties": {
+        "condition": {
+          "$ref": "Expr",
+          "description": "The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies)."
+        },
+        "members": {
+          "description": "Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`. ",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "role": {
+          "description": "Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "CancelOperationRequest": {
+      "description": "The request message for Operations.CancelOperation.",
+      "id": "CancelOperationRequest",
+      "properties": {},
+      "type": "object"
+    },
+    "Empty": {
+      "description": "A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); } The JSON representation for `Empty` is empty JSON object `{}`.",
+      "id": "Empty",
+      "properties": {},
+      "type": "object"
+    },
+    "Expr": {
+      "description": "Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: \"Summary size limit\" description: \"Determines if a summary is less than 100 chars\" expression: \"document.summary.size() < 100\" Example (Equality): title: \"Requestor is owner\" description: \"Determines if requestor is the document owner\" expression: \"document.owner == request.auth.claims.email\" Example (Logic): title: \"Public documents\" description: \"Determine whether the document should be publicly visible\" expression: \"document.type != 'private' && document.type != 'internal'\" Example (Data Manipulation): title: \"Notification string\" description: \"Create a notification string with a timestamp.\" expression: \"'New message received at ' + string(document.create_time)\" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.",
+      "id": "Expr",
+      "properties": {
+        "description": {
+          "description": "Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.",
+          "type": "string"
+        },
+        "expression": {
+          "description": "Textual representation of an expression in Common Expression Language syntax.",
+          "type": "string"
+        },
+        "location": {
+          "description": "Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.",
+          "type": "string"
+        },
+        "title": {
+          "description": "Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "ListLocationsResponse": {
+      "description": "The response message for Locations.ListLocations.",
+      "id": "ListLocationsResponse",
+      "properties": {
+        "locations": {
+          "description": "A list of locations that matches the specified filter in the request.",
+          "items": {
+            "$ref": "Location"
+          },
+          "type": "array"
+        },
+        "nextPageToken": {
+          "description": "The standard List next-page token.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "ListOperationsResponse": {
+      "description": "The response message for Operations.ListOperations.",
+      "id": "ListOperationsResponse",
+      "properties": {
+        "nextPageToken": {
+          "description": "The standard List next-page token.",
+          "type": "string"
+        },
+        "operations": {
+          "description": "A list of operations that matches the specified filter in the request.",
+          "items": {
+            "$ref": "Operation"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "Location": {
+      "description": "A resource that represents Google Cloud Platform location.",
+      "id": "Location",
+      "properties": {
+        "displayName": {
+          "description": "The friendly name for this location, typically a nearby city name. For example, \"Tokyo\".",
+          "type": "string"
+        },
+        "labels": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "Cross-service attributes for the location. For example {\"cloud.googleapis.com/region\": \"us-east1\"}",
+          "type": "object"
+        },
+        "locationId": {
+          "description": "The canonical id for this location. For example: `\"us-east1\"`.",
+          "type": "string"
+        },
+        "metadata": {
+          "additionalProperties": {
+            "description": "Properties of the object. Contains field @type with type URL.",
+            "type": "any"
+          },
+          "description": "Service-specific metadata. For example the available capacity at the given location.",
+          "type": "object"
+        },
+        "name": {
+          "description": "Resource name for the location, which may vary between implementations. For example: `\"projects/example-project/locations/us-east1\"`",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "Operation": {
+      "description": "This resource represents a long-running operation that is the result of a network API call.",
+      "id": "Operation",
+      "properties": {
+        "done": {
+          "description": "If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.",
+          "type": "boolean"
+        },
+        "error": {
+          "$ref": "Status",
+          "description": "The error result of the operation in case of failure or cancellation."
+        },
+        "metadata": {
+          "additionalProperties": {
+            "description": "Properties of the object. Contains field @type with type URL.",
+            "type": "any"
+          },
+          "description": "Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.",
+          "type": "object"
+        },
+        "name": {
+          "description": "The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.",
+          "type": "string"
+        },
+        "response": {
+          "additionalProperties": {
+            "description": "Properties of the object. Contains field @type with type URL.",
+            "type": "any"
+          },
+          "description": "The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.",
+          "type": "object"
+        }
+      },
+      "type": "object"
+    },
+    "OperationMetadata": {
+      "description": "Represents the metadata of the long-running operation.",
+      "id": "OperationMetadata",
+      "properties": {
+        "apiVersion": {
+          "description": "Output only. API version used to start the operation.",
+          "readOnly": true,
+          "type": "string"
+        },
+        "createTime": {
+          "description": "Output only. The time the operation was created.",
+          "format": "google-datetime",
+          "readOnly": true,
+          "type": "string"
+        },
+        "endTime": {
+          "description": "Output only. The time the operation finished running.",
+          "format": "google-datetime",
+          "readOnly": true,
+          "type": "string"
+        },
+        "requestedCancellation": {
+          "description": "Output only. Identifies whether the user has requested cancellation of the operation. Operations that have successfully been cancelled have Operation.error value with a google.rpc.Status.code of 1, corresponding to `Code.CANCELLED`.",
+          "readOnly": true,
+          "type": "boolean"
+        },
+        "statusMessage": {
+          "description": "Output only. Human-readable status of the operation, if any.",
+          "readOnly": true,
+          "type": "string"
+        },
+        "target": {
+          "description": "Output only. Server-defined resource path for the target of the operation.",
+          "readOnly": true,
+          "type": "string"
+        },
+        "verb": {
+          "description": "Output only. Name of the verb executed by the operation.",
+          "readOnly": true,
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "Policy": {
+      "description": "An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { \"bindings\": [ { \"role\": \"roles/resourcemanager.organizationAdmin\", \"members\": [ \"user:mike@example.com\", \"group:admins@example.com\", \"domain:google.com\", \"serviceAccount:my-project-id@appspot.gserviceaccount.com\" ] }, { \"role\": \"roles/resourcemanager.organizationViewer\", \"members\": [ \"user:eve@example.com\" ], \"condition\": { \"title\": \"expirable access\", \"description\": \"Does not grant access after Sep 2020\", \"expression\": \"request.time < timestamp('2020-10-01T00:00:00.000Z')\", } } ], \"etag\": \"BwWWja0YfJA=\", \"version\": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).",
+      "id": "Policy",
+      "properties": {
+        "auditConfigs": {
+          "description": "Specifies cloud audit logging configuration for this policy.",
+          "items": {
+            "$ref": "AuditConfig"
+          },
+          "type": "array"
+        },
+        "bindings": {
+          "description": "Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.",
+          "items": {
+            "$ref": "Binding"
+          },
+          "type": "array"
+        },
+        "etag": {
+          "description": "`etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.",
+          "format": "byte",
+          "type": "string"
+        },
+        "version": {
+          "description": "Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).",
+          "format": "int32",
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "SetIamPolicyRequest": {
+      "description": "Request message for `SetIamPolicy` method.",
+      "id": "SetIamPolicyRequest",
+      "properties": {
+        "policy": {
+          "$ref": "Policy",
+          "description": "REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them."
+        },
+        "updateMask": {
+          "description": "OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only the fields in the mask will be modified. If no mask is provided, the following default mask is used: `paths: \"bindings, etag\"`",
+          "format": "google-fieldmask",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "Status": {
+      "description": "The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).",
+      "id": "Status",
+      "properties": {
+        "code": {
+          "description": "The status code, which should be an enum value of google.rpc.Code.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "details": {
+          "description": "A list of messages that carry the error details. There is a common set of message types for APIs to use.",
+          "items": {
+            "additionalProperties": {
+              "description": "Properties of the object. Contains field @type with type URL.",
+              "type": "any"
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "message": {
+          "description": "A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "TestIamPermissionsRequest": {
+      "description": "Request message for `TestIamPermissions` method.",
+      "id": "TestIamPermissionsRequest",
+      "properties": {
+        "permissions": {
+          "description": "The set of permissions to check for the `resource`. Permissions with wildcards (such as '*' or 'storage.*') are not allowed. For more information see [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "TestIamPermissionsResponse": {
+      "description": "Response message for `TestIamPermissions` method.",
+      "id": "TestIamPermissionsResponse",
+      "properties": {
+        "permissions": {
+          "description": "A subset of `TestPermissionsRequest.permissions` that the caller is allowed.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "servicePath": "",
+  "title": "Network Services API",
+  "version": "v1",
+  "version_module": true
+}
\ No newline at end of file
diff --git a/googleapiclient/discovery_cache/documents/networkservices.v1beta1.json b/googleapiclient/discovery_cache/documents/networkservices.v1beta1.json
new file mode 100644
index 0000000..81ed41b
--- /dev/null
+++ b/googleapiclient/discovery_cache/documents/networkservices.v1beta1.json
@@ -0,0 +1,1070 @@
+{
+  "auth": {
+    "oauth2": {
+      "scopes": {
+        "https://www.googleapis.com/auth/cloud-platform": {
+          "description": "See, edit, configure, and delete your Google Cloud Platform data"
+        }
+      }
+    }
+  },
+  "basePath": "",
+  "baseUrl": "https://networkservices.googleapis.com/",
+  "batchPath": "batch",
+  "canonicalName": "NetworkServices",
+  "description": "",
+  "discoveryVersion": "v1",
+  "documentationLink": "https://cloud.google.com/networking",
+  "fullyEncodeReservedExpansion": true,
+  "icons": {
+    "x16": "http://www.google.com/images/icons/product/search-16.gif",
+    "x32": "http://www.google.com/images/icons/product/search-32.gif"
+  },
+  "id": "networkservices:v1beta1",
+  "kind": "discovery#restDescription",
+  "mtlsRootUrl": "https://networkservices.mtls.googleapis.com/",
+  "name": "networkservices",
+  "ownerDomain": "google.com",
+  "ownerName": "Google",
+  "parameters": {
+    "$.xgafv": {
+      "description": "V1 error format.",
+      "enum": [
+        "1",
+        "2"
+      ],
+      "enumDescriptions": [
+        "v1 error format",
+        "v2 error format"
+      ],
+      "location": "query",
+      "type": "string"
+    },
+    "access_token": {
+      "description": "OAuth access token.",
+      "location": "query",
+      "type": "string"
+    },
+    "alt": {
+      "default": "json",
+      "description": "Data format for response.",
+      "enum": [
+        "json",
+        "media",
+        "proto"
+      ],
+      "enumDescriptions": [
+        "Responses with Content-Type of application/json",
+        "Media download with context-dependent Content-Type",
+        "Responses with Content-Type of application/x-protobuf"
+      ],
+      "location": "query",
+      "type": "string"
+    },
+    "callback": {
+      "description": "JSONP",
+      "location": "query",
+      "type": "string"
+    },
+    "fields": {
+      "description": "Selector specifying which fields to include in a partial response.",
+      "location": "query",
+      "type": "string"
+    },
+    "key": {
+      "description": "API key. Your API key identifies your project and provides you with API access, quota, and reports. Required unless you provide an OAuth 2.0 token.",
+      "location": "query",
+      "type": "string"
+    },
+    "oauth_token": {
+      "description": "OAuth 2.0 token for the current user.",
+      "location": "query",
+      "type": "string"
+    },
+    "prettyPrint": {
+      "default": "true",
+      "description": "Returns response with indentations and line breaks.",
+      "location": "query",
+      "type": "boolean"
+    },
+    "quotaUser": {
+      "description": "Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters.",
+      "location": "query",
+      "type": "string"
+    },
+    "uploadType": {
+      "description": "Legacy upload protocol for media (e.g. \"media\", \"multipart\").",
+      "location": "query",
+      "type": "string"
+    },
+    "upload_protocol": {
+      "description": "Upload protocol for media (e.g. \"raw\", \"multipart\").",
+      "location": "query",
+      "type": "string"
+    }
+  },
+  "protocol": "rest",
+  "resources": {
+    "projects": {
+      "resources": {
+        "locations": {
+          "methods": {
+            "get": {
+              "description": "Gets information about a location.",
+              "flatPath": "v1beta1/projects/{projectsId}/locations/{locationsId}",
+              "httpMethod": "GET",
+              "id": "networkservices.projects.locations.get",
+              "parameterOrder": [
+                "name"
+              ],
+              "parameters": {
+                "name": {
+                  "description": "Resource name for the location.",
+                  "location": "path",
+                  "pattern": "^projects/[^/]+/locations/[^/]+$",
+                  "required": true,
+                  "type": "string"
+                }
+              },
+              "path": "v1beta1/{+name}",
+              "response": {
+                "$ref": "Location"
+              },
+              "scopes": [
+                "https://www.googleapis.com/auth/cloud-platform"
+              ]
+            },
+            "list": {
+              "description": "Lists information about the supported locations for this service.",
+              "flatPath": "v1beta1/projects/{projectsId}/locations",
+              "httpMethod": "GET",
+              "id": "networkservices.projects.locations.list",
+              "parameterOrder": [
+                "name"
+              ],
+              "parameters": {
+                "filter": {
+                  "description": "A filter to narrow down results to a preferred subset. The filtering language accepts strings like \"displayName=tokyo\", and is documented in more detail in [AIP-160](https://google.aip.dev/160).",
+                  "location": "query",
+                  "type": "string"
+                },
+                "name": {
+                  "description": "The resource that owns the locations collection, if applicable.",
+                  "location": "path",
+                  "pattern": "^projects/[^/]+$",
+                  "required": true,
+                  "type": "string"
+                },
+                "pageSize": {
+                  "description": "The maximum number of results to return. If not set, the service selects a default.",
+                  "format": "int32",
+                  "location": "query",
+                  "type": "integer"
+                },
+                "pageToken": {
+                  "description": "A page token received from the `next_page_token` field in the response. Send that page token to receive the subsequent page.",
+                  "location": "query",
+                  "type": "string"
+                }
+              },
+              "path": "v1beta1/{+name}/locations",
+              "response": {
+                "$ref": "ListLocationsResponse"
+              },
+              "scopes": [
+                "https://www.googleapis.com/auth/cloud-platform"
+              ]
+            }
+          },
+          "resources": {
+            "endpointPolicies": {
+              "methods": {
+                "create": {
+                  "description": "Creates a new EndpointPolicy in a given project and location.",
+                  "flatPath": "v1beta1/projects/{projectsId}/locations/{locationsId}/endpointPolicies",
+                  "httpMethod": "POST",
+                  "id": "networkservices.projects.locations.endpointPolicies.create",
+                  "parameterOrder": [
+                    "parent"
+                  ],
+                  "parameters": {
+                    "endpointPolicyId": {
+                      "description": "Required. Short name of the EndpointPolicy resource to be created. E.g. \"CustomECS\".",
+                      "location": "query",
+                      "type": "string"
+                    },
+                    "parent": {
+                      "description": "Required. The parent resource of the EndpointPolicy. Must be in the format `projects/*/locations/global`.",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1beta1/{+parent}/endpointPolicies",
+                  "request": {
+                    "$ref": "EndpointPolicy"
+                  },
+                  "response": {
+                    "$ref": "Operation"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                },
+                "delete": {
+                  "description": "Deletes a single EndpointPolicy.",
+                  "flatPath": "v1beta1/projects/{projectsId}/locations/{locationsId}/endpointPolicies/{endpointPoliciesId}",
+                  "httpMethod": "DELETE",
+                  "id": "networkservices.projects.locations.endpointPolicies.delete",
+                  "parameterOrder": [
+                    "name"
+                  ],
+                  "parameters": {
+                    "name": {
+                      "description": "Required. A name of the EndpointPolicy to delete. Must be in the format `projects/*/locations/global/endpointPolicies/*`.",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+/endpointPolicies/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1beta1/{+name}",
+                  "response": {
+                    "$ref": "Operation"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                },
+                "get": {
+                  "description": "Gets details of a single EndpointPolicy.",
+                  "flatPath": "v1beta1/projects/{projectsId}/locations/{locationsId}/endpointPolicies/{endpointPoliciesId}",
+                  "httpMethod": "GET",
+                  "id": "networkservices.projects.locations.endpointPolicies.get",
+                  "parameterOrder": [
+                    "name"
+                  ],
+                  "parameters": {
+                    "name": {
+                      "description": "Required. A name of the EndpointPolicy to get. Must be in the format `projects/*/locations/global/endpointPolicies/*`.",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+/endpointPolicies/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1beta1/{+name}",
+                  "response": {
+                    "$ref": "EndpointPolicy"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                },
+                "getIamPolicy": {
+                  "description": "Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.",
+                  "flatPath": "v1beta1/projects/{projectsId}/locations/{locationsId}/endpointPolicies/{endpointPoliciesId}:getIamPolicy",
+                  "httpMethod": "GET",
+                  "id": "networkservices.projects.locations.endpointPolicies.getIamPolicy",
+                  "parameterOrder": [
+                    "resource"
+                  ],
+                  "parameters": {
+                    "options.requestedPolicyVersion": {
+                      "description": "Optional. The policy format version to be returned. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Requests for policies with any conditional bindings must specify version 3. Policies without any conditional bindings may specify any valid value or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).",
+                      "format": "int32",
+                      "location": "query",
+                      "type": "integer"
+                    },
+                    "resource": {
+                      "description": "REQUIRED: The resource for which the policy is being requested. See the operation documentation for the appropriate value for this field.",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+/endpointPolicies/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1beta1/{+resource}:getIamPolicy",
+                  "response": {
+                    "$ref": "Policy"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                },
+                "list": {
+                  "description": "Lists EndpointPolicies in a given project and location.",
+                  "flatPath": "v1beta1/projects/{projectsId}/locations/{locationsId}/endpointPolicies",
+                  "httpMethod": "GET",
+                  "id": "networkservices.projects.locations.endpointPolicies.list",
+                  "parameterOrder": [
+                    "parent"
+                  ],
+                  "parameters": {
+                    "pageSize": {
+                      "description": "Maximum number of EndpointPolicies to return per call.",
+                      "format": "int32",
+                      "location": "query",
+                      "type": "integer"
+                    },
+                    "pageToken": {
+                      "description": "The value returned by the last `ListEndpointPoliciesResponse` Indicates that this is a continuation of a prior `ListEndpointPolicies` call, and that the system should return the next page of data.",
+                      "location": "query",
+                      "type": "string"
+                    },
+                    "parent": {
+                      "description": "Required. The project and location from which the EndpointPolicies should be listed, specified in the format `projects/*/locations/global`.",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1beta1/{+parent}/endpointPolicies",
+                  "response": {
+                    "$ref": "ListEndpointPoliciesResponse"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                },
+                "patch": {
+                  "description": "Updates the parameters of a single EndpointPolicy.",
+                  "flatPath": "v1beta1/projects/{projectsId}/locations/{locationsId}/endpointPolicies/{endpointPoliciesId}",
+                  "httpMethod": "PATCH",
+                  "id": "networkservices.projects.locations.endpointPolicies.patch",
+                  "parameterOrder": [
+                    "name"
+                  ],
+                  "parameters": {
+                    "name": {
+                      "description": "Required. Name of the EndpointPolicy resource. It matches pattern `projects/*/locations/global/endpointPolicies/`.",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+/endpointPolicies/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    },
+                    "updateMask": {
+                      "description": "Optional. Field mask is used to specify the fields to be overwritten in the EndpointPolicy resource by the update. The fields specified in the update_mask are relative to the resource, not the full request. A field will be overwritten if it is in the mask. If the user does not provide a mask then all fields will be overwritten.",
+                      "format": "google-fieldmask",
+                      "location": "query",
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1beta1/{+name}",
+                  "request": {
+                    "$ref": "EndpointPolicy"
+                  },
+                  "response": {
+                    "$ref": "Operation"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                },
+                "setIamPolicy": {
+                  "description": "Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.",
+                  "flatPath": "v1beta1/projects/{projectsId}/locations/{locationsId}/endpointPolicies/{endpointPoliciesId}:setIamPolicy",
+                  "httpMethod": "POST",
+                  "id": "networkservices.projects.locations.endpointPolicies.setIamPolicy",
+                  "parameterOrder": [
+                    "resource"
+                  ],
+                  "parameters": {
+                    "resource": {
+                      "description": "REQUIRED: The resource for which the policy is being specified. See the operation documentation for the appropriate value for this field.",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+/endpointPolicies/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1beta1/{+resource}:setIamPolicy",
+                  "request": {
+                    "$ref": "SetIamPolicyRequest"
+                  },
+                  "response": {
+                    "$ref": "Policy"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                },
+                "testIamPermissions": {
+                  "description": "Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may \"fail open\" without warning.",
+                  "flatPath": "v1beta1/projects/{projectsId}/locations/{locationsId}/endpointPolicies/{endpointPoliciesId}:testIamPermissions",
+                  "httpMethod": "POST",
+                  "id": "networkservices.projects.locations.endpointPolicies.testIamPermissions",
+                  "parameterOrder": [
+                    "resource"
+                  ],
+                  "parameters": {
+                    "resource": {
+                      "description": "REQUIRED: The resource for which the policy detail is being requested. See the operation documentation for the appropriate value for this field.",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+/endpointPolicies/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1beta1/{+resource}:testIamPermissions",
+                  "request": {
+                    "$ref": "TestIamPermissionsRequest"
+                  },
+                  "response": {
+                    "$ref": "TestIamPermissionsResponse"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                }
+              }
+            },
+            "operations": {
+              "methods": {
+                "cancel": {
+                  "description": "Starts asynchronous cancellation on a long-running operation. The server makes a best effort to cancel the operation, but success is not guaranteed. If the server doesn't support this method, it returns `google.rpc.Code.UNIMPLEMENTED`. Clients can use Operations.GetOperation or other methods to check whether the cancellation succeeded or whether the operation completed despite cancellation. On successful cancellation, the operation is not deleted; instead, it becomes an operation with an Operation.error value with a google.rpc.Status.code of 1, corresponding to `Code.CANCELLED`.",
+                  "flatPath": "v1beta1/projects/{projectsId}/locations/{locationsId}/operations/{operationsId}:cancel",
+                  "httpMethod": "POST",
+                  "id": "networkservices.projects.locations.operations.cancel",
+                  "parameterOrder": [
+                    "name"
+                  ],
+                  "parameters": {
+                    "name": {
+                      "description": "The name of the operation resource to be cancelled.",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+/operations/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1beta1/{+name}:cancel",
+                  "request": {
+                    "$ref": "CancelOperationRequest"
+                  },
+                  "response": {
+                    "$ref": "Empty"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                },
+                "delete": {
+                  "description": "Deletes a long-running operation. This method indicates that the client is no longer interested in the operation result. It does not cancel the operation. If the server doesn't support this method, it returns `google.rpc.Code.UNIMPLEMENTED`.",
+                  "flatPath": "v1beta1/projects/{projectsId}/locations/{locationsId}/operations/{operationsId}",
+                  "httpMethod": "DELETE",
+                  "id": "networkservices.projects.locations.operations.delete",
+                  "parameterOrder": [
+                    "name"
+                  ],
+                  "parameters": {
+                    "name": {
+                      "description": "The name of the operation resource to be deleted.",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+/operations/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1beta1/{+name}",
+                  "response": {
+                    "$ref": "Empty"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                },
+                "get": {
+                  "description": "Gets the latest state of a long-running operation. Clients can use this method to poll the operation result at intervals as recommended by the API service.",
+                  "flatPath": "v1beta1/projects/{projectsId}/locations/{locationsId}/operations/{operationsId}",
+                  "httpMethod": "GET",
+                  "id": "networkservices.projects.locations.operations.get",
+                  "parameterOrder": [
+                    "name"
+                  ],
+                  "parameters": {
+                    "name": {
+                      "description": "The name of the operation resource.",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+/operations/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1beta1/{+name}",
+                  "response": {
+                    "$ref": "Operation"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                },
+                "list": {
+                  "description": "Lists operations that match the specified filter in the request. If the server doesn't support this method, it returns `UNIMPLEMENTED`. NOTE: the `name` binding allows API services to override the binding to use different resource name schemes, such as `users/*/operations`. To override the binding, API services can add a binding such as `\"/v1/{name=users/*}/operations\"` to their service configuration. For backwards compatibility, the default name includes the operations collection id, however overriding users must ensure the name binding is the parent resource, without the operations collection id.",
+                  "flatPath": "v1beta1/projects/{projectsId}/locations/{locationsId}/operations",
+                  "httpMethod": "GET",
+                  "id": "networkservices.projects.locations.operations.list",
+                  "parameterOrder": [
+                    "name"
+                  ],
+                  "parameters": {
+                    "filter": {
+                      "description": "The standard list filter.",
+                      "location": "query",
+                      "type": "string"
+                    },
+                    "name": {
+                      "description": "The name of the operation's parent resource.",
+                      "location": "path",
+                      "pattern": "^projects/[^/]+/locations/[^/]+$",
+                      "required": true,
+                      "type": "string"
+                    },
+                    "pageSize": {
+                      "description": "The standard list page size.",
+                      "format": "int32",
+                      "location": "query",
+                      "type": "integer"
+                    },
+                    "pageToken": {
+                      "description": "The standard list page token.",
+                      "location": "query",
+                      "type": "string"
+                    }
+                  },
+                  "path": "v1beta1/{+name}/operations",
+                  "response": {
+                    "$ref": "ListOperationsResponse"
+                  },
+                  "scopes": [
+                    "https://www.googleapis.com/auth/cloud-platform"
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  },
+  "revision": "20210721",
+  "rootUrl": "https://networkservices.googleapis.com/",
+  "schemas": {
+    "AuditConfig": {
+      "description": "Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { \"audit_configs\": [ { \"service\": \"allServices\", \"audit_log_configs\": [ { \"log_type\": \"DATA_READ\", \"exempted_members\": [ \"user:jose@example.com\" ] }, { \"log_type\": \"DATA_WRITE\" }, { \"log_type\": \"ADMIN_READ\" } ] }, { \"service\": \"sampleservice.googleapis.com\", \"audit_log_configs\": [ { \"log_type\": \"DATA_READ\" }, { \"log_type\": \"DATA_WRITE\", \"exempted_members\": [ \"user:aliya@example.com\" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.",
+      "id": "AuditConfig",
+      "properties": {
+        "auditLogConfigs": {
+          "description": "The configuration for logging of each type of permission.",
+          "items": {
+            "$ref": "AuditLogConfig"
+          },
+          "type": "array"
+        },
+        "service": {
+          "description": "Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "AuditLogConfig": {
+      "description": "Provides the configuration for logging a type of permissions. Example: { \"audit_log_configs\": [ { \"log_type\": \"DATA_READ\", \"exempted_members\": [ \"user:jose@example.com\" ] }, { \"log_type\": \"DATA_WRITE\" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.",
+      "id": "AuditLogConfig",
+      "properties": {
+        "exemptedMembers": {
+          "description": "Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "logType": {
+          "description": "The log type that this config enables.",
+          "enum": [
+            "LOG_TYPE_UNSPECIFIED",
+            "ADMIN_READ",
+            "DATA_WRITE",
+            "DATA_READ"
+          ],
+          "enumDescriptions": [
+            "Default case. Should never be this.",
+            "Admin reads. Example: CloudIAM getIamPolicy",
+            "Data writes. Example: CloudSQL Users create",
+            "Data reads. Example: CloudSQL Users list"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "Binding": {
+      "description": "Associates `members` with a `role`.",
+      "id": "Binding",
+      "properties": {
+        "condition": {
+          "$ref": "Expr",
+          "description": "The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies)."
+        },
+        "members": {
+          "description": "Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`. ",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "role": {
+          "description": "Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "CancelOperationRequest": {
+      "description": "The request message for Operations.CancelOperation.",
+      "id": "CancelOperationRequest",
+      "properties": {},
+      "type": "object"
+    },
+    "Empty": {
+      "description": "A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); } The JSON representation for `Empty` is empty JSON object `{}`.",
+      "id": "Empty",
+      "properties": {},
+      "type": "object"
+    },
+    "EndpointMatcher": {
+      "description": "A definition of a matcher that selects endpoints to which the policies should be applied.",
+      "id": "EndpointMatcher",
+      "properties": {
+        "metadataLabelMatcher": {
+          "$ref": "MetadataLabelMatcher",
+          "description": "The matcher is based on node metadata presented by xDS clients."
+        }
+      },
+      "type": "object"
+    },
+    "EndpointPolicy": {
+      "description": "EndpointPolicy is a resource that helps apply desired configuration on the endpoints that match specific criteria. For example, this resource can be used to apply \"authentication config\" an all endpoints that serve on port 8080.",
+      "id": "EndpointPolicy",
+      "properties": {
+        "authorizationPolicy": {
+          "description": "Optional. This field specifies the URL of AuthorizationPolicy resource that applies authorization policies to the inbound traffic at the matched endpoints. Refer to Authorization. If this field is not specified, authorization is disabled(no authz checks) for this endpoint. Applicable only when EndpointPolicyType is SIDECAR_PROXY.",
+          "type": "string"
+        },
+        "clientTlsPolicy": {
+          "description": "Optional. A URL referring to a ClientTlsPolicy resource. ClientTlsPolicy can be set to specify the authentication for traffic from the proxy to the actual endpoints. More specifically, it is applied to the outgoing traffic from the proxy to the endpoint. This is typically used for sidecar model where the proxy identifies itself as endpoint to the control plane, with the connection between sidecar and endpoint requiring authentication. If this field is not set, authentication is disabled(open). Applicable only when EndpointPolicyType is SIDECAR_PROXY.",
+          "type": "string"
+        },
+        "createTime": {
+          "description": "Output only. The timestamp when the resource was created.",
+          "format": "google-datetime",
+          "readOnly": true,
+          "type": "string"
+        },
+        "description": {
+          "description": "Optional. A free-text description of the resource. Max length 1024 characters.",
+          "type": "string"
+        },
+        "endpointMatcher": {
+          "$ref": "EndpointMatcher",
+          "description": "Required. A matcher that selects endpoints to which the policies should be applied."
+        },
+        "labels": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "Optional. Set of label tags associated with the EndpointPolicy resource.",
+          "type": "object"
+        },
+        "name": {
+          "description": "Required. Name of the EndpointPolicy resource. It matches pattern `projects/*/locations/global/endpointPolicies/`.",
+          "type": "string"
+        },
+        "serverTlsPolicy": {
+          "description": "Optional. A URL referring to ServerTlsPolicy resource. ServerTlsPolicy is used to determine the authentication policy to be applied to terminate the inbound traffic at the identified backends. If this field is not set, authentication is disabled(open) for this endpoint.",
+          "type": "string"
+        },
+        "trafficPortSelector": {
+          "$ref": "TrafficPortSelector",
+          "description": "Optional. Port selector for the (matched) endpoints. If no port selector is provided, the matched config is applied to all ports."
+        },
+        "type": {
+          "description": "Required. The type of endpoint policy. This is primarily used to validate the configuration.",
+          "enum": [
+            "ENDPOINT_POLICY_TYPE_UNSPECIFIED",
+            "SIDECAR_PROXY",
+            "GRPC_SERVER"
+          ],
+          "enumDescriptions": [
+            "Default value. Must not be used.",
+            "Represents a proxy deployed as a sidecar.",
+            "Represents a proxyless gRPC backend."
+          ],
+          "type": "string"
+        },
+        "updateTime": {
+          "description": "Output only. The timestamp when the resource was updated.",
+          "format": "google-datetime",
+          "readOnly": true,
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "Expr": {
+      "description": "Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: \"Summary size limit\" description: \"Determines if a summary is less than 100 chars\" expression: \"document.summary.size() < 100\" Example (Equality): title: \"Requestor is owner\" description: \"Determines if requestor is the document owner\" expression: \"document.owner == request.auth.claims.email\" Example (Logic): title: \"Public documents\" description: \"Determine whether the document should be publicly visible\" expression: \"document.type != 'private' && document.type != 'internal'\" Example (Data Manipulation): title: \"Notification string\" description: \"Create a notification string with a timestamp.\" expression: \"'New message received at ' + string(document.create_time)\" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.",
+      "id": "Expr",
+      "properties": {
+        "description": {
+          "description": "Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.",
+          "type": "string"
+        },
+        "expression": {
+          "description": "Textual representation of an expression in Common Expression Language syntax.",
+          "type": "string"
+        },
+        "location": {
+          "description": "Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.",
+          "type": "string"
+        },
+        "title": {
+          "description": "Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "ListEndpointPoliciesResponse": {
+      "description": "Response returned by the ListEndpointPolicies method.",
+      "id": "ListEndpointPoliciesResponse",
+      "properties": {
+        "endpointPolicies": {
+          "description": "List of EndpointPolicy resources.",
+          "items": {
+            "$ref": "EndpointPolicy"
+          },
+          "type": "array"
+        },
+        "nextPageToken": {
+          "description": "If there might be more results than those appearing in this response, then `next_page_token` is included. To get the next set of results, call this method again using the value of `next_page_token` as `page_token`.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "ListLocationsResponse": {
+      "description": "The response message for Locations.ListLocations.",
+      "id": "ListLocationsResponse",
+      "properties": {
+        "locations": {
+          "description": "A list of locations that matches the specified filter in the request.",
+          "items": {
+            "$ref": "Location"
+          },
+          "type": "array"
+        },
+        "nextPageToken": {
+          "description": "The standard List next-page token.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "ListOperationsResponse": {
+      "description": "The response message for Operations.ListOperations.",
+      "id": "ListOperationsResponse",
+      "properties": {
+        "nextPageToken": {
+          "description": "The standard List next-page token.",
+          "type": "string"
+        },
+        "operations": {
+          "description": "A list of operations that matches the specified filter in the request.",
+          "items": {
+            "$ref": "Operation"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "Location": {
+      "description": "A resource that represents Google Cloud Platform location.",
+      "id": "Location",
+      "properties": {
+        "displayName": {
+          "description": "The friendly name for this location, typically a nearby city name. For example, \"Tokyo\".",
+          "type": "string"
+        },
+        "labels": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "Cross-service attributes for the location. For example {\"cloud.googleapis.com/region\": \"us-east1\"}",
+          "type": "object"
+        },
+        "locationId": {
+          "description": "The canonical id for this location. For example: `\"us-east1\"`.",
+          "type": "string"
+        },
+        "metadata": {
+          "additionalProperties": {
+            "description": "Properties of the object. Contains field @type with type URL.",
+            "type": "any"
+          },
+          "description": "Service-specific metadata. For example the available capacity at the given location.",
+          "type": "object"
+        },
+        "name": {
+          "description": "Resource name for the location, which may vary between implementations. For example: `\"projects/example-project/locations/us-east1\"`",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "MetadataLabelMatcher": {
+      "description": "The matcher that is based on node metadata presented by xDS clients.",
+      "id": "MetadataLabelMatcher",
+      "properties": {
+        "metadataLabelMatchCriteria": {
+          "description": "Specifies how matching should be done. Supported values are: MATCH_ANY: At least one of the Labels specified in the matcher should match the metadata presented by xDS client. MATCH_ALL: The metadata presented by the xDS client should contain all of the labels specified here. The selection is determined based on the best match. For example, suppose there are three EndpointPolicy resources P1, P2 and P3 and if P1 has a the matcher as MATCH_ANY , P2 has MATCH_ALL , and P3 has MATCH_ALL . If a client with label connects, the config from P1 will be selected. If a client with label connects, the config from P2 will be selected. If a client with label connects, the config from P3 will be selected. If there is more than one best match, (for example, if a config P4 with selector exists and if a client with label connects), an error will be thrown.",
+          "enum": [
+            "METADATA_LABEL_MATCH_CRITERIA_UNSPECIFIED",
+            "MATCH_ANY",
+            "MATCH_ALL"
+          ],
+          "enumDescriptions": [
+            "Default value. Should not be used.",
+            "At least one of the Labels specified in the matcher should match the metadata presented by xDS client.",
+            "The metadata presented by the xDS client should contain all of the labels specified here."
+          ],
+          "type": "string"
+        },
+        "metadataLabels": {
+          "description": "The list of label value pairs that must match labels in the provided metadata based on filterMatchCriteria This list can have at most 64 entries. The list can be empty if the match criteria is MATCH_ANY, to specify a wildcard match (i.e this matches any client).",
+          "items": {
+            "$ref": "MetadataLabels"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "MetadataLabels": {
+      "description": "Defines a name-pair value for a single label.",
+      "id": "MetadataLabels",
+      "properties": {
+        "labelName": {
+          "description": "Required. Label name presented as key in xDS Node Metadata.",
+          "type": "string"
+        },
+        "labelValue": {
+          "description": "Required. Label value presented as value corresponding to the above key, in xDS Node Metadata.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "Operation": {
+      "description": "This resource represents a long-running operation that is the result of a network API call.",
+      "id": "Operation",
+      "properties": {
+        "done": {
+          "description": "If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.",
+          "type": "boolean"
+        },
+        "error": {
+          "$ref": "Status",
+          "description": "The error result of the operation in case of failure or cancellation."
+        },
+        "metadata": {
+          "additionalProperties": {
+            "description": "Properties of the object. Contains field @type with type URL.",
+            "type": "any"
+          },
+          "description": "Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.",
+          "type": "object"
+        },
+        "name": {
+          "description": "The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.",
+          "type": "string"
+        },
+        "response": {
+          "additionalProperties": {
+            "description": "Properties of the object. Contains field @type with type URL.",
+            "type": "any"
+          },
+          "description": "The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.",
+          "type": "object"
+        }
+      },
+      "type": "object"
+    },
+    "OperationMetadata": {
+      "description": "Represents the metadata of the long-running operation.",
+      "id": "OperationMetadata",
+      "properties": {
+        "apiVersion": {
+          "description": "Output only. API version used to start the operation.",
+          "readOnly": true,
+          "type": "string"
+        },
+        "createTime": {
+          "description": "Output only. The time the operation was created.",
+          "format": "google-datetime",
+          "readOnly": true,
+          "type": "string"
+        },
+        "endTime": {
+          "description": "Output only. The time the operation finished running.",
+          "format": "google-datetime",
+          "readOnly": true,
+          "type": "string"
+        },
+        "requestedCancellation": {
+          "description": "Output only. Identifies whether the user has requested cancellation of the operation. Operations that have successfully been cancelled have Operation.error value with a google.rpc.Status.code of 1, corresponding to `Code.CANCELLED`.",
+          "readOnly": true,
+          "type": "boolean"
+        },
+        "statusMessage": {
+          "description": "Output only. Human-readable status of the operation, if any.",
+          "readOnly": true,
+          "type": "string"
+        },
+        "target": {
+          "description": "Output only. Server-defined resource path for the target of the operation.",
+          "readOnly": true,
+          "type": "string"
+        },
+        "verb": {
+          "description": "Output only. Name of the verb executed by the operation.",
+          "readOnly": true,
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "Policy": {
+      "description": "An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { \"bindings\": [ { \"role\": \"roles/resourcemanager.organizationAdmin\", \"members\": [ \"user:mike@example.com\", \"group:admins@example.com\", \"domain:google.com\", \"serviceAccount:my-project-id@appspot.gserviceaccount.com\" ] }, { \"role\": \"roles/resourcemanager.organizationViewer\", \"members\": [ \"user:eve@example.com\" ], \"condition\": { \"title\": \"expirable access\", \"description\": \"Does not grant access after Sep 2020\", \"expression\": \"request.time < timestamp('2020-10-01T00:00:00.000Z')\", } } ], \"etag\": \"BwWWja0YfJA=\", \"version\": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).",
+      "id": "Policy",
+      "properties": {
+        "auditConfigs": {
+          "description": "Specifies cloud audit logging configuration for this policy.",
+          "items": {
+            "$ref": "AuditConfig"
+          },
+          "type": "array"
+        },
+        "bindings": {
+          "description": "Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.",
+          "items": {
+            "$ref": "Binding"
+          },
+          "type": "array"
+        },
+        "etag": {
+          "description": "`etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.",
+          "format": "byte",
+          "type": "string"
+        },
+        "version": {
+          "description": "Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).",
+          "format": "int32",
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "SetIamPolicyRequest": {
+      "description": "Request message for `SetIamPolicy` method.",
+      "id": "SetIamPolicyRequest",
+      "properties": {
+        "policy": {
+          "$ref": "Policy",
+          "description": "REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them."
+        },
+        "updateMask": {
+          "description": "OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only the fields in the mask will be modified. If no mask is provided, the following default mask is used: `paths: \"bindings, etag\"`",
+          "format": "google-fieldmask",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "Status": {
+      "description": "The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).",
+      "id": "Status",
+      "properties": {
+        "code": {
+          "description": "The status code, which should be an enum value of google.rpc.Code.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "details": {
+          "description": "A list of messages that carry the error details. There is a common set of message types for APIs to use.",
+          "items": {
+            "additionalProperties": {
+              "description": "Properties of the object. Contains field @type with type URL.",
+              "type": "any"
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "message": {
+          "description": "A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "TestIamPermissionsRequest": {
+      "description": "Request message for `TestIamPermissions` method.",
+      "id": "TestIamPermissionsRequest",
+      "properties": {
+        "permissions": {
+          "description": "The set of permissions to check for the `resource`. Permissions with wildcards (such as '*' or 'storage.*') are not allowed. For more information see [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "TestIamPermissionsResponse": {
+      "description": "Response message for `TestIamPermissions` method.",
+      "id": "TestIamPermissionsResponse",
+      "properties": {
+        "permissions": {
+          "description": "A subset of `TestPermissionsRequest.permissions` that the caller is allowed.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "TrafficPortSelector": {
+      "description": "Specification of a port-based selector.",
+      "id": "TrafficPortSelector",
+      "properties": {
+        "ports": {
+          "description": "Optional. A list of ports. Can be port numbers or port range (example, [80-90] specifies all ports from 80 to 90, including 80 and 90) or named ports or * to specify all ports. If the list is empty, all ports are selected.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "servicePath": "",
+  "title": "Network Services API",
+  "version": "v1beta1",
+  "version_module": true
+}
\ No newline at end of file
diff --git a/googleapiclient/discovery_cache/documents/notebooks.v1.json b/googleapiclient/discovery_cache/documents/notebooks.v1.json
index 9a4d890..d9aca44 100644
--- a/googleapiclient/discovery_cache/documents/notebooks.v1.json
+++ b/googleapiclient/discovery_cache/documents/notebooks.v1.json
@@ -370,7 +370,7 @@
                   ],
                   "parameters": {
                     "name": {
-                      "description": "Required. Format: `projects/{project_id}/locations/{location}/schedules/{execution_id}`",
+                      "description": "Required. Format: `projects/{project_id}/locations/{location}/executions/{execution_id}`",
                       "location": "path",
                       "pattern": "^projects/[^/]+/locations/[^/]+/executions/[^/]+$",
                       "required": true,
@@ -1609,7 +1609,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210722",
   "rootUrl": "https://notebooks.googleapis.com/",
   "schemas": {
     "AcceleratorConfig": {
diff --git a/googleapiclient/discovery_cache/documents/ondemandscanning.v1.json b/googleapiclient/discovery_cache/documents/ondemandscanning.v1.json
index 4a8ccf1..e8a1de4 100644
--- a/googleapiclient/discovery_cache/documents/ondemandscanning.v1.json
+++ b/googleapiclient/discovery_cache/documents/ondemandscanning.v1.json
@@ -339,7 +339,7 @@
       }
     }
   },
-  "revision": "20210717",
+  "revision": "20210723",
   "rootUrl": "https://ondemandscanning.googleapis.com/",
   "schemas": {
     "AliasContext": {
diff --git a/googleapiclient/discovery_cache/documents/ondemandscanning.v1beta1.json b/googleapiclient/discovery_cache/documents/ondemandscanning.v1beta1.json
index ee88e9a..6346b4f 100644
--- a/googleapiclient/discovery_cache/documents/ondemandscanning.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/ondemandscanning.v1beta1.json
@@ -339,7 +339,7 @@
       }
     }
   },
-  "revision": "20210717",
+  "revision": "20210723",
   "rootUrl": "https://ondemandscanning.googleapis.com/",
   "schemas": {
     "AliasContext": {
diff --git a/googleapiclient/discovery_cache/documents/orgpolicy.v2.json b/googleapiclient/discovery_cache/documents/orgpolicy.v2.json
index 619b2ed..e288916 100644
--- a/googleapiclient/discovery_cache/documents/orgpolicy.v2.json
+++ b/googleapiclient/discovery_cache/documents/orgpolicy.v2.json
@@ -751,7 +751,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://orgpolicy.googleapis.com/",
   "schemas": {
     "GoogleCloudOrgpolicyV2Constraint": {
diff --git a/googleapiclient/discovery_cache/documents/osconfig.v1.json b/googleapiclient/discovery_cache/documents/osconfig.v1.json
index c63a47f..f5d8470 100644
--- a/googleapiclient/discovery_cache/documents/osconfig.v1.json
+++ b/googleapiclient/discovery_cache/documents/osconfig.v1.json
@@ -476,7 +476,7 @@
       }
     }
   },
-  "revision": "20210710",
+  "revision": "20210723",
   "rootUrl": "https://osconfig.googleapis.com/",
   "schemas": {
     "AptSettings": {
diff --git a/googleapiclient/discovery_cache/documents/osconfig.v1alpha.json b/googleapiclient/discovery_cache/documents/osconfig.v1alpha.json
index 1f008b6..54fe82b 100644
--- a/googleapiclient/discovery_cache/documents/osconfig.v1alpha.json
+++ b/googleapiclient/discovery_cache/documents/osconfig.v1alpha.json
@@ -610,7 +610,7 @@
       }
     }
   },
-  "revision": "20210710",
+  "revision": "20210723",
   "rootUrl": "https://osconfig.googleapis.com/",
   "schemas": {
     "CVSSv3": {
@@ -765,6 +765,28 @@
       "properties": {},
       "type": "object"
     },
+    "Date": {
+      "description": "Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.",
+      "id": "Date",
+      "properties": {
+        "day": {
+          "description": "Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "month": {
+          "description": "Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "year": {
+          "description": "Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.",
+          "format": "int32",
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
     "Empty": {
       "description": "A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); } The JSON representation for `Empty` is empty JSON object `{}`.",
       "id": "Empty",
@@ -1038,6 +1060,10 @@
           "$ref": "InventoryWindowsQuickFixEngineeringPackage",
           "description": "Details of a Windows Quick Fix engineering package. See https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-quickfixengineering for info in Windows Quick Fix Engineering."
         },
+        "windowsApplication": {
+          "$ref": "InventoryWindowsApplication",
+          "description": "Details of Windows Application."
+        },
         "wuaPackage": {
           "$ref": "InventoryWindowsUpdatePackage",
           "description": "Details of a Windows Update package. See https://docs.microsoft.com/en-us/windows/win32/api/_wua/ for information about Windows Update."
@@ -1076,6 +1102,33 @@
       },
       "type": "object"
     },
+    "InventoryWindowsApplication": {
+      "description": "Contains information about a Windows application as retrieved from the Windows Registry. For more information about these fields, see [Windows Installer Properties for the Uninstall Registry](https://docs.microsoft.com/en-us/windows/win32/msi/uninstall-registry-key){: class=\"external\" }",
+      "id": "InventoryWindowsApplication",
+      "properties": {
+        "displayName": {
+          "description": "The name of the application or product.",
+          "type": "string"
+        },
+        "displayVersion": {
+          "description": "The version of the product or application in string format.",
+          "type": "string"
+        },
+        "helpLink": {
+          "description": "The internet address for technical support.",
+          "type": "string"
+        },
+        "installDate": {
+          "$ref": "Date",
+          "description": "The last time this product received service. The value of this property is replaced each time a patch is applied or removed from the product or the command-line option is used to repair the product."
+        },
+        "publisher": {
+          "description": "The name of the manufacturer for the product or application.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "InventoryWindowsQuickFixEngineeringPackage": {
       "description": "Information related to a Quick Fix Engineering package. Fields are taken from Windows QuickFixEngineering Interface and match the source names: https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-quickfixengineering",
       "id": "InventoryWindowsQuickFixEngineeringPackage",
diff --git a/googleapiclient/discovery_cache/documents/osconfig.v1beta.json b/googleapiclient/discovery_cache/documents/osconfig.v1beta.json
index 9cce1c9..00856cb 100644
--- a/googleapiclient/discovery_cache/documents/osconfig.v1beta.json
+++ b/googleapiclient/discovery_cache/documents/osconfig.v1beta.json
@@ -599,7 +599,7 @@
       }
     }
   },
-  "revision": "20210710",
+  "revision": "20210723",
   "rootUrl": "https://osconfig.googleapis.com/",
   "schemas": {
     "AptRepository": {
diff --git a/googleapiclient/discovery_cache/documents/pagespeedonline.v5.json b/googleapiclient/discovery_cache/documents/pagespeedonline.v5.json
index 3cd7c2a..4e6a862 100644
--- a/googleapiclient/discovery_cache/documents/pagespeedonline.v5.json
+++ b/googleapiclient/discovery_cache/documents/pagespeedonline.v5.json
@@ -193,7 +193,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210730",
   "rootUrl": "https://pagespeedonline.googleapis.com/",
   "schemas": {
     "AuditRefs": {
diff --git a/googleapiclient/discovery_cache/documents/paymentsresellersubscription.v1.json b/googleapiclient/discovery_cache/documents/paymentsresellersubscription.v1.json
index 40cf93d..11cd57a 100644
--- a/googleapiclient/discovery_cache/documents/paymentsresellersubscription.v1.json
+++ b/googleapiclient/discovery_cache/documents/paymentsresellersubscription.v1.json
@@ -366,7 +366,7 @@
       }
     }
   },
-  "revision": "20210725",
+  "revision": "20210801",
   "rootUrl": "https://paymentsresellersubscription.googleapis.com/",
   "schemas": {
     "GoogleCloudPaymentsResellerSubscriptionV1CancelSubscriptionRequest": {
diff --git a/googleapiclient/discovery_cache/documents/people.v1.json b/googleapiclient/discovery_cache/documents/people.v1.json
index 83025d0..8dd60fb 100644
--- a/googleapiclient/discovery_cache/documents/people.v1.json
+++ b/googleapiclient/discovery_cache/documents/people.v1.json
@@ -424,7 +424,7 @@
               "type": "boolean"
             },
             "sources": {
-              "description": "Optional. A mask of what source types to return. Defaults to READ_SOURCE_TYPE_CONTACT if not set.",
+              "description": "Optional. A mask of what source types to return. Defaults to READ_SOURCE_TYPE_CONTACT if not set. If READ_SOURCE_TYPE_CONTACT is used, valid values for the readMask are: * emailAddresses * metadata * names * phoneNumbers * photos If READ_SOURCE_TYPE_PROFILE is used, valid values for the readMask are: * addresses * ageRanges * biographies * birthdays * calendarUrls * clientData * coverPhotos * emailAddresses * events * externalIds * genders * imClients * interests * locales * locations * memberships * metadata * miscKeywords * names * nicknames * occupations * organizations * phoneNumbers * photos * relations * sipAddresses * skills * urls * userDefined",
               "enum": [
                 "READ_SOURCE_TYPE_UNSPECIFIED",
                 "READ_SOURCE_TYPE_PROFILE",
@@ -1172,7 +1172,7 @@
       }
     }
   },
-  "revision": "20210720",
+  "revision": "20210726",
   "rootUrl": "https://people.googleapis.com/",
   "schemas": {
     "Address": {
diff --git a/googleapiclient/discovery_cache/documents/playablelocations.v3.json b/googleapiclient/discovery_cache/documents/playablelocations.v3.json
index d9c6603..bd42f23 100644
--- a/googleapiclient/discovery_cache/documents/playablelocations.v3.json
+++ b/googleapiclient/discovery_cache/documents/playablelocations.v3.json
@@ -146,7 +146,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://playablelocations.googleapis.com/",
   "schemas": {
     "GoogleMapsPlayablelocationsV3Impression": {
diff --git a/googleapiclient/discovery_cache/documents/playcustomapp.v1.json b/googleapiclient/discovery_cache/documents/playcustomapp.v1.json
index f7b663b..3131423 100644
--- a/googleapiclient/discovery_cache/documents/playcustomapp.v1.json
+++ b/googleapiclient/discovery_cache/documents/playcustomapp.v1.json
@@ -158,7 +158,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://playcustomapp.googleapis.com/",
   "schemas": {
     "CustomApp": {
diff --git a/googleapiclient/discovery_cache/documents/policyanalyzer.v1.json b/googleapiclient/discovery_cache/documents/policyanalyzer.v1.json
new file mode 100644
index 0000000..99ed159
--- /dev/null
+++ b/googleapiclient/discovery_cache/documents/policyanalyzer.v1.json
@@ -0,0 +1,235 @@
+{
+  "auth": {
+    "oauth2": {
+      "scopes": {
+        "https://www.googleapis.com/auth/cloud-platform": {
+          "description": "See, edit, configure, and delete your Google Cloud Platform data"
+        }
+      }
+    }
+  },
+  "basePath": "",
+  "baseUrl": "https://policyanalyzer.googleapis.com/",
+  "batchPath": "batch",
+  "canonicalName": "Policy Analyzer",
+  "description": "",
+  "discoveryVersion": "v1",
+  "documentationLink": "https://www.google.com",
+  "fullyEncodeReservedExpansion": true,
+  "icons": {
+    "x16": "http://www.google.com/images/icons/product/search-16.gif",
+    "x32": "http://www.google.com/images/icons/product/search-32.gif"
+  },
+  "id": "policyanalyzer:v1",
+  "kind": "discovery#restDescription",
+  "mtlsRootUrl": "https://policyanalyzer.mtls.googleapis.com/",
+  "name": "policyanalyzer",
+  "ownerDomain": "google.com",
+  "ownerName": "Google",
+  "parameters": {
+    "$.xgafv": {
+      "description": "V1 error format.",
+      "enum": [
+        "1",
+        "2"
+      ],
+      "enumDescriptions": [
+        "v1 error format",
+        "v2 error format"
+      ],
+      "location": "query",
+      "type": "string"
+    },
+    "access_token": {
+      "description": "OAuth access token.",
+      "location": "query",
+      "type": "string"
+    },
+    "alt": {
+      "default": "json",
+      "description": "Data format for response.",
+      "enum": [
+        "json",
+        "media",
+        "proto"
+      ],
+      "enumDescriptions": [
+        "Responses with Content-Type of application/json",
+        "Media download with context-dependent Content-Type",
+        "Responses with Content-Type of application/x-protobuf"
+      ],
+      "location": "query",
+      "type": "string"
+    },
+    "callback": {
+      "description": "JSONP",
+      "location": "query",
+      "type": "string"
+    },
+    "fields": {
+      "description": "Selector specifying which fields to include in a partial response.",
+      "location": "query",
+      "type": "string"
+    },
+    "key": {
+      "description": "API key. Your API key identifies your project and provides you with API access, quota, and reports. Required unless you provide an OAuth 2.0 token.",
+      "location": "query",
+      "type": "string"
+    },
+    "oauth_token": {
+      "description": "OAuth 2.0 token for the current user.",
+      "location": "query",
+      "type": "string"
+    },
+    "prettyPrint": {
+      "default": "true",
+      "description": "Returns response with indentations and line breaks.",
+      "location": "query",
+      "type": "boolean"
+    },
+    "quotaUser": {
+      "description": "Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters.",
+      "location": "query",
+      "type": "string"
+    },
+    "uploadType": {
+      "description": "Legacy upload protocol for media (e.g. \"media\", \"multipart\").",
+      "location": "query",
+      "type": "string"
+    },
+    "upload_protocol": {
+      "description": "Upload protocol for media (e.g. \"raw\", \"multipart\").",
+      "location": "query",
+      "type": "string"
+    }
+  },
+  "protocol": "rest",
+  "resources": {
+    "projects": {
+      "resources": {
+        "locations": {
+          "resources": {
+            "activityTypes": {
+              "resources": {
+                "activities": {
+                  "methods": {
+                    "query": {
+                      "description": "Queries policy activities on GCP resources.",
+                      "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/activityTypes/{activityTypesId}/activities:query",
+                      "httpMethod": "GET",
+                      "id": "policyanalyzer.projects.locations.activityTypes.activities.query",
+                      "parameterOrder": [
+                        "parent"
+                      ],
+                      "parameters": {
+                        "filter": {
+                          "description": "Optional. Optional filter expression to restrict the activities returned. Supported filters are: - service_account_last_authn.full_resource_name {=} - service_account_key_last_authn.full_resource_name {=} ",
+                          "location": "query",
+                          "type": "string"
+                        },
+                        "pageSize": {
+                          "description": "Optional. The maximum number of results to return from this request. Max limit is 1000. Non-positive values are ignored. The presence of `nextPageToken` in the response indicates that more results might be available.",
+                          "format": "int32",
+                          "location": "query",
+                          "type": "integer"
+                        },
+                        "pageToken": {
+                          "description": "Optional. If present, then retrieve the next batch of results from the preceding call to this method. `pageToken` must be the value of `nextPageToken` from the previous response. The values of other method parameters should be identical to those in the previous call.",
+                          "location": "query",
+                          "type": "string"
+                        },
+                        "parent": {
+                          "description": "Required. The container resource on which to execute the request. Acceptable formats: `projects/[PROJECT_ID|PROJECT_NUMBER]/locations/[LOCATION]/activityTypes/[ACTIVITY_TYPE]` LOCATION here refers to GCP Locations: https://cloud.google.com/about/locations/",
+                          "location": "path",
+                          "pattern": "^projects/[^/]+/locations/[^/]+/activityTypes/[^/]+$",
+                          "required": true,
+                          "type": "string"
+                        }
+                      },
+                      "path": "v1/{+parent}/activities:query",
+                      "response": {
+                        "$ref": "GoogleCloudPolicyanalyzerV1QueryActivityResponse"
+                      },
+                      "scopes": [
+                        "https://www.googleapis.com/auth/cloud-platform"
+                      ]
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  },
+  "revision": "20210723",
+  "rootUrl": "https://policyanalyzer.googleapis.com/",
+  "schemas": {
+    "GoogleCloudPolicyanalyzerV1Activity": {
+      "id": "GoogleCloudPolicyanalyzerV1Activity",
+      "properties": {
+        "activity": {
+          "additionalProperties": {
+            "description": "Properties of the object.",
+            "type": "any"
+          },
+          "description": "A struct of custom fields to explain the activity.",
+          "type": "object"
+        },
+        "activityType": {
+          "description": "The type of the activity.",
+          "type": "string"
+        },
+        "fullResourceName": {
+          "description": "The full resource name that identifies the resource. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names.",
+          "type": "string"
+        },
+        "observationPeriod": {
+          "$ref": "GoogleCloudPolicyanalyzerV1ObservationPeriod",
+          "description": "The data observation period to build the activity."
+        }
+      },
+      "type": "object"
+    },
+    "GoogleCloudPolicyanalyzerV1ObservationPeriod": {
+      "description": "Represents data observation period.",
+      "id": "GoogleCloudPolicyanalyzerV1ObservationPeriod",
+      "properties": {
+        "endTime": {
+          "description": "The observation end time.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "startTime": {
+          "description": "The observation start time.",
+          "format": "google-datetime",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "GoogleCloudPolicyanalyzerV1QueryActivityResponse": {
+      "description": "Response to the `QueryActivity` method.",
+      "id": "GoogleCloudPolicyanalyzerV1QueryActivityResponse",
+      "properties": {
+        "activities": {
+          "description": "The set of activities that match the filter included in the request.",
+          "items": {
+            "$ref": "GoogleCloudPolicyanalyzerV1Activity"
+          },
+          "type": "array"
+        },
+        "nextPageToken": {
+          "description": "If there might be more results than those appearing in this response, then `nextPageToken` is included. To get the next set of results, call this method again using the value of `nextPageToken` as `pageToken`.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "servicePath": "",
+  "title": "Policy Analyzer API",
+  "version": "v1",
+  "version_module": true
+}
\ No newline at end of file
diff --git a/googleapiclient/discovery_cache/documents/policyanalyzer.v1beta1.json b/googleapiclient/discovery_cache/documents/policyanalyzer.v1beta1.json
new file mode 100644
index 0000000..a18d3e8
--- /dev/null
+++ b/googleapiclient/discovery_cache/documents/policyanalyzer.v1beta1.json
@@ -0,0 +1,235 @@
+{
+  "auth": {
+    "oauth2": {
+      "scopes": {
+        "https://www.googleapis.com/auth/cloud-platform": {
+          "description": "See, edit, configure, and delete your Google Cloud Platform data"
+        }
+      }
+    }
+  },
+  "basePath": "",
+  "baseUrl": "https://policyanalyzer.googleapis.com/",
+  "batchPath": "batch",
+  "canonicalName": "Policy Analyzer",
+  "description": "",
+  "discoveryVersion": "v1",
+  "documentationLink": "https://www.google.com",
+  "fullyEncodeReservedExpansion": true,
+  "icons": {
+    "x16": "http://www.google.com/images/icons/product/search-16.gif",
+    "x32": "http://www.google.com/images/icons/product/search-32.gif"
+  },
+  "id": "policyanalyzer:v1beta1",
+  "kind": "discovery#restDescription",
+  "mtlsRootUrl": "https://policyanalyzer.mtls.googleapis.com/",
+  "name": "policyanalyzer",
+  "ownerDomain": "google.com",
+  "ownerName": "Google",
+  "parameters": {
+    "$.xgafv": {
+      "description": "V1 error format.",
+      "enum": [
+        "1",
+        "2"
+      ],
+      "enumDescriptions": [
+        "v1 error format",
+        "v2 error format"
+      ],
+      "location": "query",
+      "type": "string"
+    },
+    "access_token": {
+      "description": "OAuth access token.",
+      "location": "query",
+      "type": "string"
+    },
+    "alt": {
+      "default": "json",
+      "description": "Data format for response.",
+      "enum": [
+        "json",
+        "media",
+        "proto"
+      ],
+      "enumDescriptions": [
+        "Responses with Content-Type of application/json",
+        "Media download with context-dependent Content-Type",
+        "Responses with Content-Type of application/x-protobuf"
+      ],
+      "location": "query",
+      "type": "string"
+    },
+    "callback": {
+      "description": "JSONP",
+      "location": "query",
+      "type": "string"
+    },
+    "fields": {
+      "description": "Selector specifying which fields to include in a partial response.",
+      "location": "query",
+      "type": "string"
+    },
+    "key": {
+      "description": "API key. Your API key identifies your project and provides you with API access, quota, and reports. Required unless you provide an OAuth 2.0 token.",
+      "location": "query",
+      "type": "string"
+    },
+    "oauth_token": {
+      "description": "OAuth 2.0 token for the current user.",
+      "location": "query",
+      "type": "string"
+    },
+    "prettyPrint": {
+      "default": "true",
+      "description": "Returns response with indentations and line breaks.",
+      "location": "query",
+      "type": "boolean"
+    },
+    "quotaUser": {
+      "description": "Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters.",
+      "location": "query",
+      "type": "string"
+    },
+    "uploadType": {
+      "description": "Legacy upload protocol for media (e.g. \"media\", \"multipart\").",
+      "location": "query",
+      "type": "string"
+    },
+    "upload_protocol": {
+      "description": "Upload protocol for media (e.g. \"raw\", \"multipart\").",
+      "location": "query",
+      "type": "string"
+    }
+  },
+  "protocol": "rest",
+  "resources": {
+    "projects": {
+      "resources": {
+        "locations": {
+          "resources": {
+            "activityTypes": {
+              "resources": {
+                "activities": {
+                  "methods": {
+                    "query": {
+                      "description": "Queries policy activities on GCP resources.",
+                      "flatPath": "v1beta1/projects/{projectsId}/locations/{locationsId}/activityTypes/{activityTypesId}/activities:query",
+                      "httpMethod": "GET",
+                      "id": "policyanalyzer.projects.locations.activityTypes.activities.query",
+                      "parameterOrder": [
+                        "parent"
+                      ],
+                      "parameters": {
+                        "filter": {
+                          "description": "Optional. Optional filter expression to restrict the activities returned. Supported filters are: - service_account_last_authn.full_resource_name {=} - service_account_key_last_authn.full_resource_name {=} ",
+                          "location": "query",
+                          "type": "string"
+                        },
+                        "pageSize": {
+                          "description": "Optional. The maximum number of results to return from this request. Max limit is 1000. Non-positive values are ignored. The presence of `nextPageToken` in the response indicates that more results might be available.",
+                          "format": "int32",
+                          "location": "query",
+                          "type": "integer"
+                        },
+                        "pageToken": {
+                          "description": "Optional. If present, then retrieve the next batch of results from the preceding call to this method. `pageToken` must be the value of `nextPageToken` from the previous response. The values of other method parameters should be identical to those in the previous call.",
+                          "location": "query",
+                          "type": "string"
+                        },
+                        "parent": {
+                          "description": "Required. The container resource on which to execute the request. Acceptable formats: `projects/[PROJECT_ID|PROJECT_NUMBER]/locations/[LOCATION]/activityTypes/[ACTIVITY_TYPE]` LOCATION here refers to GCP Locations: https://cloud.google.com/about/locations/",
+                          "location": "path",
+                          "pattern": "^projects/[^/]+/locations/[^/]+/activityTypes/[^/]+$",
+                          "required": true,
+                          "type": "string"
+                        }
+                      },
+                      "path": "v1beta1/{+parent}/activities:query",
+                      "response": {
+                        "$ref": "GoogleCloudPolicyanalyzerV1beta1QueryActivityResponse"
+                      },
+                      "scopes": [
+                        "https://www.googleapis.com/auth/cloud-platform"
+                      ]
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  },
+  "revision": "20210723",
+  "rootUrl": "https://policyanalyzer.googleapis.com/",
+  "schemas": {
+    "GoogleCloudPolicyanalyzerV1beta1Activity": {
+      "id": "GoogleCloudPolicyanalyzerV1beta1Activity",
+      "properties": {
+        "activity": {
+          "additionalProperties": {
+            "description": "Properties of the object.",
+            "type": "any"
+          },
+          "description": "A struct of custom fields to explain the activity.",
+          "type": "object"
+        },
+        "activityType": {
+          "description": "The type of the activity.",
+          "type": "string"
+        },
+        "fullResourceName": {
+          "description": "The full resource name that identifies the resource. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names.",
+          "type": "string"
+        },
+        "observationPeriod": {
+          "$ref": "GoogleCloudPolicyanalyzerV1beta1ObservationPeriod",
+          "description": "The data observation period to build the activity."
+        }
+      },
+      "type": "object"
+    },
+    "GoogleCloudPolicyanalyzerV1beta1ObservationPeriod": {
+      "description": "Represents data observation period.",
+      "id": "GoogleCloudPolicyanalyzerV1beta1ObservationPeriod",
+      "properties": {
+        "endTime": {
+          "description": "The observation end time.",
+          "format": "google-datetime",
+          "type": "string"
+        },
+        "startTime": {
+          "description": "The observation start time.",
+          "format": "google-datetime",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "GoogleCloudPolicyanalyzerV1beta1QueryActivityResponse": {
+      "description": "Response to the `QueryActivity` method.",
+      "id": "GoogleCloudPolicyanalyzerV1beta1QueryActivityResponse",
+      "properties": {
+        "activities": {
+          "description": "The set of activities that match the filter included in the request.",
+          "items": {
+            "$ref": "GoogleCloudPolicyanalyzerV1beta1Activity"
+          },
+          "type": "array"
+        },
+        "nextPageToken": {
+          "description": "If there might be more results than those appearing in this response, then `nextPageToken` is included. To get the next set of results, call this method again using the value of `nextPageToken` as `pageToken`.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "servicePath": "",
+  "title": "Policy Analyzer API",
+  "version": "v1beta1",
+  "version_module": true
+}
\ No newline at end of file
diff --git a/googleapiclient/discovery_cache/documents/policysimulator.v1.json b/googleapiclient/discovery_cache/documents/policysimulator.v1.json
index 78ec766..c184383 100644
--- a/googleapiclient/discovery_cache/documents/policysimulator.v1.json
+++ b/googleapiclient/discovery_cache/documents/policysimulator.v1.json
@@ -493,7 +493,7 @@
       }
     }
   },
-  "revision": "20210717",
+  "revision": "20210723",
   "rootUrl": "https://policysimulator.googleapis.com/",
   "schemas": {
     "GoogleCloudPolicysimulatorV1AccessStateDiff": {
diff --git a/googleapiclient/discovery_cache/documents/policysimulator.v1beta1.json b/googleapiclient/discovery_cache/documents/policysimulator.v1beta1.json
index ff09197..09e7f5d 100644
--- a/googleapiclient/discovery_cache/documents/policysimulator.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/policysimulator.v1beta1.json
@@ -493,7 +493,7 @@
       }
     }
   },
-  "revision": "20210717",
+  "revision": "20210723",
   "rootUrl": "https://policysimulator.googleapis.com/",
   "schemas": {
     "GoogleCloudPolicysimulatorV1Replay": {
diff --git a/googleapiclient/discovery_cache/documents/policytroubleshooter.v1.json b/googleapiclient/discovery_cache/documents/policytroubleshooter.v1.json
index 35d7e8b..54b88ce 100644
--- a/googleapiclient/discovery_cache/documents/policytroubleshooter.v1.json
+++ b/googleapiclient/discovery_cache/documents/policytroubleshooter.v1.json
@@ -128,7 +128,7 @@
       }
     }
   },
-  "revision": "20210717",
+  "revision": "20210724",
   "rootUrl": "https://policytroubleshooter.googleapis.com/",
   "schemas": {
     "GoogleCloudPolicytroubleshooterV1AccessTuple": {
diff --git a/googleapiclient/discovery_cache/documents/policytroubleshooter.v1beta.json b/googleapiclient/discovery_cache/documents/policytroubleshooter.v1beta.json
index e3dd76a..e82b3c1 100644
--- a/googleapiclient/discovery_cache/documents/policytroubleshooter.v1beta.json
+++ b/googleapiclient/discovery_cache/documents/policytroubleshooter.v1beta.json
@@ -128,7 +128,7 @@
       }
     }
   },
-  "revision": "20210717",
+  "revision": "20210724",
   "rootUrl": "https://policytroubleshooter.googleapis.com/",
   "schemas": {
     "GoogleCloudPolicytroubleshooterV1betaAccessTuple": {
diff --git a/googleapiclient/discovery_cache/documents/privateca.v1.json b/googleapiclient/discovery_cache/documents/privateca.v1.json
index f4b09b0..d46ea68 100644
--- a/googleapiclient/discovery_cache/documents/privateca.v1.json
+++ b/googleapiclient/discovery_cache/documents/privateca.v1.json
@@ -1590,7 +1590,7 @@
       }
     }
   },
-  "revision": "20210714",
+  "revision": "20210721",
   "rootUrl": "https://privateca.googleapis.com/",
   "schemas": {
     "AccessUrls": {
@@ -3268,7 +3268,7 @@
       "id": "SubordinateConfig",
       "properties": {
         "certificateAuthority": {
-          "description": "Required. This can refer to a CertificateAuthority in the same project that was used to create a subordinate CertificateAuthority. This field is used for information and usability purposes only. The resource name is in the format `projects/*/locations/*/caPools/*/certificateAuthorities/*`.",
+          "description": "Required. This can refer to a CertificateAuthority that was used to create a subordinate CertificateAuthority. This field is used for information and usability purposes only. The resource name is in the format `projects/*/locations/*/caPools/*/certificateAuthorities/*`.",
           "type": "string"
         },
         "pemIssuerChain": {
diff --git a/googleapiclient/discovery_cache/documents/prod_tt_sasportal.v1alpha1.json b/googleapiclient/discovery_cache/documents/prod_tt_sasportal.v1alpha1.json
index fd1177a..642c973 100644
--- a/googleapiclient/discovery_cache/documents/prod_tt_sasportal.v1alpha1.json
+++ b/googleapiclient/discovery_cache/documents/prod_tt_sasportal.v1alpha1.json
@@ -2484,7 +2484,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://prod-tt-sasportal.googleapis.com/",
   "schemas": {
     "SasPortalAssignment": {
diff --git a/googleapiclient/discovery_cache/documents/pubsub.v1.json b/googleapiclient/discovery_cache/documents/pubsub.v1.json
index 5905e02..93cde80 100644
--- a/googleapiclient/discovery_cache/documents/pubsub.v1.json
+++ b/googleapiclient/discovery_cache/documents/pubsub.v1.json
@@ -1424,7 +1424,7 @@
       }
     }
   },
-  "revision": "20210712",
+  "revision": "20210720",
   "rootUrl": "https://pubsub.googleapis.com/",
   "schemas": {
     "AcknowledgeRequest": {
diff --git a/googleapiclient/discovery_cache/documents/pubsub.v1beta1a.json b/googleapiclient/discovery_cache/documents/pubsub.v1beta1a.json
index bb89476..ea84e81 100644
--- a/googleapiclient/discovery_cache/documents/pubsub.v1beta1a.json
+++ b/googleapiclient/discovery_cache/documents/pubsub.v1beta1a.json
@@ -457,7 +457,7 @@
       }
     }
   },
-  "revision": "20210712",
+  "revision": "20210720",
   "rootUrl": "https://pubsub.googleapis.com/",
   "schemas": {
     "AcknowledgeRequest": {
diff --git a/googleapiclient/discovery_cache/documents/pubsub.v1beta2.json b/googleapiclient/discovery_cache/documents/pubsub.v1beta2.json
index b3397da..ae7bccc 100644
--- a/googleapiclient/discovery_cache/documents/pubsub.v1beta2.json
+++ b/googleapiclient/discovery_cache/documents/pubsub.v1beta2.json
@@ -724,7 +724,7 @@
       }
     }
   },
-  "revision": "20210712",
+  "revision": "20210720",
   "rootUrl": "https://pubsub.googleapis.com/",
   "schemas": {
     "AcknowledgeRequest": {
diff --git a/googleapiclient/discovery_cache/documents/pubsublite.v1.json b/googleapiclient/discovery_cache/documents/pubsublite.v1.json
index fb52f25..51b153e 100644
--- a/googleapiclient/discovery_cache/documents/pubsublite.v1.json
+++ b/googleapiclient/discovery_cache/documents/pubsublite.v1.json
@@ -690,7 +690,7 @@
       }
     }
   },
-  "revision": "20210720",
+  "revision": "20210727",
   "rootUrl": "https://pubsublite.googleapis.com/",
   "schemas": {
     "Capacity": {
diff --git a/googleapiclient/discovery_cache/documents/realtimebidding.v1.json b/googleapiclient/discovery_cache/documents/realtimebidding.v1.json
index a12a76b..7fd6a65 100644
--- a/googleapiclient/discovery_cache/documents/realtimebidding.v1.json
+++ b/googleapiclient/discovery_cache/documents/realtimebidding.v1.json
@@ -1140,7 +1140,7 @@
       }
     }
   },
-  "revision": "20210724",
+  "revision": "20210731",
   "rootUrl": "https://realtimebidding.googleapis.com/",
   "schemas": {
     "ActivatePretargetingConfigRequest": {
diff --git a/googleapiclient/discovery_cache/documents/realtimebidding.v1alpha.json b/googleapiclient/discovery_cache/documents/realtimebidding.v1alpha.json
index f20edd4..51ab88e 100644
--- a/googleapiclient/discovery_cache/documents/realtimebidding.v1alpha.json
+++ b/googleapiclient/discovery_cache/documents/realtimebidding.v1alpha.json
@@ -234,7 +234,7 @@
       }
     }
   },
-  "revision": "20210724",
+  "revision": "20210731",
   "rootUrl": "https://realtimebidding.googleapis.com/",
   "schemas": {
     "ActivateBiddingFunctionRequest": {
diff --git a/googleapiclient/discovery_cache/documents/recaptchaenterprise.v1.json b/googleapiclient/discovery_cache/documents/recaptchaenterprise.v1.json
index 0a76a21..b99df38 100644
--- a/googleapiclient/discovery_cache/documents/recaptchaenterprise.v1.json
+++ b/googleapiclient/discovery_cache/documents/recaptchaenterprise.v1.json
@@ -375,7 +375,7 @@
       }
     }
   },
-  "revision": "20210717",
+  "revision": "20210723",
   "rootUrl": "https://recaptchaenterprise.googleapis.com/",
   "schemas": {
     "GoogleCloudRecaptchaenterpriseV1AndroidKeySettings": {
diff --git a/googleapiclient/discovery_cache/documents/recommendationengine.v1beta1.json b/googleapiclient/discovery_cache/documents/recommendationengine.v1beta1.json
index a9e6cb0..610d044 100644
--- a/googleapiclient/discovery_cache/documents/recommendationengine.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/recommendationengine.v1beta1.json
@@ -842,7 +842,7 @@
       }
     }
   },
-  "revision": "20210702",
+  "revision": "20210731",
   "rootUrl": "https://recommendationengine.googleapis.com/",
   "schemas": {
     "GoogleApiHttpBody": {
diff --git a/googleapiclient/discovery_cache/documents/recommender.v1.json b/googleapiclient/discovery_cache/documents/recommender.v1.json
index d3d0120..3d3293b 100644
--- a/googleapiclient/discovery_cache/documents/recommender.v1.json
+++ b/googleapiclient/discovery_cache/documents/recommender.v1.json
@@ -1178,7 +1178,7 @@
       }
     }
   },
-  "revision": "20210717",
+  "revision": "20210723",
   "rootUrl": "https://recommender.googleapis.com/",
   "schemas": {
     "GoogleCloudRecommenderV1CostProjection": {
diff --git a/googleapiclient/discovery_cache/documents/recommender.v1beta1.json b/googleapiclient/discovery_cache/documents/recommender.v1beta1.json
index 235826f..9d36b78 100644
--- a/googleapiclient/discovery_cache/documents/recommender.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/recommender.v1beta1.json
@@ -1178,7 +1178,7 @@
       }
     }
   },
-  "revision": "20210717",
+  "revision": "20210723",
   "rootUrl": "https://recommender.googleapis.com/",
   "schemas": {
     "GoogleCloudRecommenderV1beta1CostProjection": {
diff --git a/googleapiclient/discovery_cache/documents/reseller.v1.json b/googleapiclient/discovery_cache/documents/reseller.v1.json
index 9d1e9a8..9048707 100644
--- a/googleapiclient/discovery_cache/documents/reseller.v1.json
+++ b/googleapiclient/discovery_cache/documents/reseller.v1.json
@@ -631,7 +631,7 @@
       }
     }
   },
-  "revision": "20210720",
+  "revision": "20210727",
   "rootUrl": "https://reseller.googleapis.com/",
   "schemas": {
     "Address": {
diff --git a/googleapiclient/discovery_cache/documents/resourcesettings.v1.json b/googleapiclient/discovery_cache/documents/resourcesettings.v1.json
index 8e21d08..bbb99c4 100644
--- a/googleapiclient/discovery_cache/documents/resourcesettings.v1.json
+++ b/googleapiclient/discovery_cache/documents/resourcesettings.v1.json
@@ -499,7 +499,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://resourcesettings.googleapis.com/",
   "schemas": {
     "GoogleCloudResourcesettingsV1ListSettingsResponse": {
diff --git a/googleapiclient/discovery_cache/documents/retail.v2.json b/googleapiclient/discovery_cache/documents/retail.v2.json
index a8b3cc7..1aee9bb 100644
--- a/googleapiclient/discovery_cache/documents/retail.v2.json
+++ b/googleapiclient/discovery_cache/documents/retail.v2.json
@@ -112,7 +112,7 @@
             "catalogs": {
               "methods": {
                 "completeQuery": {
-                  "description": "Completes the specified prefix with keyword suggestions. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.",
+                  "description": "Completes the specified prefix with keyword suggestions. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.",
                   "flatPath": "v2/projects/{projectsId}/locations/{locationsId}/catalogs/{catalogsId}:completeQuery",
                   "httpMethod": "GET",
                   "id": "retail.projects.locations.catalogs.completeQuery",
@@ -128,7 +128,7 @@
                       "type": "string"
                     },
                     "dataset": {
-                      "description": "Determines which dataset to use for fetching completion. \"user-data\" will use the imported dataset through ImportCompletionData. \"cloud-retail\" will use the dataset generated by cloud retail based on user events. If leave empty, it will use the \"user-data\". Current supported values: * user-data * cloud-retail This option is not automatically enabled. Before using cloud-retail, contact retail-search-support@google.com first.",
+                      "description": "Determines which dataset to use for fetching completion. \"user-data\" will use the imported dataset through CompletionService.ImportCompletionData. \"cloud-retail\" will use the dataset generated by cloud retail based on user events. If leave empty, it will use the \"user-data\". Current supported values: * user-data * cloud-retail This option requires additional allowlisting. Before using cloud-retail, contact Cloud Retail support team first.",
                       "location": "query",
                       "type": "string"
                     },
@@ -144,7 +144,7 @@
                       "type": "string"
                     },
                     "maxSuggestions": {
-                      "description": "Completion max suggestions. The maximum allowed max suggestions is 20. The default value is 20.",
+                      "description": "Completion max suggestions. If left unset or set to 0, then will fallback to the configured value CompletionConfig.max_suggestions. The maximum allowed max suggestions is 20. If it is set higher, it will be capped by 20.",
                       "format": "int32",
                       "location": "query",
                       "type": "integer"
@@ -169,7 +169,7 @@
                   ]
                 },
                 "getDefaultBranch": {
-                  "description": "Get which branch is currently default branch set by CatalogService.SetDefaultBranch method under a specified parent catalog. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.",
+                  "description": "Get which branch is currently default branch set by CatalogService.SetDefaultBranch method under a specified parent catalog. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.",
                   "flatPath": "v2/projects/{projectsId}/locations/{locationsId}/catalogs/{catalogsId}:getDefaultBranch",
                   "httpMethod": "GET",
                   "id": "retail.projects.locations.catalogs.getDefaultBranch",
@@ -264,7 +264,7 @@
                   ]
                 },
                 "setDefaultBranch": {
-                  "description": "Set a specified branch id as default branch. API methods such as SearchService.Search, ProductService.GetProduct, ProductService.ListProducts will treat requests using \"default_branch\" to the actual branch id set as default. For example, if `projects/*/locations/*/catalogs/*/branches/1` is set as default, setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/default_branch` is equivalent to setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/1`. Using multiple branches can be useful when developers would like to have a staging branch to test and verify for future usage. When it becomes ready, developers switch on the staging branch using this API while keeping using `projects/*/locations/*/catalogs/*/branches/default_branch` as SearchRequest.branch to route the traffic to this staging branch. CAUTION: If you have live predict/search traffic, switching the default branch could potentially cause outages if the ID space of the new branch is very different from the old one. More specifically: * PredictionService will only return product IDs from branch {newBranch}. * SearchService will only return product IDs from branch {newBranch} (if branch is not explicitly set). * UserEventService will only join events with products from branch {newBranch}. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.",
+                  "description": "Set a specified branch id as default branch. API methods such as SearchService.Search, ProductService.GetProduct, ProductService.ListProducts will treat requests using \"default_branch\" to the actual branch id set as default. For example, if `projects/*/locations/*/catalogs/*/branches/1` is set as default, setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/default_branch` is equivalent to setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/1`. Using multiple branches can be useful when developers would like to have a staging branch to test and verify for future usage. When it becomes ready, developers switch on the staging branch using this API while keeping using `projects/*/locations/*/catalogs/*/branches/default_branch` as SearchRequest.branch to route the traffic to this staging branch. CAUTION: If you have live predict/search traffic, switching the default branch could potentially cause outages if the ID space of the new branch is very different from the old one. More specifically: * PredictionService will only return product IDs from branch {newBranch}. * SearchService will only return product IDs from branch {newBranch} (if branch is not explicitly set). * UserEventService will only join events with products from branch {newBranch}. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.",
                   "flatPath": "v2/projects/{projectsId}/locations/{locationsId}/catalogs/{catalogsId}:setDefaultBranch",
                   "httpMethod": "POST",
                   "id": "retail.projects.locations.catalogs.setDefaultBranch",
@@ -327,7 +327,7 @@
                     "products": {
                       "methods": {
                         "addFulfillmentPlaces": {
-                          "description": "Incrementally adds place IDs to Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the added place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.",
+                          "description": "Incrementally adds place IDs to Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the added place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.",
                           "flatPath": "v2/projects/{projectsId}/locations/{locationsId}/catalogs/{catalogsId}/branches/{branchesId}/products/{productsId}:addFulfillmentPlaces",
                           "httpMethod": "POST",
                           "id": "retail.projects.locations.catalogs.branches.products.addFulfillmentPlaces",
@@ -552,7 +552,7 @@
                           ]
                         },
                         "removeFulfillmentPlaces": {
-                          "description": "Incrementally removes place IDs from a Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the removed place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.",
+                          "description": "Incrementally removes place IDs from a Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the removed place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.",
                           "flatPath": "v2/projects/{projectsId}/locations/{locationsId}/catalogs/{catalogsId}/branches/{branchesId}/products/{productsId}:removeFulfillmentPlaces",
                           "httpMethod": "POST",
                           "id": "retail.projects.locations.catalogs.branches.products.removeFulfillmentPlaces",
@@ -580,7 +580,7 @@
                           ]
                         },
                         "setInventory": {
-                          "description": "Updates inventory information for a Product while respecting the last update timestamps of each inventory field. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, updates are not immediately manifested in the Product queried by GetProduct or ListProducts. When inventory is updated with CreateProduct and UpdateProduct, the specified inventory field value(s) will overwrite any existing value(s) while ignoring the last update time for this field. Furthermore, the last update time for the specified inventory fields will be overwritten to the time of the CreateProduct or UpdateProduct request. If no inventory fields are set in CreateProductRequest.product, then any pre-existing inventory information for this product will be used. If no inventory fields are set in UpdateProductRequest.set_mask, then any existing inventory information will be preserved. Pre-existing inventory information can only be updated with SetInventory, AddFulfillmentPlaces, and RemoveFulfillmentPlaces. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.",
+                          "description": "Updates inventory information for a Product while respecting the last update timestamps of each inventory field. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, updates are not immediately manifested in the Product queried by GetProduct or ListProducts. When inventory is updated with CreateProduct and UpdateProduct, the specified inventory field value(s) will overwrite any existing value(s) while ignoring the last update time for this field. Furthermore, the last update time for the specified inventory fields will be overwritten to the time of the CreateProduct or UpdateProduct request. If no inventory fields are set in CreateProductRequest.product, then any pre-existing inventory information for this product will be used. If no inventory fields are set in UpdateProductRequest.set_mask, then any existing inventory information will be preserved. Pre-existing inventory information can only be updated with SetInventory, AddFulfillmentPlaces, and RemoveFulfillmentPlaces. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.",
                           "flatPath": "v2/projects/{projectsId}/locations/{locationsId}/catalogs/{catalogsId}/branches/{branchesId}/products/{productsId}:setInventory",
                           "httpMethod": "POST",
                           "id": "retail.projects.locations.catalogs.branches.products.setInventory",
@@ -614,7 +614,7 @@
                 "completionData": {
                   "methods": {
                     "import": {
-                      "description": "Bulk import of processed completion dataset. Request processing may be synchronous. Partial updating is not supported. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.",
+                      "description": "Bulk import of processed completion dataset. Request processing may be synchronous. Partial updating is not supported. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.",
                       "flatPath": "v2/projects/{projectsId}/locations/{locationsId}/catalogs/{catalogsId}/completionData:import",
                       "httpMethod": "POST",
                       "id": "retail.projects.locations.catalogs.completionData.import",
@@ -744,7 +744,7 @@
                       ]
                     },
                     "search": {
-                      "description": "Performs a search. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.",
+                      "description": "Performs a search. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.",
                       "flatPath": "v2/projects/{projectsId}/locations/{locationsId}/catalogs/{catalogsId}/placements/{placementsId}:search",
                       "httpMethod": "POST",
                       "id": "retail.projects.locations.catalogs.placements.search",
@@ -1007,7 +1007,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210730",
   "rootUrl": "https://retail.googleapis.com/",
   "schemas": {
     "GoogleApiHttpBody": {
@@ -1307,7 +1307,7 @@
           "type": "array"
         },
         "recentSearchResults": {
-          "description": "Matched recent searches of this user. This field is a restricted feature. Contact Retail Support (retail-search-support@google.com) if you are interested in enabling it. This feature is only available when CompleteQueryRequest.visitor_id field is set and UserEvent is imported. The recent searches satisfy the follow rules: * They are ordered from latest to oldest. * They are matched with CompleteQueryRequest.query case insensitively. * They are transformed to lower cases. * They are UTF-8 safe. Recent searches are deduplicated. More recent searches will be reserved when duplication happens.",
+          "description": "Matched recent searches of this user. This field is a restricted feature. Contact Retail Search support team if you are interested in enabling it. This feature is only available when CompleteQueryRequest.visitor_id field is set and UserEvent is imported. The recent searches satisfy the follow rules: * They are ordered from latest to oldest. * They are matched with CompleteQueryRequest.query case insensitively. * They are transformed to lower cases. * They are UTF-8 safe. Recent searches are deduplicated. More recent searches will be reserved when duplication happens.",
           "items": {
             "$ref": "GoogleCloudRetailV2CompleteQueryResponseRecentSearchResult"
           },
@@ -1351,7 +1351,7 @@
       "properties": {
         "bigQuerySource": {
           "$ref": "GoogleCloudRetailV2BigQuerySource",
-          "description": "Required. BigQuery input source. Add the IAM permission \u201cBigQuery Data Viewer\u201d for cloud-retail-customer-data-access@system.gserviceaccount.com before using this feature otherwise an error is thrown."
+          "description": "Required. BigQuery input source. Add the IAM permission \"BigQuery Data Viewer\" for cloud-retail-customer-data-access@system.gserviceaccount.com before using this feature otherwise an error is thrown."
         }
       },
       "type": "object"
@@ -1584,7 +1584,7 @@
           "enumDescriptions": [
             "Defaults to INCREMENTAL.",
             "Inserts new products or updates existing products.",
-            "Calculates diff and replaces the entire product dataset. Existing products may be deleted if they are not present in the source location. Can only be while using BigQuerySource. Add the IAM permission \u201cBigQuery Data Viewer\u201d for cloud-retail-customer-data-access@system.gserviceaccount.com before using this feature otherwise an error is thrown. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search."
+            "Calculates diff and replaces the entire product dataset. Existing products may be deleted if they are not present in the source location. Can only be while using BigQuerySource. Add the IAM permission \"BigQuery Data Viewer\" for cloud-retail-customer-data-access@system.gserviceaccount.com before using this feature otherwise an error is thrown. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search."
           ],
           "type": "string"
         },
@@ -2016,7 +2016,7 @@
           "description": "The rating of this product."
         },
         "retrievableFields": {
-          "description": "Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form \"attributes.key\" where \"key\" is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.",
+          "description": "Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form \"attributes.key\" where \"key\" is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.",
           "format": "google-fieldmask",
           "type": "string"
         },
@@ -2080,7 +2080,7 @@
       "properties": {
         "product": {
           "$ref": "GoogleCloudRetailV2Product",
-          "description": "Required. Product information. Only Product.id field is used when ingesting an event, all other product fields are ignored as we will look them up from the catalog."
+          "description": "Required. Product information. Required field(s): * Product.id Optional override field(s): * Product.price_info If any supported optional fields are provided, we will treat them as a full override when looking up product information from the catalog. Thus, it is important to ensure that the overriding fields are accurate and complete. All other product fields are ignored and instead populated via catalog lookup after event ingestion."
         },
         "quantity": {
           "description": "Quantity of the product associated with the user event. For example, this field will be 2 if two products are added to the shopping cart for `purchase-complete` event. Required for `add-to-cart` and `purchase-complete` event types.",
@@ -2333,7 +2333,7 @@
         },
         "dynamicFacetSpec": {
           "$ref": "GoogleCloudRetailV2SearchRequestDynamicFacetSpec",
-          "description": "The specification for dynamically generated facets. Notice that only textual facets can be dynamically generated. This feature requires additional allowlisting. Contact Retail Support (retail-search-support@google.com) if you are interested in using dynamic facet feature."
+          "description": "The specification for dynamically generated facets. Notice that only textual facets can be dynamically generated. This feature requires additional allowlisting. Contact Retail Search support team if you are interested in using dynamic facet feature."
         },
         "facetSpecs": {
           "description": "Facet specifications for faceted search. If empty, no facets are returned. A maximum of 100 values are allowed. Otherwise, an INVALID_ARGUMENT error is returned.",
@@ -2384,7 +2384,7 @@
           "description": "User information."
         },
         "variantRollupKeys": {
-          "description": "The keys to fetch and rollup the matching variant Products attributes. The attributes from all the matching variant Products are merged and de-duplicated. Notice that rollup variant Products attributes will lead to extra query latency. Maximum number of keys is 10. For Product.fulfillment_info, a fulfillment type and a fulfillment ID must be provided in the format of \"fulfillmentType.filfillmentId\". E.g., in \"pickupInStore.store123\", \"pickupInStore\" is fulfillment type and \"store123\" is the store ID. Supported keys are: * colorFamilies * price * originalPrice * discount * attributes.key, where key is any key in the Product.attributes map. * pickupInStore.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.PICKUP_IN_STORE. * shipToStore.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.SHIP_TO_STORE. * sameDayDelivery.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.SAME_DAY_DELIVERY. * nextDayDelivery.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.NEXT_DAY_DELIVERY. * customFulfillment1.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_1. * customFulfillment2.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_2. * customFulfillment3.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_3. * customFulfillment4.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_4. * customFulfillment5.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_5. If this field is set to an invalid value other than these, an INVALID_ARGUMENT error is returned.",
+          "description": "The keys to fetch and rollup the matching variant Products attributes. The attributes from all the matching variant Products are merged and de-duplicated. Notice that rollup variant Products attributes will lead to extra query latency. Maximum number of keys is 10. For FulfillmentInfo, a fulfillment type and a fulfillment ID must be provided in the format of \"fulfillmentType.fulfillmentId\". E.g., in \"pickupInStore.store123\", \"pickupInStore\" is fulfillment type and \"store123\" is the store ID. Supported keys are: * colorFamilies * price * originalPrice * discount * attributes.key, where key is any key in the Product.attributes map. * pickupInStore.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"pickup-in-store\". * shipToStore.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"ship-to-store\". * sameDayDelivery.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"same-day-delivery\". * nextDayDelivery.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"next-day-delivery\". * customFulfillment1.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"custom-type-1\". * customFulfillment2.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"custom-type-2\". * customFulfillment3.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"custom-type-3\". * customFulfillment4.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"custom-type-4\". * customFulfillment5.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"custom-type-5\". If this field is set to an invalid value other than these, an INVALID_ARGUMENT error is returned.",
           "items": {
             "type": "string"
           },
@@ -2494,11 +2494,11 @@
           "type": "array"
         },
         "key": {
-          "description": "Required. Supported textual and numerical facet keys in Product object, over which the facet values are computed. Facet key is case-sensitive. Allowed facet keys when FacetKey.query is not specified: * textual_field = *# The Product.brands. * \"brands\"; *# The Product.categories. * \"categories\"; *# The Audience.genders. * | \"genders\"; *# The Audience.age_groups. * | \"ageGroups\"; *# The Product.availability. Value is one of * *# \"IN_STOCK\", \"OUT_OF_STOCK\", PREORDER\", \"BACKORDER\". * | \"availability\"; *# The ColorInfo.color_families. * | \"colorFamilies\"; *# The ColorInfo.colors. * | \"colors\"; *# The Product.sizes. * | \"sizes\"; *# The Product.materials. * | \"materials\"; *# The Product.patterns. * | \"patterns\"; *# The Product.conditions. * | \"conditions\"; *# The textual custom attribute in Product object. Key can * *# be any key in the Product.attributes map * *# if the attribute values are textual. * *# map. * | \"attributes.key\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.PICKUP_IN_STORE. * | \"pickupInStore\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.SHIP_TO_STORE. * | \"shipToStore\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.SAME_DAY_DELIVERY. * | \"sameDayDelivery\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.NEXT_DAY_DELIVERY. * | \"nextDayDelivery\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_1. * | \"customFulfillment1\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_2. * | \"customFulfillment2\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_3. * | \"customFulfillment3\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_4. * | \"customFulfillment4\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_5. * | \"customFulfillment5\"; * numerical_field = *# The PriceInfo.price. * \"price\"; *# The discount. Computed by (original_price-price)/price * \"discount\"; *# The Rating.average_rating. * \"rating\"; *# The Rating.rating_count. * \"ratingCount\"; *# The numerical custom attribute in Product object. Key can * *# be any key in the Product.attributes map * *# if the attribute values are numerical. * | \"attributes.key\";",
+          "description": "Required. Supported textual and numerical facet keys in Product object, over which the facet values are computed. Facet key is case-sensitive. Allowed facet keys when FacetKey.query is not specified: * textual_field = *# The Product.brands. * | \"brands\"; *# The Product.categories. * | \"categories\"; *# The Audience.genders. * | \"genders\"; *# The Audience.age_groups. * | \"ageGroups\"; *# The Product.availability. Value is one of * *# \"IN_STOCK\", \"OUT_OF_STOCK\", PREORDER\", \"BACKORDER\". * | \"availability\"; *# The ColorInfo.color_families. * | \"colorFamilies\"; *# The ColorInfo.colors. * | \"colors\"; *# The Product.sizes. * | \"sizes\"; *# The Product.materials. * | \"materials\"; *# The Product.patterns. * | \"patterns\"; *# The Product.conditions. * | \"conditions\"; *# The textual custom attribute in Product object. Key can * *# be any key in the Product.attributes map * *# if the attribute values are textual. * | \"attributes.key\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"pickup-in-store\". * | \"pickupInStore\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"ship-to-store\". * | \"shipToStore\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"same-day-delivery\". * | \"sameDayDelivery\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"next-day-delivery\". * | \"nextDayDelivery\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"custom-type-1\". * | \"customFulfillment1\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"custom-type-2\". * | \"customFulfillment2\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"custom-type-3\". * | \"customFulfillment3\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"custom-type-4\". * | \"customFulfillment4\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"custom-type-5\". * | \"customFulfillment5\"; * numerical_field = *# The PriceInfo.price. * | \"price\"; *# The discount. Computed by (original_price-price)/price * | \"discount\"; *# The Rating.average_rating. * | \"rating\"; *# The Rating.rating_count. * | \"ratingCount\"; *# The numerical custom attribute in Product object. Key can * *# be any key in the Product.attributes map * *# if the attribute values are numerical. * | \"attributes.key\";",
           "type": "string"
         },
         "orderBy": {
-          "description": "The order in which Facet.values are returned. Allowed values are: * \"count desc\", which means order by Facet.FacetValue.count descending. * \"value desc\", which means order by Facet.FacetValue.value descending. Only applies to textual facets. If not set, textual values are sorted in [natural order](https://en.wikipedia.org/wiki/Natural_sort_order); numerical intervals are sorted in the order given by FacetSpec.FacetKey.intervals; FulfillmentInfo.ids are sorted in the order given by FacetSpec.FacetKey.restricted_values.",
+          "description": "The order in which Facet.values are returned. Allowed values are: * \"count desc\", which means order by Facet.FacetValue.count descending. * \"value desc\", which means order by Facet.FacetValue.value descending. Only applies to textual facets. If not set, textual values are sorted in [natural order](https://en.wikipedia.org/wiki/Natural_sort_order); numerical intervals are sorted in the order given by FacetSpec.FacetKey.intervals; FulfillmentInfo.place_ids are sorted in the order given by FacetSpec.FacetKey.restricted_values.",
           "type": "string"
         },
         "prefixes": {
@@ -2671,7 +2671,7 @@
           "additionalProperties": {
             "type": "any"
           },
-          "description": "The rollup matching variant Product attributes. The key is one of the SearchRequest.variant_rollup_keys. The values are the merged and de-duplicated Product attributes. Notice that the rollup values are respect filter. For example, when filtering by \"colorFamilies:ANY(\\\"red\\\")\" and rollup \"colorFamilies\", only \"red\" is returned. For textual and numerical attributes, the rollup values is a list of string or double values with type google.protobuf.ListValue. For example, if there are two variants with colors \"red\" and \"blue\", the rollup values are { key: \"colorFamilies\" value { list_value { values { string_value: \"red\" } values { string_value: \"blue\" } } } } For Product.fulfillment_info, the rollup values is a double value with type google.protobuf.Value. For example, {key: \"pickupInStore.store1\" value { number_value: 10 }} means a there are 10 variants in this product are available in the store \"store1\".",
+          "description": "The rollup matching variant Product attributes. The key is one of the SearchRequest.variant_rollup_keys. The values are the merged and de-duplicated Product attributes. Notice that the rollup values are respect filter. For example, when filtering by \"colorFamilies:ANY(\\\"red\\\")\" and rollup \"colorFamilies\", only \"red\" is returned. For textual and numerical attributes, the rollup values is a list of string or double values with type google.protobuf.ListValue. For example, if there are two variants with colors \"red\" and \"blue\", the rollup values are { key: \"colorFamilies\" value { list_value { values { string_value: \"red\" } values { string_value: \"blue\" } } } } For FulfillmentInfo, the rollup values is a double value with type google.protobuf.Value. For example, {key: \"pickupInStore.store1\" value { number_value: 10 }} means a there are 10 variants in this product are available in the store \"store1\".",
           "type": "object"
         }
       },
diff --git a/googleapiclient/discovery_cache/documents/retail.v2alpha.json b/googleapiclient/discovery_cache/documents/retail.v2alpha.json
index a82ccaa..1e5d2ac 100644
--- a/googleapiclient/discovery_cache/documents/retail.v2alpha.json
+++ b/googleapiclient/discovery_cache/documents/retail.v2alpha.json
@@ -112,7 +112,7 @@
             "catalogs": {
               "methods": {
                 "completeQuery": {
-                  "description": "Completes the specified prefix with keyword suggestions. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.",
+                  "description": "Completes the specified prefix with keyword suggestions. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.",
                   "flatPath": "v2alpha/projects/{projectsId}/locations/{locationsId}/catalogs/{catalogsId}:completeQuery",
                   "httpMethod": "GET",
                   "id": "retail.projects.locations.catalogs.completeQuery",
@@ -128,7 +128,7 @@
                       "type": "string"
                     },
                     "dataset": {
-                      "description": "Determines which dataset to use for fetching completion. \"user-data\" will use the imported dataset through ImportCompletionData. \"cloud-retail\" will use the dataset generated by cloud retail based on user events. If leave empty, it will use the \"user-data\". Current supported values: * user-data * cloud-retail This option is not automatically enabled. Before using cloud-retail, contact retail-search-support@google.com first.",
+                      "description": "Determines which dataset to use for fetching completion. \"user-data\" will use the imported dataset through CompletionService.ImportCompletionData. \"cloud-retail\" will use the dataset generated by cloud retail based on user events. If leave empty, it will use the \"user-data\". Current supported values: * user-data * cloud-retail This option requires additional allowlisting. Before using cloud-retail, contact Cloud Retail support team first.",
                       "location": "query",
                       "type": "string"
                     },
@@ -144,7 +144,7 @@
                       "type": "string"
                     },
                     "maxSuggestions": {
-                      "description": "Completion max suggestions. The maximum allowed max suggestions is 20. The default value is 20.",
+                      "description": "Completion max suggestions. If left unset or set to 0, then will fallback to the configured value CompletionConfig.max_suggestions. The maximum allowed max suggestions is 20. If it is set higher, it will be capped by 20.",
                       "format": "int32",
                       "location": "query",
                       "type": "integer"
@@ -169,7 +169,7 @@
                   ]
                 },
                 "getDefaultBranch": {
-                  "description": "Get which branch is currently default branch set by CatalogService.SetDefaultBranch method under a specified parent catalog. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.",
+                  "description": "Get which branch is currently default branch set by CatalogService.SetDefaultBranch method under a specified parent catalog. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.",
                   "flatPath": "v2alpha/projects/{projectsId}/locations/{locationsId}/catalogs/{catalogsId}:getDefaultBranch",
                   "httpMethod": "GET",
                   "id": "retail.projects.locations.catalogs.getDefaultBranch",
@@ -264,7 +264,7 @@
                   ]
                 },
                 "setDefaultBranch": {
-                  "description": "Set a specified branch id as default branch. API methods such as SearchService.Search, ProductService.GetProduct, ProductService.ListProducts will treat requests using \"default_branch\" to the actual branch id set as default. For example, if `projects/*/locations/*/catalogs/*/branches/1` is set as default, setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/default_branch` is equivalent to setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/1`. Using multiple branches can be useful when developers would like to have a staging branch to test and verify for future usage. When it becomes ready, developers switch on the staging branch using this API while keeping using `projects/*/locations/*/catalogs/*/branches/default_branch` as SearchRequest.branch to route the traffic to this staging branch. CAUTION: If you have live predict/search traffic, switching the default branch could potentially cause outages if the ID space of the new branch is very different from the old one. More specifically: * PredictionService will only return product IDs from branch {newBranch}. * SearchService will only return product IDs from branch {newBranch} (if branch is not explicitly set). * UserEventService will only join events with products from branch {newBranch}. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.",
+                  "description": "Set a specified branch id as default branch. API methods such as SearchService.Search, ProductService.GetProduct, ProductService.ListProducts will treat requests using \"default_branch\" to the actual branch id set as default. For example, if `projects/*/locations/*/catalogs/*/branches/1` is set as default, setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/default_branch` is equivalent to setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/1`. Using multiple branches can be useful when developers would like to have a staging branch to test and verify for future usage. When it becomes ready, developers switch on the staging branch using this API while keeping using `projects/*/locations/*/catalogs/*/branches/default_branch` as SearchRequest.branch to route the traffic to this staging branch. CAUTION: If you have live predict/search traffic, switching the default branch could potentially cause outages if the ID space of the new branch is very different from the old one. More specifically: * PredictionService will only return product IDs from branch {newBranch}. * SearchService will only return product IDs from branch {newBranch} (if branch is not explicitly set). * UserEventService will only join events with products from branch {newBranch}. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.",
                   "flatPath": "v2alpha/projects/{projectsId}/locations/{locationsId}/catalogs/{catalogsId}:setDefaultBranch",
                   "httpMethod": "POST",
                   "id": "retail.projects.locations.catalogs.setDefaultBranch",
@@ -327,7 +327,7 @@
                     "products": {
                       "methods": {
                         "addFulfillmentPlaces": {
-                          "description": "Incrementally adds place IDs to Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the added place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.",
+                          "description": "Incrementally adds place IDs to Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the added place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.",
                           "flatPath": "v2alpha/projects/{projectsId}/locations/{locationsId}/catalogs/{catalogsId}/branches/{branchesId}/products/{productsId}:addFulfillmentPlaces",
                           "httpMethod": "POST",
                           "id": "retail.projects.locations.catalogs.branches.products.addFulfillmentPlaces",
@@ -557,7 +557,7 @@
                           ]
                         },
                         "removeFulfillmentPlaces": {
-                          "description": "Incrementally removes place IDs from a Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the removed place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.",
+                          "description": "Incrementally removes place IDs from a Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the removed place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.",
                           "flatPath": "v2alpha/projects/{projectsId}/locations/{locationsId}/catalogs/{catalogsId}/branches/{branchesId}/products/{productsId}:removeFulfillmentPlaces",
                           "httpMethod": "POST",
                           "id": "retail.projects.locations.catalogs.branches.products.removeFulfillmentPlaces",
@@ -585,7 +585,7 @@
                           ]
                         },
                         "setInventory": {
-                          "description": "Updates inventory information for a Product while respecting the last update timestamps of each inventory field. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, updates are not immediately manifested in the Product queried by GetProduct or ListProducts. When inventory is updated with CreateProduct and UpdateProduct, the specified inventory field value(s) will overwrite any existing value(s) while ignoring the last update time for this field. Furthermore, the last update time for the specified inventory fields will be overwritten to the time of the CreateProduct or UpdateProduct request. If no inventory fields are set in CreateProductRequest.product, then any pre-existing inventory information for this product will be used. If no inventory fields are set in UpdateProductRequest.set_mask, then any existing inventory information will be preserved. Pre-existing inventory information can only be updated with SetInventory, AddFulfillmentPlaces, and RemoveFulfillmentPlaces. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.",
+                          "description": "Updates inventory information for a Product while respecting the last update timestamps of each inventory field. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, updates are not immediately manifested in the Product queried by GetProduct or ListProducts. When inventory is updated with CreateProduct and UpdateProduct, the specified inventory field value(s) will overwrite any existing value(s) while ignoring the last update time for this field. Furthermore, the last update time for the specified inventory fields will be overwritten to the time of the CreateProduct or UpdateProduct request. If no inventory fields are set in CreateProductRequest.product, then any pre-existing inventory information for this product will be used. If no inventory fields are set in UpdateProductRequest.set_mask, then any existing inventory information will be preserved. Pre-existing inventory information can only be updated with SetInventory, AddFulfillmentPlaces, and RemoveFulfillmentPlaces. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.",
                           "flatPath": "v2alpha/projects/{projectsId}/locations/{locationsId}/catalogs/{catalogsId}/branches/{branchesId}/products/{productsId}:setInventory",
                           "httpMethod": "POST",
                           "id": "retail.projects.locations.catalogs.branches.products.setInventory",
@@ -619,7 +619,7 @@
                 "completionData": {
                   "methods": {
                     "import": {
-                      "description": "Bulk import of processed completion dataset. Request processing may be synchronous. Partial updating is not supported. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.",
+                      "description": "Bulk import of processed completion dataset. Request processing may be synchronous. Partial updating is not supported. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.",
                       "flatPath": "v2alpha/projects/{projectsId}/locations/{locationsId}/catalogs/{catalogsId}/completionData:import",
                       "httpMethod": "POST",
                       "id": "retail.projects.locations.catalogs.completionData.import",
@@ -749,7 +749,7 @@
                       ]
                     },
                     "search": {
-                      "description": "Performs a search. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.",
+                      "description": "Performs a search. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.",
                       "flatPath": "v2alpha/projects/{projectsId}/locations/{locationsId}/catalogs/{catalogsId}/placements/{placementsId}:search",
                       "httpMethod": "POST",
                       "id": "retail.projects.locations.catalogs.placements.search",
@@ -1012,7 +1012,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210730",
   "rootUrl": "https://retail.googleapis.com/",
   "schemas": {
     "GoogleApiHttpBody": {
@@ -1505,7 +1505,7 @@
           "type": "array"
         },
         "recentSearchResults": {
-          "description": "Matched recent searches of this user. This field is a restricted feature. Contact Retail Support (retail-search-support@google.com) if you are interested in enabling it. This feature is only available when CompleteQueryRequest.visitor_id field is set and UserEvent is imported. The recent searches satisfy the follow rules: * They are ordered from latest to oldest. * They are matched with CompleteQueryRequest.query case insensitively. * They are transformed to lower cases. * They are UTF-8 safe. Recent searches are deduplicated. More recent searches will be reserved when duplication happens.",
+          "description": "Matched recent searches of this user. This field is a restricted feature. Contact Retail Search support team if you are interested in enabling it. This feature is only available when CompleteQueryRequest.visitor_id field is set and UserEvent is imported. The recent searches satisfy the follow rules: * They are ordered from latest to oldest. * They are matched with CompleteQueryRequest.query case insensitively. * They are transformed to lower cases. * They are UTF-8 safe. Recent searches are deduplicated. More recent searches will be reserved when duplication happens.",
           "items": {
             "$ref": "GoogleCloudRetailV2alphaCompleteQueryResponseRecentSearchResult"
           },
@@ -1549,7 +1549,7 @@
       "properties": {
         "bigQuerySource": {
           "$ref": "GoogleCloudRetailV2alphaBigQuerySource",
-          "description": "Required. BigQuery input source. Add the IAM permission \u201cBigQuery Data Viewer\u201d for cloud-retail-customer-data-access@system.gserviceaccount.com before using this feature otherwise an error is thrown."
+          "description": "Required. BigQuery input source. Add the IAM permission \"BigQuery Data Viewer\" for cloud-retail-customer-data-access@system.gserviceaccount.com before using this feature otherwise an error is thrown."
         }
       },
       "type": "object"
@@ -1846,7 +1846,7 @@
           "enumDescriptions": [
             "Defaults to INCREMENTAL.",
             "Inserts new products or updates existing products.",
-            "Calculates diff and replaces the entire product dataset. Existing products may be deleted if they are not present in the source location. Can only be while using BigQuerySource. Add the IAM permission \u201cBigQuery Data Viewer\u201d for cloud-retail-customer-data-access@system.gserviceaccount.com before using this feature otherwise an error is thrown. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search."
+            "Calculates diff and replaces the entire product dataset. Existing products may be deleted if they are not present in the source location. Can only be while using BigQuerySource. Add the IAM permission \"BigQuery Data Viewer\" for cloud-retail-customer-data-access@system.gserviceaccount.com before using this feature otherwise an error is thrown. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search."
           ],
           "type": "string"
         },
@@ -1994,7 +1994,7 @@
           "type": "string"
         },
         "destinations": {
-          "description": "String representing the destination to import for, all if left empty. List of possible values can be found here. [https://support.google.com/merchants/answer/7501026?hl=en] List of allowed string values: \"shopping-ads\", \"buy-on-google-listings\", \"display-ads\", \"local-inventory -ads\", \"free-listings\", \"free-local-listings\" NOTE: The string values are case sensitive.",
+          "description": "String representing the destination to import for, all if left empty. List of possible values can be found here. [https://support.google.com/merchants/answer/7501026] List of allowed string values: \"shopping-ads\", \"buy-on-google-listings\", \"display-ads\", \"local-inventory -ads\", \"free-listings\", \"free-local-listings\" NOTE: The string values are case sensitive.",
           "items": {
             "type": "string"
           },
@@ -2320,7 +2320,7 @@
           "description": "The rating of this product."
         },
         "retrievableFields": {
-          "description": "Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form \"attributes.key\" where \"key\" is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.",
+          "description": "Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form \"attributes.key\" where \"key\" is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.",
           "format": "google-fieldmask",
           "type": "string"
         },
@@ -2384,7 +2384,7 @@
       "properties": {
         "product": {
           "$ref": "GoogleCloudRetailV2alphaProduct",
-          "description": "Required. Product information. Only Product.id field is used when ingesting an event, all other product fields are ignored as we will look them up from the catalog."
+          "description": "Required. Product information. Required field(s): * Product.id Optional override field(s): * Product.price_info If any supported optional fields are provided, we will treat them as a full override when looking up product information from the catalog. Thus, it is important to ensure that the overriding fields are accurate and complete. All other product fields are ignored and instead populated via catalog lookup after event ingestion."
         },
         "quantity": {
           "description": "Quantity of the product associated with the user event. For example, this field will be 2 if two products are added to the shopping cart for `purchase-complete` event. Required for `add-to-cart` and `purchase-complete` event types.",
@@ -2637,7 +2637,7 @@
         },
         "dynamicFacetSpec": {
           "$ref": "GoogleCloudRetailV2alphaSearchRequestDynamicFacetSpec",
-          "description": "The specification for dynamically generated facets. Notice that only textual facets can be dynamically generated. This feature requires additional allowlisting. Contact Retail Support (retail-search-support@google.com) if you are interested in using dynamic facet feature."
+          "description": "The specification for dynamically generated facets. Notice that only textual facets can be dynamically generated. This feature requires additional allowlisting. Contact Retail Search support team if you are interested in using dynamic facet feature."
         },
         "facetSpecs": {
           "description": "Facet specifications for faceted search. If empty, no facets are returned. A maximum of 100 values are allowed. Otherwise, an INVALID_ARGUMENT error is returned.",
@@ -2706,7 +2706,7 @@
           "description": "User information."
         },
         "variantRollupKeys": {
-          "description": "The keys to fetch and rollup the matching variant Products attributes. The attributes from all the matching variant Products are merged and de-duplicated. Notice that rollup variant Products attributes will lead to extra query latency. Maximum number of keys is 10. For Product.fulfillment_info, a fulfillment type and a fulfillment ID must be provided in the format of \"fulfillmentType.filfillmentId\". E.g., in \"pickupInStore.store123\", \"pickupInStore\" is fulfillment type and \"store123\" is the store ID. Supported keys are: * colorFamilies * price * originalPrice * discount * attributes.key, where key is any key in the Product.attributes map. * pickupInStore.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.PICKUP_IN_STORE. * shipToStore.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.SHIP_TO_STORE. * sameDayDelivery.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.SAME_DAY_DELIVERY. * nextDayDelivery.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.NEXT_DAY_DELIVERY. * customFulfillment1.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_1. * customFulfillment2.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_2. * customFulfillment3.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_3. * customFulfillment4.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_4. * customFulfillment5.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_5. If this field is set to an invalid value other than these, an INVALID_ARGUMENT error is returned.",
+          "description": "The keys to fetch and rollup the matching variant Products attributes. The attributes from all the matching variant Products are merged and de-duplicated. Notice that rollup variant Products attributes will lead to extra query latency. Maximum number of keys is 10. For FulfillmentInfo, a fulfillment type and a fulfillment ID must be provided in the format of \"fulfillmentType.fulfillmentId\". E.g., in \"pickupInStore.store123\", \"pickupInStore\" is fulfillment type and \"store123\" is the store ID. Supported keys are: * colorFamilies * price * originalPrice * discount * attributes.key, where key is any key in the Product.attributes map. * pickupInStore.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"pickup-in-store\". * shipToStore.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"ship-to-store\". * sameDayDelivery.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"same-day-delivery\". * nextDayDelivery.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"next-day-delivery\". * customFulfillment1.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"custom-type-1\". * customFulfillment2.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"custom-type-2\". * customFulfillment3.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"custom-type-3\". * customFulfillment4.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"custom-type-4\". * customFulfillment5.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"custom-type-5\". If this field is set to an invalid value other than these, an INVALID_ARGUMENT error is returned.",
           "items": {
             "type": "string"
           },
@@ -2816,11 +2816,11 @@
           "type": "array"
         },
         "key": {
-          "description": "Required. Supported textual and numerical facet keys in Product object, over which the facet values are computed. Facet key is case-sensitive. Allowed facet keys when FacetKey.query is not specified: * textual_field = *# The Product.brands. * \"brands\"; *# The Product.categories. * \"categories\"; *# The Audience.genders. * | \"genders\"; *# The Audience.age_groups. * | \"ageGroups\"; *# The Product.availability. Value is one of * *# \"IN_STOCK\", \"OUT_OF_STOCK\", PREORDER\", \"BACKORDER\". * | \"availability\"; *# The ColorInfo.color_families. * | \"colorFamilies\"; *# The ColorInfo.colors. * | \"colors\"; *# The Product.sizes. * | \"sizes\"; *# The Product.materials. * | \"materials\"; *# The Product.patterns. * | \"patterns\"; *# The Product.conditions. * | \"conditions\"; *# The textual custom attribute in Product object. Key can * *# be any key in the Product.attributes map * *# if the attribute values are textual. * *# map. * | \"attributes.key\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.PICKUP_IN_STORE. * | \"pickupInStore\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.SHIP_TO_STORE. * | \"shipToStore\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.SAME_DAY_DELIVERY. * | \"sameDayDelivery\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.NEXT_DAY_DELIVERY. * | \"nextDayDelivery\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_1. * | \"customFulfillment1\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_2. * | \"customFulfillment2\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_3. * | \"customFulfillment3\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_4. * | \"customFulfillment4\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_5. * | \"customFulfillment5\"; * numerical_field = *# The PriceInfo.price. * \"price\"; *# The discount. Computed by (original_price-price)/price * \"discount\"; *# The Rating.average_rating. * \"rating\"; *# The Rating.rating_count. * \"ratingCount\"; *# The numerical custom attribute in Product object. Key can * *# be any key in the Product.attributes map * *# if the attribute values are numerical. * | \"attributes.key\";",
+          "description": "Required. Supported textual and numerical facet keys in Product object, over which the facet values are computed. Facet key is case-sensitive. Allowed facet keys when FacetKey.query is not specified: * textual_field = *# The Product.brands. * | \"brands\"; *# The Product.categories. * | \"categories\"; *# The Audience.genders. * | \"genders\"; *# The Audience.age_groups. * | \"ageGroups\"; *# The Product.availability. Value is one of * *# \"IN_STOCK\", \"OUT_OF_STOCK\", PREORDER\", \"BACKORDER\". * | \"availability\"; *# The ColorInfo.color_families. * | \"colorFamilies\"; *# The ColorInfo.colors. * | \"colors\"; *# The Product.sizes. * | \"sizes\"; *# The Product.materials. * | \"materials\"; *# The Product.patterns. * | \"patterns\"; *# The Product.conditions. * | \"conditions\"; *# The textual custom attribute in Product object. Key can * *# be any key in the Product.attributes map * *# if the attribute values are textual. * | \"attributes.key\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"pickup-in-store\". * | \"pickupInStore\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"ship-to-store\". * | \"shipToStore\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"same-day-delivery\". * | \"sameDayDelivery\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"next-day-delivery\". * | \"nextDayDelivery\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"custom-type-1\". * | \"customFulfillment1\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"custom-type-2\". * | \"customFulfillment2\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"custom-type-3\". * | \"customFulfillment3\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"custom-type-4\". * | \"customFulfillment4\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"custom-type-5\". * | \"customFulfillment5\"; * numerical_field = *# The PriceInfo.price. * | \"price\"; *# The discount. Computed by (original_price-price)/price * | \"discount\"; *# The Rating.average_rating. * | \"rating\"; *# The Rating.rating_count. * | \"ratingCount\"; *# The numerical custom attribute in Product object. Key can * *# be any key in the Product.attributes map * *# if the attribute values are numerical. * | \"attributes.key\";",
           "type": "string"
         },
         "orderBy": {
-          "description": "The order in which Facet.values are returned. Allowed values are: * \"count desc\", which means order by Facet.FacetValue.count descending. * \"value desc\", which means order by Facet.FacetValue.value descending. Only applies to textual facets. If not set, textual values are sorted in [natural order](https://en.wikipedia.org/wiki/Natural_sort_order); numerical intervals are sorted in the order given by FacetSpec.FacetKey.intervals; FulfillmentInfo.ids are sorted in the order given by FacetSpec.FacetKey.restricted_values.",
+          "description": "The order in which Facet.values are returned. Allowed values are: * \"count desc\", which means order by Facet.FacetValue.count descending. * \"value desc\", which means order by Facet.FacetValue.value descending. Only applies to textual facets. If not set, textual values are sorted in [natural order](https://en.wikipedia.org/wiki/Natural_sort_order); numerical intervals are sorted in the order given by FacetSpec.FacetKey.intervals; FulfillmentInfo.place_ids are sorted in the order given by FacetSpec.FacetKey.restricted_values.",
           "type": "string"
         },
         "prefixes": {
@@ -2993,7 +2993,7 @@
           "additionalProperties": {
             "type": "any"
           },
-          "description": "The rollup matching variant Product attributes. The key is one of the SearchRequest.variant_rollup_keys. The values are the merged and de-duplicated Product attributes. Notice that the rollup values are respect filter. For example, when filtering by \"colorFamilies:ANY(\\\"red\\\")\" and rollup \"colorFamilies\", only \"red\" is returned. For textual and numerical attributes, the rollup values is a list of string or double values with type google.protobuf.ListValue. For example, if there are two variants with colors \"red\" and \"blue\", the rollup values are { key: \"colorFamilies\" value { list_value { values { string_value: \"red\" } values { string_value: \"blue\" } } } } For Product.fulfillment_info, the rollup values is a double value with type google.protobuf.Value. For example, {key: \"pickupInStore.store1\" value { number_value: 10 }} means a there are 10 variants in this product are available in the store \"store1\".",
+          "description": "The rollup matching variant Product attributes. The key is one of the SearchRequest.variant_rollup_keys. The values are the merged and de-duplicated Product attributes. Notice that the rollup values are respect filter. For example, when filtering by \"colorFamilies:ANY(\\\"red\\\")\" and rollup \"colorFamilies\", only \"red\" is returned. For textual and numerical attributes, the rollup values is a list of string or double values with type google.protobuf.ListValue. For example, if there are two variants with colors \"red\" and \"blue\", the rollup values are { key: \"colorFamilies\" value { list_value { values { string_value: \"red\" } values { string_value: \"blue\" } } } } For FulfillmentInfo, the rollup values is a double value with type google.protobuf.Value. For example, {key: \"pickupInStore.store1\" value { number_value: 10 }} means a there are 10 variants in this product are available in the store \"store1\".",
           "type": "object"
         }
       },
diff --git a/googleapiclient/discovery_cache/documents/retail.v2beta.json b/googleapiclient/discovery_cache/documents/retail.v2beta.json
index c42b4e4..734c264 100644
--- a/googleapiclient/discovery_cache/documents/retail.v2beta.json
+++ b/googleapiclient/discovery_cache/documents/retail.v2beta.json
@@ -112,7 +112,7 @@
             "catalogs": {
               "methods": {
                 "completeQuery": {
-                  "description": "Completes the specified prefix with keyword suggestions. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.",
+                  "description": "Completes the specified prefix with keyword suggestions. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.",
                   "flatPath": "v2beta/projects/{projectsId}/locations/{locationsId}/catalogs/{catalogsId}:completeQuery",
                   "httpMethod": "GET",
                   "id": "retail.projects.locations.catalogs.completeQuery",
@@ -128,7 +128,7 @@
                       "type": "string"
                     },
                     "dataset": {
-                      "description": "Determines which dataset to use for fetching completion. \"user-data\" will use the imported dataset through ImportCompletionData. \"cloud-retail\" will use the dataset generated by cloud retail based on user events. If leave empty, it will use the \"user-data\". Current supported values: * user-data * cloud-retail This option is not automatically enabled. Before using cloud-retail, contact retail-search-support@google.com first.",
+                      "description": "Determines which dataset to use for fetching completion. \"user-data\" will use the imported dataset through CompletionService.ImportCompletionData. \"cloud-retail\" will use the dataset generated by cloud retail based on user events. If leave empty, it will use the \"user-data\". Current supported values: * user-data * cloud-retail This option requires additional allowlisting. Before using cloud-retail, contact Cloud Retail support team first.",
                       "location": "query",
                       "type": "string"
                     },
@@ -144,7 +144,7 @@
                       "type": "string"
                     },
                     "maxSuggestions": {
-                      "description": "Completion max suggestions. The maximum allowed max suggestions is 20. The default value is 20.",
+                      "description": "Completion max suggestions. If left unset or set to 0, then will fallback to the configured value CompletionConfig.max_suggestions. The maximum allowed max suggestions is 20. If it is set higher, it will be capped by 20.",
                       "format": "int32",
                       "location": "query",
                       "type": "integer"
@@ -169,7 +169,7 @@
                   ]
                 },
                 "getDefaultBranch": {
-                  "description": "Get which branch is currently default branch set by CatalogService.SetDefaultBranch method under a specified parent catalog. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.",
+                  "description": "Get which branch is currently default branch set by CatalogService.SetDefaultBranch method under a specified parent catalog. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.",
                   "flatPath": "v2beta/projects/{projectsId}/locations/{locationsId}/catalogs/{catalogsId}:getDefaultBranch",
                   "httpMethod": "GET",
                   "id": "retail.projects.locations.catalogs.getDefaultBranch",
@@ -264,7 +264,7 @@
                   ]
                 },
                 "setDefaultBranch": {
-                  "description": "Set a specified branch id as default branch. API methods such as SearchService.Search, ProductService.GetProduct, ProductService.ListProducts will treat requests using \"default_branch\" to the actual branch id set as default. For example, if `projects/*/locations/*/catalogs/*/branches/1` is set as default, setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/default_branch` is equivalent to setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/1`. Using multiple branches can be useful when developers would like to have a staging branch to test and verify for future usage. When it becomes ready, developers switch on the staging branch using this API while keeping using `projects/*/locations/*/catalogs/*/branches/default_branch` as SearchRequest.branch to route the traffic to this staging branch. CAUTION: If you have live predict/search traffic, switching the default branch could potentially cause outages if the ID space of the new branch is very different from the old one. More specifically: * PredictionService will only return product IDs from branch {newBranch}. * SearchService will only return product IDs from branch {newBranch} (if branch is not explicitly set). * UserEventService will only join events with products from branch {newBranch}. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.",
+                  "description": "Set a specified branch id as default branch. API methods such as SearchService.Search, ProductService.GetProduct, ProductService.ListProducts will treat requests using \"default_branch\" to the actual branch id set as default. For example, if `projects/*/locations/*/catalogs/*/branches/1` is set as default, setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/default_branch` is equivalent to setting SearchRequest.branch to `projects/*/locations/*/catalogs/*/branches/1`. Using multiple branches can be useful when developers would like to have a staging branch to test and verify for future usage. When it becomes ready, developers switch on the staging branch using this API while keeping using `projects/*/locations/*/catalogs/*/branches/default_branch` as SearchRequest.branch to route the traffic to this staging branch. CAUTION: If you have live predict/search traffic, switching the default branch could potentially cause outages if the ID space of the new branch is very different from the old one. More specifically: * PredictionService will only return product IDs from branch {newBranch}. * SearchService will only return product IDs from branch {newBranch} (if branch is not explicitly set). * UserEventService will only join events with products from branch {newBranch}. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.",
                   "flatPath": "v2beta/projects/{projectsId}/locations/{locationsId}/catalogs/{catalogsId}:setDefaultBranch",
                   "httpMethod": "POST",
                   "id": "retail.projects.locations.catalogs.setDefaultBranch",
@@ -327,7 +327,7 @@
                     "products": {
                       "methods": {
                         "addFulfillmentPlaces": {
-                          "description": "Incrementally adds place IDs to Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the added place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.",
+                          "description": "Incrementally adds place IDs to Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the added place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.",
                           "flatPath": "v2beta/projects/{projectsId}/locations/{locationsId}/catalogs/{catalogsId}/branches/{branchesId}/products/{productsId}:addFulfillmentPlaces",
                           "httpMethod": "POST",
                           "id": "retail.projects.locations.catalogs.branches.products.addFulfillmentPlaces",
@@ -552,7 +552,7 @@
                           ]
                         },
                         "removeFulfillmentPlaces": {
-                          "description": "Incrementally removes place IDs from a Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the removed place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.",
+                          "description": "Incrementally removes place IDs from a Product.fulfillment_info.place_ids. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, the removed place IDs are not immediately manifested in the Product queried by GetProduct or ListProducts. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.",
                           "flatPath": "v2beta/projects/{projectsId}/locations/{locationsId}/catalogs/{catalogsId}/branches/{branchesId}/products/{productsId}:removeFulfillmentPlaces",
                           "httpMethod": "POST",
                           "id": "retail.projects.locations.catalogs.branches.products.removeFulfillmentPlaces",
@@ -580,7 +580,7 @@
                           ]
                         },
                         "setInventory": {
-                          "description": "Updates inventory information for a Product while respecting the last update timestamps of each inventory field. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, updates are not immediately manifested in the Product queried by GetProduct or ListProducts. When inventory is updated with CreateProduct and UpdateProduct, the specified inventory field value(s) will overwrite any existing value(s) while ignoring the last update time for this field. Furthermore, the last update time for the specified inventory fields will be overwritten to the time of the CreateProduct or UpdateProduct request. If no inventory fields are set in CreateProductRequest.product, then any pre-existing inventory information for this product will be used. If no inventory fields are set in UpdateProductRequest.set_mask, then any existing inventory information will be preserved. Pre-existing inventory information can only be updated with SetInventory, AddFulfillmentPlaces, and RemoveFulfillmentPlaces. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.",
+                          "description": "Updates inventory information for a Product while respecting the last update timestamps of each inventory field. This process is asynchronous and does not require the Product to exist before updating fulfillment information. If the request is valid, the update will be enqueued and processed downstream. As a consequence, when a response is returned, updates are not immediately manifested in the Product queried by GetProduct or ListProducts. When inventory is updated with CreateProduct and UpdateProduct, the specified inventory field value(s) will overwrite any existing value(s) while ignoring the last update time for this field. Furthermore, the last update time for the specified inventory fields will be overwritten to the time of the CreateProduct or UpdateProduct request. If no inventory fields are set in CreateProductRequest.product, then any pre-existing inventory information for this product will be used. If no inventory fields are set in UpdateProductRequest.set_mask, then any existing inventory information will be preserved. Pre-existing inventory information can only be updated with SetInventory, AddFulfillmentPlaces, and RemoveFulfillmentPlaces. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.",
                           "flatPath": "v2beta/projects/{projectsId}/locations/{locationsId}/catalogs/{catalogsId}/branches/{branchesId}/products/{productsId}:setInventory",
                           "httpMethod": "POST",
                           "id": "retail.projects.locations.catalogs.branches.products.setInventory",
@@ -614,7 +614,7 @@
                 "completionData": {
                   "methods": {
                     "import": {
-                      "description": "Bulk import of processed completion dataset. Request processing may be synchronous. Partial updating is not supported. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.",
+                      "description": "Bulk import of processed completion dataset. Request processing may be synchronous. Partial updating is not supported. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.",
                       "flatPath": "v2beta/projects/{projectsId}/locations/{locationsId}/catalogs/{catalogsId}/completionData:import",
                       "httpMethod": "POST",
                       "id": "retail.projects.locations.catalogs.completionData.import",
@@ -744,7 +744,7 @@
                       ]
                     },
                     "search": {
-                      "description": "Performs a search. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search.",
+                      "description": "Performs a search. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search.",
                       "flatPath": "v2beta/projects/{projectsId}/locations/{locationsId}/catalogs/{catalogsId}/placements/{placementsId}:search",
                       "httpMethod": "POST",
                       "id": "retail.projects.locations.catalogs.placements.search",
@@ -1007,7 +1007,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210730",
   "rootUrl": "https://retail.googleapis.com/",
   "schemas": {
     "GoogleApiHttpBody": {
@@ -1749,7 +1749,7 @@
           "type": "array"
         },
         "recentSearchResults": {
-          "description": "Matched recent searches of this user. This field is a restricted feature. Contact Retail Support (retail-search-support@google.com) if you are interested in enabling it. This feature is only available when CompleteQueryRequest.visitor_id field is set and UserEvent is imported. The recent searches satisfy the follow rules: * They are ordered from latest to oldest. * They are matched with CompleteQueryRequest.query case insensitively. * They are transformed to lower cases. * They are UTF-8 safe. Recent searches are deduplicated. More recent searches will be reserved when duplication happens.",
+          "description": "Matched recent searches of this user. This field is a restricted feature. Contact Retail Search support team if you are interested in enabling it. This feature is only available when CompleteQueryRequest.visitor_id field is set and UserEvent is imported. The recent searches satisfy the follow rules: * They are ordered from latest to oldest. * They are matched with CompleteQueryRequest.query case insensitively. * They are transformed to lower cases. * They are UTF-8 safe. Recent searches are deduplicated. More recent searches will be reserved when duplication happens.",
           "items": {
             "$ref": "GoogleCloudRetailV2betaCompleteQueryResponseRecentSearchResult"
           },
@@ -1793,7 +1793,7 @@
       "properties": {
         "bigQuerySource": {
           "$ref": "GoogleCloudRetailV2betaBigQuerySource",
-          "description": "Required. BigQuery input source. Add the IAM permission \u201cBigQuery Data Viewer\u201d for cloud-retail-customer-data-access@system.gserviceaccount.com before using this feature otherwise an error is thrown."
+          "description": "Required. BigQuery input source. Add the IAM permission \"BigQuery Data Viewer\" for cloud-retail-customer-data-access@system.gserviceaccount.com before using this feature otherwise an error is thrown."
         }
       },
       "type": "object"
@@ -2090,7 +2090,7 @@
           "enumDescriptions": [
             "Defaults to INCREMENTAL.",
             "Inserts new products or updates existing products.",
-            "Calculates diff and replaces the entire product dataset. Existing products may be deleted if they are not present in the source location. Can only be while using BigQuerySource. Add the IAM permission \u201cBigQuery Data Viewer\u201d for cloud-retail-customer-data-access@system.gserviceaccount.com before using this feature otherwise an error is thrown. This feature is only available for users who have Retail Search enabled. Contact Retail Support (retail-search-support@google.com) if you are interested in using Retail Search."
+            "Calculates diff and replaces the entire product dataset. Existing products may be deleted if they are not present in the source location. Can only be while using BigQuerySource. Add the IAM permission \"BigQuery Data Viewer\" for cloud-retail-customer-data-access@system.gserviceaccount.com before using this feature otherwise an error is thrown. This feature is only available for users who have Retail Search enabled. Please submit a form [here](https://cloud.google.com/contact) to contact cloud sales if you are interested in using Retail Search."
           ],
           "type": "string"
         },
@@ -2522,7 +2522,7 @@
           "description": "The rating of this product."
         },
         "retrievableFields": {
-          "description": "Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form \"attributes.key\" where \"key\" is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 20. Otherwise, an INVALID_ARGUMENT error is returned.",
+          "description": "Indicates which fields in the Products are returned in SearchResponse. Supported fields for all types: * audience * availability * brands * color_info * conditions * gtin * materials * name * patterns * price_info * rating * sizes * title * uri Supported fields only for Type.PRIMARY and Type.COLLECTION: * categories * description * images Supported fields only for Type.VARIANT: * Only the first image in images To mark attributes as retrievable, include paths of the form \"attributes.key\" where \"key\" is the key of a custom attribute, as specified in attributes. For Type.PRIMARY and Type.COLLECTION, the following fields are always returned in SearchResponse by default: * name For Type.VARIANT, the following fields are always returned in by default: * name * color_info Maximum number of paths is 30. Otherwise, an INVALID_ARGUMENT error is returned. Note: Returning more fields in SearchResponse may increase response payload size and serving latency.",
           "format": "google-fieldmask",
           "type": "string"
         },
@@ -2586,7 +2586,7 @@
       "properties": {
         "product": {
           "$ref": "GoogleCloudRetailV2betaProduct",
-          "description": "Required. Product information. Only Product.id field is used when ingesting an event, all other product fields are ignored as we will look them up from the catalog."
+          "description": "Required. Product information. Required field(s): * Product.id Optional override field(s): * Product.price_info If any supported optional fields are provided, we will treat them as a full override when looking up product information from the catalog. Thus, it is important to ensure that the overriding fields are accurate and complete. All other product fields are ignored and instead populated via catalog lookup after event ingestion."
         },
         "quantity": {
           "description": "Quantity of the product associated with the user event. For example, this field will be 2 if two products are added to the shopping cart for `purchase-complete` event. Required for `add-to-cart` and `purchase-complete` event types.",
@@ -2839,7 +2839,7 @@
         },
         "dynamicFacetSpec": {
           "$ref": "GoogleCloudRetailV2betaSearchRequestDynamicFacetSpec",
-          "description": "The specification for dynamically generated facets. Notice that only textual facets can be dynamically generated. This feature requires additional allowlisting. Contact Retail Support (retail-search-support@google.com) if you are interested in using dynamic facet feature."
+          "description": "The specification for dynamically generated facets. Notice that only textual facets can be dynamically generated. This feature requires additional allowlisting. Contact Retail Search support team if you are interested in using dynamic facet feature."
         },
         "facetSpecs": {
           "description": "Facet specifications for faceted search. If empty, no facets are returned. A maximum of 100 values are allowed. Otherwise, an INVALID_ARGUMENT error is returned.",
@@ -2890,7 +2890,7 @@
           "description": "User information."
         },
         "variantRollupKeys": {
-          "description": "The keys to fetch and rollup the matching variant Products attributes. The attributes from all the matching variant Products are merged and de-duplicated. Notice that rollup variant Products attributes will lead to extra query latency. Maximum number of keys is 10. For Product.fulfillment_info, a fulfillment type and a fulfillment ID must be provided in the format of \"fulfillmentType.filfillmentId\". E.g., in \"pickupInStore.store123\", \"pickupInStore\" is fulfillment type and \"store123\" is the store ID. Supported keys are: * colorFamilies * price * originalPrice * discount * attributes.key, where key is any key in the Product.attributes map. * pickupInStore.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.PICKUP_IN_STORE. * shipToStore.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.SHIP_TO_STORE. * sameDayDelivery.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.SAME_DAY_DELIVERY. * nextDayDelivery.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.NEXT_DAY_DELIVERY. * customFulfillment1.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_1. * customFulfillment2.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_2. * customFulfillment3.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_3. * customFulfillment4.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_4. * customFulfillment5.id, where id is any FulfillmentInfo.ids for type FulfillmentInfo.Type.CUSTOM_TYPE_5. If this field is set to an invalid value other than these, an INVALID_ARGUMENT error is returned.",
+          "description": "The keys to fetch and rollup the matching variant Products attributes. The attributes from all the matching variant Products are merged and de-duplicated. Notice that rollup variant Products attributes will lead to extra query latency. Maximum number of keys is 10. For FulfillmentInfo, a fulfillment type and a fulfillment ID must be provided in the format of \"fulfillmentType.fulfillmentId\". E.g., in \"pickupInStore.store123\", \"pickupInStore\" is fulfillment type and \"store123\" is the store ID. Supported keys are: * colorFamilies * price * originalPrice * discount * attributes.key, where key is any key in the Product.attributes map. * pickupInStore.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"pickup-in-store\". * shipToStore.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"ship-to-store\". * sameDayDelivery.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"same-day-delivery\". * nextDayDelivery.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"next-day-delivery\". * customFulfillment1.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"custom-type-1\". * customFulfillment2.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"custom-type-2\". * customFulfillment3.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"custom-type-3\". * customFulfillment4.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"custom-type-4\". * customFulfillment5.id, where id is any FulfillmentInfo.place_ids for FulfillmentInfo.type \"custom-type-5\". If this field is set to an invalid value other than these, an INVALID_ARGUMENT error is returned.",
           "items": {
             "type": "string"
           },
@@ -3000,11 +3000,11 @@
           "type": "array"
         },
         "key": {
-          "description": "Required. Supported textual and numerical facet keys in Product object, over which the facet values are computed. Facet key is case-sensitive. Allowed facet keys when FacetKey.query is not specified: * textual_field = *# The Product.brands. * \"brands\"; *# The Product.categories. * \"categories\"; *# The Audience.genders. * | \"genders\"; *# The Audience.age_groups. * | \"ageGroups\"; *# The Product.availability. Value is one of * *# \"IN_STOCK\", \"OUT_OF_STOCK\", PREORDER\", \"BACKORDER\". * | \"availability\"; *# The ColorInfo.color_families. * | \"colorFamilies\"; *# The ColorInfo.colors. * | \"colors\"; *# The Product.sizes. * | \"sizes\"; *# The Product.materials. * | \"materials\"; *# The Product.patterns. * | \"patterns\"; *# The Product.conditions. * | \"conditions\"; *# The textual custom attribute in Product object. Key can * *# be any key in the Product.attributes map * *# if the attribute values are textual. * *# map. * | \"attributes.key\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.PICKUP_IN_STORE. * | \"pickupInStore\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.SHIP_TO_STORE. * | \"shipToStore\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.SAME_DAY_DELIVERY. * | \"sameDayDelivery\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.NEXT_DAY_DELIVERY. * | \"nextDayDelivery\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_1. * | \"customFulfillment1\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_2. * | \"customFulfillment2\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_3. * | \"customFulfillment3\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_4. * | \"customFulfillment4\"; *# The FulfillmentInfo.ids for type *# FulfillmentInfo.Type.CUSTOM_TYPE_5. * | \"customFulfillment5\"; * numerical_field = *# The PriceInfo.price. * \"price\"; *# The discount. Computed by (original_price-price)/price * \"discount\"; *# The Rating.average_rating. * \"rating\"; *# The Rating.rating_count. * \"ratingCount\"; *# The numerical custom attribute in Product object. Key can * *# be any key in the Product.attributes map * *# if the attribute values are numerical. * | \"attributes.key\";",
+          "description": "Required. Supported textual and numerical facet keys in Product object, over which the facet values are computed. Facet key is case-sensitive. Allowed facet keys when FacetKey.query is not specified: * textual_field = *# The Product.brands. * | \"brands\"; *# The Product.categories. * | \"categories\"; *# The Audience.genders. * | \"genders\"; *# The Audience.age_groups. * | \"ageGroups\"; *# The Product.availability. Value is one of * *# \"IN_STOCK\", \"OUT_OF_STOCK\", PREORDER\", \"BACKORDER\". * | \"availability\"; *# The ColorInfo.color_families. * | \"colorFamilies\"; *# The ColorInfo.colors. * | \"colors\"; *# The Product.sizes. * | \"sizes\"; *# The Product.materials. * | \"materials\"; *# The Product.patterns. * | \"patterns\"; *# The Product.conditions. * | \"conditions\"; *# The textual custom attribute in Product object. Key can * *# be any key in the Product.attributes map * *# if the attribute values are textual. * | \"attributes.key\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"pickup-in-store\". * | \"pickupInStore\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"ship-to-store\". * | \"shipToStore\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"same-day-delivery\". * | \"sameDayDelivery\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"next-day-delivery\". * | \"nextDayDelivery\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"custom-type-1\". * | \"customFulfillment1\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"custom-type-2\". * | \"customFulfillment2\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"custom-type-3\". * | \"customFulfillment3\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"custom-type-4\". * | \"customFulfillment4\"; *# The FulfillmentInfo.place_ids for FulfillmentInfo.type * *# \"custom-type-5\". * | \"customFulfillment5\"; * numerical_field = *# The PriceInfo.price. * | \"price\"; *# The discount. Computed by (original_price-price)/price * | \"discount\"; *# The Rating.average_rating. * | \"rating\"; *# The Rating.rating_count. * | \"ratingCount\"; *# The numerical custom attribute in Product object. Key can * *# be any key in the Product.attributes map * *# if the attribute values are numerical. * | \"attributes.key\";",
           "type": "string"
         },
         "orderBy": {
-          "description": "The order in which Facet.values are returned. Allowed values are: * \"count desc\", which means order by Facet.FacetValue.count descending. * \"value desc\", which means order by Facet.FacetValue.value descending. Only applies to textual facets. If not set, textual values are sorted in [natural order](https://en.wikipedia.org/wiki/Natural_sort_order); numerical intervals are sorted in the order given by FacetSpec.FacetKey.intervals; FulfillmentInfo.ids are sorted in the order given by FacetSpec.FacetKey.restricted_values.",
+          "description": "The order in which Facet.values are returned. Allowed values are: * \"count desc\", which means order by Facet.FacetValue.count descending. * \"value desc\", which means order by Facet.FacetValue.value descending. Only applies to textual facets. If not set, textual values are sorted in [natural order](https://en.wikipedia.org/wiki/Natural_sort_order); numerical intervals are sorted in the order given by FacetSpec.FacetKey.intervals; FulfillmentInfo.place_ids are sorted in the order given by FacetSpec.FacetKey.restricted_values.",
           "type": "string"
         },
         "prefixes": {
@@ -3177,7 +3177,7 @@
           "additionalProperties": {
             "type": "any"
           },
-          "description": "The rollup matching variant Product attributes. The key is one of the SearchRequest.variant_rollup_keys. The values are the merged and de-duplicated Product attributes. Notice that the rollup values are respect filter. For example, when filtering by \"colorFamilies:ANY(\\\"red\\\")\" and rollup \"colorFamilies\", only \"red\" is returned. For textual and numerical attributes, the rollup values is a list of string or double values with type google.protobuf.ListValue. For example, if there are two variants with colors \"red\" and \"blue\", the rollup values are { key: \"colorFamilies\" value { list_value { values { string_value: \"red\" } values { string_value: \"blue\" } } } } For Product.fulfillment_info, the rollup values is a double value with type google.protobuf.Value. For example, {key: \"pickupInStore.store1\" value { number_value: 10 }} means a there are 10 variants in this product are available in the store \"store1\".",
+          "description": "The rollup matching variant Product attributes. The key is one of the SearchRequest.variant_rollup_keys. The values are the merged and de-duplicated Product attributes. Notice that the rollup values are respect filter. For example, when filtering by \"colorFamilies:ANY(\\\"red\\\")\" and rollup \"colorFamilies\", only \"red\" is returned. For textual and numerical attributes, the rollup values is a list of string or double values with type google.protobuf.ListValue. For example, if there are two variants with colors \"red\" and \"blue\", the rollup values are { key: \"colorFamilies\" value { list_value { values { string_value: \"red\" } values { string_value: \"blue\" } } } } For FulfillmentInfo, the rollup values is a double value with type google.protobuf.Value. For example, {key: \"pickupInStore.store1\" value { number_value: 10 }} means a there are 10 variants in this product are available in the store \"store1\".",
           "type": "object"
         }
       },
diff --git a/googleapiclient/discovery_cache/documents/runtimeconfig.v1.json b/googleapiclient/discovery_cache/documents/runtimeconfig.v1.json
index 1151a3e..87a20e7 100644
--- a/googleapiclient/discovery_cache/documents/runtimeconfig.v1.json
+++ b/googleapiclient/discovery_cache/documents/runtimeconfig.v1.json
@@ -210,7 +210,7 @@
       }
     }
   },
-  "revision": "20210726",
+  "revision": "20210731",
   "rootUrl": "https://runtimeconfig.googleapis.com/",
   "schemas": {
     "CancelOperationRequest": {
diff --git a/googleapiclient/discovery_cache/documents/runtimeconfig.v1beta1.json b/googleapiclient/discovery_cache/documents/runtimeconfig.v1beta1.json
index 66d4558..4d145b8 100644
--- a/googleapiclient/discovery_cache/documents/runtimeconfig.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/runtimeconfig.v1beta1.json
@@ -805,7 +805,7 @@
       }
     }
   },
-  "revision": "20210719",
+  "revision": "20210726",
   "rootUrl": "https://runtimeconfig.googleapis.com/",
   "schemas": {
     "Binding": {
diff --git a/googleapiclient/discovery_cache/documents/safebrowsing.v4.json b/googleapiclient/discovery_cache/documents/safebrowsing.v4.json
index dc8b152..6054b62 100644
--- a/googleapiclient/discovery_cache/documents/safebrowsing.v4.json
+++ b/googleapiclient/discovery_cache/documents/safebrowsing.v4.json
@@ -261,7 +261,7 @@
       }
     }
   },
-  "revision": "20210721",
+  "revision": "20210731",
   "rootUrl": "https://safebrowsing.googleapis.com/",
   "schemas": {
     "GoogleProtobufEmpty": {
diff --git a/googleapiclient/discovery_cache/documents/sasportal.v1alpha1.json b/googleapiclient/discovery_cache/documents/sasportal.v1alpha1.json
index 1c3f23c..9a7eb47 100644
--- a/googleapiclient/discovery_cache/documents/sasportal.v1alpha1.json
+++ b/googleapiclient/discovery_cache/documents/sasportal.v1alpha1.json
@@ -2483,7 +2483,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210723",
   "rootUrl": "https://sasportal.googleapis.com/",
   "schemas": {
     "SasPortalAssignment": {
diff --git a/googleapiclient/discovery_cache/documents/script.v1.json b/googleapiclient/discovery_cache/documents/script.v1.json
index e2db03c..c0d546d 100644
--- a/googleapiclient/discovery_cache/documents/script.v1.json
+++ b/googleapiclient/discovery_cache/documents/script.v1.json
@@ -887,7 +887,7 @@
       }
     }
   },
-  "revision": "20210717",
+  "revision": "20210723",
   "rootUrl": "https://script.googleapis.com/",
   "schemas": {
     "Content": {
diff --git a/googleapiclient/discovery_cache/documents/securitycenter.v1.json b/googleapiclient/discovery_cache/documents/securitycenter.v1.json
index 01047d8..1ae17a7 100644
--- a/googleapiclient/discovery_cache/documents/securitycenter.v1.json
+++ b/googleapiclient/discovery_cache/documents/securitycenter.v1.json
@@ -1816,7 +1816,7 @@
       }
     }
   },
-  "revision": "20210716",
+  "revision": "20210723",
   "rootUrl": "https://securitycenter.googleapis.com/",
   "schemas": {
     "Asset": {
diff --git a/googleapiclient/discovery_cache/documents/securitycenter.v1beta1.json b/googleapiclient/discovery_cache/documents/securitycenter.v1beta1.json
index 885ddcb..b914de3 100644
--- a/googleapiclient/discovery_cache/documents/securitycenter.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/securitycenter.v1beta1.json
@@ -896,7 +896,7 @@
       }
     }
   },
-  "revision": "20210716",
+  "revision": "20210723",
   "rootUrl": "https://securitycenter.googleapis.com/",
   "schemas": {
     "Asset": {
diff --git a/googleapiclient/discovery_cache/documents/securitycenter.v1beta2.json b/googleapiclient/discovery_cache/documents/securitycenter.v1beta2.json
index af088a4..671edee 100644
--- a/googleapiclient/discovery_cache/documents/securitycenter.v1beta2.json
+++ b/googleapiclient/discovery_cache/documents/securitycenter.v1beta2.json
@@ -1328,7 +1328,7 @@
       }
     }
   },
-  "revision": "20210716",
+  "revision": "20210723",
   "rootUrl": "https://securitycenter.googleapis.com/",
   "schemas": {
     "Config": {
diff --git a/googleapiclient/discovery_cache/documents/serviceconsumermanagement.v1.json b/googleapiclient/discovery_cache/documents/serviceconsumermanagement.v1.json
index dd76f10..c66f39b 100644
--- a/googleapiclient/discovery_cache/documents/serviceconsumermanagement.v1.json
+++ b/googleapiclient/discovery_cache/documents/serviceconsumermanagement.v1.json
@@ -542,7 +542,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://serviceconsumermanagement.googleapis.com/",
   "schemas": {
     "AddTenantProjectRequest": {
@@ -1736,7 +1736,7 @@
           "type": "string"
         },
         "type": {
-          "description": "Required. The monitored resource type. For example, the type `\"cloudsql_database\"` represents databases in Google Cloud SQL.",
+          "description": "Required. The monitored resource type. For example, the type `\"cloudsql_database\"` represents databases in Google Cloud SQL. For a list of types, see [Monitoring resource types](https://cloud.google.com/monitoring/api/resources) and [Logging resource types](https://cloud.google.com/logging/docs/api/v2/resource-list).",
           "type": "string"
         }
       },
diff --git a/googleapiclient/discovery_cache/documents/serviceconsumermanagement.v1beta1.json b/googleapiclient/discovery_cache/documents/serviceconsumermanagement.v1beta1.json
index 49ffa12..ece73ff 100644
--- a/googleapiclient/discovery_cache/documents/serviceconsumermanagement.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/serviceconsumermanagement.v1beta1.json
@@ -500,7 +500,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://serviceconsumermanagement.googleapis.com/",
   "schemas": {
     "Api": {
@@ -1570,7 +1570,7 @@
           "type": "string"
         },
         "type": {
-          "description": "Required. The monitored resource type. For example, the type `\"cloudsql_database\"` represents databases in Google Cloud SQL.",
+          "description": "Required. The monitored resource type. For example, the type `\"cloudsql_database\"` represents databases in Google Cloud SQL. For a list of types, see [Monitoring resource types](https://cloud.google.com/monitoring/api/resources) and [Logging resource types](https://cloud.google.com/logging/docs/api/v2/resource-list).",
           "type": "string"
         }
       },
diff --git a/googleapiclient/discovery_cache/documents/servicecontrol.v1.json b/googleapiclient/discovery_cache/documents/servicecontrol.v1.json
index 0e50f81..b91a877 100644
--- a/googleapiclient/discovery_cache/documents/servicecontrol.v1.json
+++ b/googleapiclient/discovery_cache/documents/servicecontrol.v1.json
@@ -197,7 +197,7 @@
       }
     }
   },
-  "revision": "20210709",
+  "revision": "20210729",
   "rootUrl": "https://servicecontrol.googleapis.com/",
   "schemas": {
     "AllocateInfo": {
diff --git a/googleapiclient/discovery_cache/documents/servicecontrol.v2.json b/googleapiclient/discovery_cache/documents/servicecontrol.v2.json
index 4454332..49e8e32 100644
--- a/googleapiclient/discovery_cache/documents/servicecontrol.v2.json
+++ b/googleapiclient/discovery_cache/documents/servicecontrol.v2.json
@@ -169,7 +169,7 @@
       }
     }
   },
-  "revision": "20210709",
+  "revision": "20210729",
   "rootUrl": "https://servicecontrol.googleapis.com/",
   "schemas": {
     "Api": {
diff --git a/googleapiclient/discovery_cache/documents/servicemanagement.v1.json b/googleapiclient/discovery_cache/documents/servicemanagement.v1.json
index 001a664..224d59e 100644
--- a/googleapiclient/discovery_cache/documents/servicemanagement.v1.json
+++ b/googleapiclient/discovery_cache/documents/servicemanagement.v1.json
@@ -829,7 +829,7 @@
       }
     }
   },
-  "revision": "20210716",
+  "revision": "20210730",
   "rootUrl": "https://servicemanagement.googleapis.com/",
   "schemas": {
     "Advice": {
diff --git a/googleapiclient/discovery_cache/documents/servicenetworking.v1.json b/googleapiclient/discovery_cache/documents/servicenetworking.v1.json
index 8bd3dc1..62f694f 100644
--- a/googleapiclient/discovery_cache/documents/servicenetworking.v1.json
+++ b/googleapiclient/discovery_cache/documents/servicenetworking.v1.json
@@ -860,7 +860,7 @@
       }
     }
   },
-  "revision": "20210721",
+  "revision": "20210727",
   "rootUrl": "https://servicenetworking.googleapis.com/",
   "schemas": {
     "AddDnsRecordSetMetadata": {
diff --git a/googleapiclient/discovery_cache/documents/servicenetworking.v1beta.json b/googleapiclient/discovery_cache/documents/servicenetworking.v1beta.json
index e91792b..20ff9f0 100644
--- a/googleapiclient/discovery_cache/documents/servicenetworking.v1beta.json
+++ b/googleapiclient/discovery_cache/documents/servicenetworking.v1beta.json
@@ -307,7 +307,7 @@
       }
     }
   },
-  "revision": "20210721",
+  "revision": "20210727",
   "rootUrl": "https://servicenetworking.googleapis.com/",
   "schemas": {
     "AddDnsRecordSetMetadata": {
diff --git a/googleapiclient/discovery_cache/documents/serviceusage.v1.json b/googleapiclient/discovery_cache/documents/serviceusage.v1.json
index 8d328a8..c18c842 100644
--- a/googleapiclient/discovery_cache/documents/serviceusage.v1.json
+++ b/googleapiclient/discovery_cache/documents/serviceusage.v1.json
@@ -426,7 +426,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://serviceusage.googleapis.com/",
   "schemas": {
     "AdminQuotaPolicy": {
@@ -2100,7 +2100,7 @@
           "type": "string"
         },
         "type": {
-          "description": "Required. The monitored resource type. For example, the type `\"cloudsql_database\"` represents databases in Google Cloud SQL.",
+          "description": "Required. The monitored resource type. For example, the type `\"cloudsql_database\"` represents databases in Google Cloud SQL. For a list of types, see [Monitoring resource types](https://cloud.google.com/monitoring/api/resources) and [Logging resource types](https://cloud.google.com/logging/docs/api/v2/resource-list).",
           "type": "string"
         }
       },
diff --git a/googleapiclient/discovery_cache/documents/serviceusage.v1beta1.json b/googleapiclient/discovery_cache/documents/serviceusage.v1beta1.json
index b336712..fadf314 100644
--- a/googleapiclient/discovery_cache/documents/serviceusage.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/serviceusage.v1beta1.json
@@ -959,7 +959,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://serviceusage.googleapis.com/",
   "schemas": {
     "AdminQuotaPolicy": {
@@ -2783,7 +2783,7 @@
           "type": "string"
         },
         "type": {
-          "description": "Required. The monitored resource type. For example, the type `\"cloudsql_database\"` represents databases in Google Cloud SQL.",
+          "description": "Required. The monitored resource type. For example, the type `\"cloudsql_database\"` represents databases in Google Cloud SQL. For a list of types, see [Monitoring resource types](https://cloud.google.com/monitoring/api/resources) and [Logging resource types](https://cloud.google.com/logging/docs/api/v2/resource-list).",
           "type": "string"
         }
       },
diff --git a/googleapiclient/discovery_cache/documents/sheets.v4.json b/googleapiclient/discovery_cache/documents/sheets.v4.json
index 7e7d3cf..bca22c8 100644
--- a/googleapiclient/discovery_cache/documents/sheets.v4.json
+++ b/googleapiclient/discovery_cache/documents/sheets.v4.json
@@ -870,7 +870,7 @@
       }
     }
   },
-  "revision": "20210719",
+  "revision": "20210727",
   "rootUrl": "https://sheets.googleapis.com/",
   "schemas": {
     "AddBandingRequest": {
diff --git a/googleapiclient/discovery_cache/documents/slides.v1.json b/googleapiclient/discovery_cache/documents/slides.v1.json
index 8b7688b..d61e841 100644
--- a/googleapiclient/discovery_cache/documents/slides.v1.json
+++ b/googleapiclient/discovery_cache/documents/slides.v1.json
@@ -313,7 +313,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210730",
   "rootUrl": "https://slides.googleapis.com/",
   "schemas": {
     "AffineTransform": {
diff --git a/googleapiclient/discovery_cache/documents/smartdevicemanagement.v1.json b/googleapiclient/discovery_cache/documents/smartdevicemanagement.v1.json
index b811638..a2f15f3 100644
--- a/googleapiclient/discovery_cache/documents/smartdevicemanagement.v1.json
+++ b/googleapiclient/discovery_cache/documents/smartdevicemanagement.v1.json
@@ -355,7 +355,7 @@
       }
     }
   },
-  "revision": "20210717",
+  "revision": "20210726",
   "rootUrl": "https://smartdevicemanagement.googleapis.com/",
   "schemas": {
     "GoogleHomeEnterpriseSdmV1Device": {
diff --git a/googleapiclient/discovery_cache/documents/spanner.v1.json b/googleapiclient/discovery_cache/documents/spanner.v1.json
index b57cb5c..7c07436 100644
--- a/googleapiclient/discovery_cache/documents/spanner.v1.json
+++ b/googleapiclient/discovery_cache/documents/spanner.v1.json
@@ -2037,7 +2037,7 @@
       }
     }
   },
-  "revision": "20210713",
+  "revision": "20210723",
   "rootUrl": "https://spanner.googleapis.com/",
   "schemas": {
     "Backup": {
@@ -2858,12 +2858,12 @@
           "type": "string"
         },
         "nodeCount": {
-          "description": "The number of nodes allocated to this instance. This may be zero in API responses for instances that are not yet in state `READY`. See [the documentation](https://cloud.google.com/spanner/docs/instances#node_count) for more information about nodes.",
+          "description": "The number of nodes allocated to this instance. At most one of either node_count or processing_units should be present in the message. This may be zero in API responses for instances that are not yet in state `READY`. See [the documentation](https://cloud.google.com/spanner/docs/compute-capacity) for more information about nodes and processing units.",
           "format": "int32",
           "type": "integer"
         },
         "processingUnits": {
-          "description": "The number of processing units allocated to this instance. At most one of processing_units or node_count should be present in the message. This may be zero in API responses for instances that are not yet in state `READY`.",
+          "description": "The number of processing units allocated to this instance. At most one of processing_units or node_count should be present in the message. This may be zero in API responses for instances that are not yet in state `READY`. See [the documentation](https://cloud.google.com/spanner/docs/compute-capacity) for more information about nodes and processing units.",
           "format": "int32",
           "type": "integer"
         },
diff --git a/googleapiclient/discovery_cache/documents/speech.v1.json b/googleapiclient/discovery_cache/documents/speech.v1.json
index de56af2..95d0a10 100644
--- a/googleapiclient/discovery_cache/documents/speech.v1.json
+++ b/googleapiclient/discovery_cache/documents/speech.v1.json
@@ -212,7 +212,7 @@
       }
     }
   },
-  "revision": "20210714",
+  "revision": "20210726",
   "rootUrl": "https://speech.googleapis.com/",
   "schemas": {
     "ListOperationsResponse": {
diff --git a/googleapiclient/discovery_cache/documents/speech.v1p1beta1.json b/googleapiclient/discovery_cache/documents/speech.v1p1beta1.json
index 0424806..376ce2b 100644
--- a/googleapiclient/discovery_cache/documents/speech.v1p1beta1.json
+++ b/googleapiclient/discovery_cache/documents/speech.v1p1beta1.json
@@ -524,7 +524,7 @@
       }
     }
   },
-  "revision": "20210714",
+  "revision": "20210726",
   "rootUrl": "https://speech.googleapis.com/",
   "schemas": {
     "ClassItem": {
@@ -596,25 +596,6 @@
       "properties": {},
       "type": "object"
     },
-    "Entry": {
-      "description": "A single replacement configuration.",
-      "id": "Entry",
-      "properties": {
-        "caseSensitive": {
-          "description": "Whether the search is case sensitive.",
-          "type": "boolean"
-        },
-        "replace": {
-          "description": "What to replace with. Max length is 100 characters.",
-          "type": "string"
-        },
-        "search": {
-          "description": "What to replace. Max length is 100 characters.",
-          "type": "string"
-        }
-      },
-      "type": "object"
-    },
     "ListCustomClassesResponse": {
       "description": "Message returned to the client by the `ListCustomClasses` method.",
       "id": "ListCustomClassesResponse",
@@ -950,10 +931,6 @@
           },
           "type": "array"
         },
-        "transcriptNormalization": {
-          "$ref": "TranscriptNormalization",
-          "description": "Use transcription normalization to automatically replace parts of the transcript with phrases of your choosing. For StreamingRecognize, this normalization only applies to stable partial transcripts (stability > 0.8) and final transcripts."
-        },
         "useEnhanced": {
           "description": "Set to true to use an enhanced model for speech recognition. If `use_enhanced` is set to true and the `model` field is not set, then an appropriate enhanced model is chosen if an enhanced model exists for the audio. If `use_enhanced` is true and an enhanced version of the specified model does not exist, then the speech is recognized using the standard version of the specified model.",
           "type": "boolean"
@@ -1245,17 +1222,6 @@
       },
       "type": "object"
     },
-    "TranscriptNormalization": {
-      "description": "Transcription normalization configuration. Use transcription normalization to automatically replace parts of the transcript with phrases of your choosing. For StreamingRecognize, this normalization only applies to stable partial transcripts (stability > 0.8) and final transcripts.",
-      "id": "TranscriptNormalization",
-      "properties": {
-        "entries": {
-          "$ref": "Entry",
-          "description": "A list of replacement entries. We will perform replacement with one entry at a time. For example, the second entry in [\"cat\" => \"dog\", \"mountain cat\" => \"mountain dog\"] will never be applied because we will always process the first entry before it. At most 100 entries."
-        }
-      },
-      "type": "object"
-    },
     "TranscriptOutputConfig": {
       "description": "Specifies an optional destination for the recognition results.",
       "id": "TranscriptOutputConfig",
diff --git a/googleapiclient/discovery_cache/documents/speech.v2beta1.json b/googleapiclient/discovery_cache/documents/speech.v2beta1.json
index 579a81c..8d29522 100644
--- a/googleapiclient/discovery_cache/documents/speech.v2beta1.json
+++ b/googleapiclient/discovery_cache/documents/speech.v2beta1.json
@@ -184,7 +184,7 @@
       }
     }
   },
-  "revision": "20210714",
+  "revision": "20210726",
   "rootUrl": "https://speech.googleapis.com/",
   "schemas": {
     "ListOperationsResponse": {
diff --git a/googleapiclient/discovery_cache/documents/storage.v1.json b/googleapiclient/discovery_cache/documents/storage.v1.json
index a4f32b5..39a7719 100644
--- a/googleapiclient/discovery_cache/documents/storage.v1.json
+++ b/googleapiclient/discovery_cache/documents/storage.v1.json
@@ -26,7 +26,7 @@
   "description": "Stores and retrieves potentially large, immutable data objects.",
   "discoveryVersion": "v1",
   "documentationLink": "https://developers.google.com/storage/docs/json_api/",
-  "etag": "\"32333036333736303432373833323938323934\"",
+  "etag": "\"34363635363432323232343131303239393631\"",
   "icons": {
     "x16": "https://www.google.com/images/icons/product/cloud_storage-16.png",
     "x32": "https://www.google.com/images/icons/product/cloud_storage-32.png"
@@ -3230,7 +3230,7 @@
       }
     }
   },
-  "revision": "20210721",
+  "revision": "20210729",
   "rootUrl": "https://storage.googleapis.com/",
   "schemas": {
     "Bucket": {
diff --git a/googleapiclient/discovery_cache/documents/storagetransfer.v1.json b/googleapiclient/discovery_cache/documents/storagetransfer.v1.json
index b164e9f..a20f394 100644
--- a/googleapiclient/discovery_cache/documents/storagetransfer.v1.json
+++ b/googleapiclient/discovery_cache/documents/storagetransfer.v1.json
@@ -163,7 +163,7 @@
           ],
           "parameters": {
             "jobName": {
-              "description": "Required. \" The job to get.",
+              "description": "Required. The job to get.",
               "location": "path",
               "pattern": "^transferJobs/.*$",
               "required": true,
@@ -434,7 +434,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210726",
   "rootUrl": "https://storagetransfer.googleapis.com/",
   "schemas": {
     "AwsAccessKey": {
@@ -469,7 +469,7 @@
           "type": "string"
         },
         "roleArn": {
-          "description": "Input only. The Amazon Resource Name (ARN) of the role to support temporary credentials via `AssumeRoleWithWebIdentity`. For more information about ARNs, see [IAM ARNs](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns). When a role ARN is provided, Transfer Service fetches temporary credentials for the session using a `AssumeRoleWithWebIdentity` call for the provided role using the GoogleServiceAccount for this project.",
+          "description": "The Amazon Resource Name (ARN) of the role to support temporary credentials via `AssumeRoleWithWebIdentity`. For more information about ARNs, see [IAM ARNs](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns). When a role ARN is provided, Transfer Service fetches temporary credentials for the session using a `AssumeRoleWithWebIdentity` call for the provided role using the GoogleServiceAccount for this project.",
           "type": "string"
         }
       },
@@ -699,6 +699,17 @@
       },
       "type": "object"
     },
+    "LoggingConfig": {
+      "description": "Logging configure.",
+      "id": "LoggingConfig",
+      "properties": {
+        "enableOnpremGcsTransferLogs": {
+          "description": "Enables the Cloud Storage transfer logs for this transfer. This is only supported for transfer jobs with PosixFilesystem sources. The default is that logs are not generated for this transfer.",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
     "NotificationConfig": {
       "description": "Specification to configure notifications published to Pub/Sub. Notifications are published to the customer-provided topic using the following `PubsubMessage.attributes`: * `\"eventType\"`: one of the EventType values * `\"payloadFormat\"`: one of the PayloadFormat values * `\"projectId\"`: the project_id of the `TransferOperation` * `\"transferJobName\"`: the transfer_job_name of the `TransferOperation` * `\"transferOperationName\"`: the name of the `TransferOperation` The `PubsubMessage.data` contains a TransferOperation resource formatted according to the specified `PayloadFormat`.",
       "id": "NotificationConfig",
@@ -825,6 +836,17 @@
       "properties": {},
       "type": "object"
     },
+    "PosixFilesystem": {
+      "description": "A POSIX filesystem data source or sink.",
+      "id": "PosixFilesystem",
+      "properties": {
+        "rootDirectory": {
+          "description": "Root directory path to the filesystem.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "ResumeTransferOperationRequest": {
       "description": "Request passed to ResumeTransferOperation.",
       "id": "ResumeTransferOperationRequest",
@@ -968,6 +990,21 @@
           "format": "int64",
           "type": "string"
         },
+        "directoriesFailedToListFromSource": {
+          "description": "For transfers involving PosixFilesystem only. Number of listing failures for each directory found at the source. Potential failures when listing a directory include permission failure or block failure. If listing a directory fails, no files in the directory are transferred.",
+          "format": "int64",
+          "type": "string"
+        },
+        "directoriesFoundFromSource": {
+          "description": "For transfers involving PosixFilesystem only. Number of directories found while listing. For example, if the root directory of the transfer is `base/` and there are two other directories, `a/` and `b/` under this directory, the count after listing `base/`, `base/a/` and `base/b/` is 3.",
+          "format": "int64",
+          "type": "string"
+        },
+        "directoriesSuccessfullyListedFromSource": {
+          "description": "For transfers involving PosixFilesystem only. Number of successful listings for each directory found at the source.",
+          "format": "int64",
+          "type": "string"
+        },
         "objectsCopiedToSink": {
           "description": "Objects that are copied to the data sink.",
           "format": "int64",
@@ -1041,6 +1078,10 @@
           "description": "The name of the most recently started TransferOperation of this JobConfig. Present if a TransferOperation has been created for this JobConfig.",
           "type": "string"
         },
+        "loggingConfig": {
+          "$ref": "LoggingConfig",
+          "description": "Logging configuration."
+        },
         "name": {
           "description": "A unique name (within the transfer project) assigned when the job is created. If this field is empty in a CreateTransferJobRequest, Storage Transfer Service assigns a unique name. Otherwise, the specified name is used as the unique name for this job. If the specified name is in use by a job, the creation request fails with an ALREADY_EXISTS error. This name must start with `\"transferJobs/\"` prefix and end with a letter or a number, and should be no more than 128 characters. For transfers involving PosixFilesystem, this name must start with 'transferJobs/OPI' specifically. For all other transfer types, this name must not start with 'transferJobs/OPI'. 'transferJobs/OPI' is a reserved prefix for PosixFilesystem transfers. Non-PosixFilesystem example: `\"transferJobs/^(?!OPI)[A-Za-z0-9-._~]*[A-Za-z0-9]$\"` PosixFilesystem example: `\"transferJobs/OPI^[A-Za-z0-9-._~]*[A-Za-z0-9]$\"` Applications must not rely on the enforcement of naming requirements involving OPI. Invalid job names fail with an INVALID_ARGUMENT error.",
           "type": "string"
@@ -1197,6 +1238,10 @@
           "$ref": "ObjectConditions",
           "description": "Only objects that satisfy these object conditions are included in the set of data source and data sink objects. Object conditions based on objects' \"last modification time\" do not exclude objects in a data sink."
         },
+        "posixDataSource": {
+          "$ref": "PosixFilesystem",
+          "description": "A POSIX Filesystem data source."
+        },
         "transferOptions": {
           "$ref": "TransferOptions",
           "description": "If the option delete_objects_unique_in_sink is `true` and time-based object conditions such as 'last modification time' are specified, the request fails with an INVALID_ARGUMENT error."
diff --git a/googleapiclient/discovery_cache/documents/streetviewpublish.v1.json b/googleapiclient/discovery_cache/documents/streetviewpublish.v1.json
index e2cc6b2..0264505 100644
--- a/googleapiclient/discovery_cache/documents/streetviewpublish.v1.json
+++ b/googleapiclient/discovery_cache/documents/streetviewpublish.v1.json
@@ -375,7 +375,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210728",
   "rootUrl": "https://streetviewpublish.googleapis.com/",
   "schemas": {
     "BatchDeletePhotosRequest": {
diff --git a/googleapiclient/discovery_cache/documents/sts.v1.json b/googleapiclient/discovery_cache/documents/sts.v1.json
index b7cce72..77bb970 100644
--- a/googleapiclient/discovery_cache/documents/sts.v1.json
+++ b/googleapiclient/discovery_cache/documents/sts.v1.json
@@ -131,7 +131,7 @@
       }
     }
   },
-  "revision": "20210716",
+  "revision": "20210723",
   "rootUrl": "https://sts.googleapis.com/",
   "schemas": {
     "GoogleIdentityStsV1ExchangeTokenRequest": {
@@ -139,7 +139,7 @@
       "id": "GoogleIdentityStsV1ExchangeTokenRequest",
       "properties": {
         "audience": {
-          "description": "The full resource name of the identity provider; for example: `//iam.googleapis.com/projects//workloadIdentityPools//providers/`. Required when exchanging an external credential for a Google access token.",
+          "description": "The full resource name of the identity provider; for example: `//iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/`. Required when exchanging an external credential for a Google access token.",
           "type": "string"
         },
         "grantType": {
@@ -159,7 +159,7 @@
           "type": "string"
         },
         "subjectToken": {
-          "description": "Required. The input token. This token is either an external credential issued by a workload identity pool provider, or a short-lived access token issued by Google. If the token is an OIDC JWT, it must use the JWT format defined in [RFC 7523](https://tools.ietf.org/html/rfc7523), and the `subject_token_type` must be either `urn:ietf:params:oauth:token-type:jwt` or `urn:ietf:params:oauth:token-type:id_token`. The following headers are required: - `kid`: The identifier of the signing key securing the JWT. - `alg`: The cryptographic algorithm securing the JWT. Must be `RS256` or `ES256`. The following payload fields are required. For more information, see [RFC 7523, Section 3](https://tools.ietf.org/html/rfc7523#section-3): - `iss`: The issuer of the token. The issuer must provide a discovery document at the URL `/.well-known/openid-configuration`, where `` is the value of this field. The document must be formatted according to section 4.2 of the [OIDC 1.0 Discovery specification](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). - `iat`: The issue time, in seconds, since the Unix epoch. Must be in the past. - `exp`: The expiration time, in seconds, since the Unix epoch. Must be less than 48 hours after `iat`. Shorter expiration times are more secure. If possible, we recommend setting an expiration time less than 6 hours. - `sub`: The identity asserted in the JWT. - `aud`: For workload identity pools, this must be a value specified in the allowed audiences for the workload identity pool provider, or one of the audiences allowed by default if no audiences were specified. See https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.providers#oidc Example header: ``` { \"alg\": \"RS256\", \"kid\": \"us-east-11\" } ``` Example payload: ``` { \"iss\": \"https://accounts.google.com\", \"iat\": 1517963104, \"exp\": 1517966704, \"aud\": \"//iam.googleapis.com/projects/1234567890123/locations/global/workloadIdentityPools/my-pool/providers/my-provider\", \"sub\": \"113475438248934895348\", \"my_claims\": { \"additional_claim\": \"value\" } } ``` If `subject_token` is for AWS, it must be a serialized `GetCallerIdentity` token. This token contains the same information as a request to the AWS [`GetCallerIdentity()`](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity) method, as well as the AWS [signature](https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html) for the request information. Use Signature Version 4. Format the request as URL-encoded JSON, and set the `subject_token_type` parameter to `urn:ietf:params:aws:token-type:aws4_request`. The following parameters are required: - `url`: The URL of the AWS STS endpoint for `GetCallerIdentity()`, such as `https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15`. Regional endpoints are also supported. - `method`: The HTTP request method: `POST`. - `headers`: The HTTP request headers, which must include: - `Authorization`: The request signature. - `x-amz-date`: The time you will send the request, formatted as an [ISO8601 Basic](https://docs.aws.amazon.com/general/latest/gr/sigv4_elements.html#sigv4_elements_date) string. This value is typically set to the current time and is used to help prevent replay attacks. - `host`: The hostname of the `url` field; for example, `sts.amazonaws.com`. - `x-goog-cloud-target-resource`: The full, canonical resource name of the workload identity pool provider, with or without an `https:` prefix. To help ensure data integrity, we recommend including this header in the `SignedHeaders` field of the signed request. For example: //iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ If you are using temporary security credentials provided by AWS, you must also include the header `x-amz-security-token`, with the value set to the session token. The following example shows a `GetCallerIdentity` token: ``` { \"headers\": [ {\"key\": \"x-amz-date\", \"value\": \"20200815T015049Z\"}, {\"key\": \"Authorization\", \"value\": \"AWS4-HMAC-SHA256+Credential=$credential,+SignedHeaders=host;x-amz-date;x-goog-cloud-target-resource,+Signature=$signature\"}, {\"key\": \"x-goog-cloud-target-resource\", \"value\": \"//iam.googleapis.com/projects//locations//workloadIdentityPools//providers/\"}, {\"key\": \"host\", \"value\": \"sts.amazonaws.com\"} . ], \"method\": \"POST\", \"url\": \"https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15\" } ``` You can also use a Google-issued OAuth 2.0 access token with this field to obtain an access token with new security attributes applied, such as a Credential Access Boundary. In this case, set `subject_token_type` to `urn:ietf:params:oauth:token-type:access_token`. If an access token already contains security attributes, you cannot apply additional security attributes.",
+          "description": "Required. The input token. This token is either an external credential issued by a workload identity pool provider, or a short-lived access token issued by Google. If the token is an OIDC JWT, it must use the JWT format defined in [RFC 7523](https://tools.ietf.org/html/rfc7523), and the `subject_token_type` must be either `urn:ietf:params:oauth:token-type:jwt` or `urn:ietf:params:oauth:token-type:id_token`. The following headers are required: - `kid`: The identifier of the signing key securing the JWT. - `alg`: The cryptographic algorithm securing the JWT. Must be `RS256` or `ES256`. The following payload fields are required. For more information, see [RFC 7523, Section 3](https://tools.ietf.org/html/rfc7523#section-3): - `iss`: The issuer of the token. The issuer must provide a discovery document at the URL `/.well-known/openid-configuration`, where `` is the value of this field. The document must be formatted according to section 4.2 of the [OIDC 1.0 Discovery specification](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). - `iat`: The issue time, in seconds, since the Unix epoch. Must be in the past. - `exp`: The expiration time, in seconds, since the Unix epoch. Must be less than 48 hours after `iat`. Shorter expiration times are more secure. If possible, we recommend setting an expiration time less than 6 hours. - `sub`: The identity asserted in the JWT. - `aud`: For workload identity pools, this must be a value specified in the allowed audiences for the workload identity pool provider, or one of the audiences allowed by default if no audiences were specified. See https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.providers#oidc Example header: ``` { \"alg\": \"RS256\", \"kid\": \"us-east-11\" } ``` Example payload: ``` { \"iss\": \"https://accounts.google.com\", \"iat\": 1517963104, \"exp\": 1517966704, \"aud\": \"//iam.googleapis.com/projects/1234567890123/locations/global/workloadIdentityPools/my-pool/providers/my-provider\", \"sub\": \"113475438248934895348\", \"my_claims\": { \"additional_claim\": \"value\" } } ``` If `subject_token` is for AWS, it must be a serialized `GetCallerIdentity` token. This token contains the same information as a request to the AWS [`GetCallerIdentity()`](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity) method, as well as the AWS [signature](https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html) for the request information. Use Signature Version 4. Format the request as URL-encoded JSON, and set the `subject_token_type` parameter to `urn:ietf:params:aws:token-type:aws4_request`. The following parameters are required: - `url`: The URL of the AWS STS endpoint for `GetCallerIdentity()`, such as `https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15`. Regional endpoints are also supported. - `method`: The HTTP request method: `POST`. - `headers`: The HTTP request headers, which must include: - `Authorization`: The request signature. - `x-amz-date`: The time you will send the request, formatted as an [ISO8601 Basic](https://docs.aws.amazon.com/general/latest/gr/sigv4_elements.html#sigv4_elements_date) string. This value is typically set to the current time and is used to help prevent replay attacks. - `host`: The hostname of the `url` field; for example, `sts.amazonaws.com`. - `x-goog-cloud-target-resource`: The full, canonical resource name of the workload identity pool provider, with or without an `https:` prefix. To help ensure data integrity, we recommend including this header in the `SignedHeaders` field of the signed request. For example: //iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ If you are using temporary security credentials provided by AWS, you must also include the header `x-amz-security-token`, with the value set to the session token. The following example shows a `GetCallerIdentity` token: ``` { \"headers\": [ {\"key\": \"x-amz-date\", \"value\": \"20200815T015049Z\"}, {\"key\": \"Authorization\", \"value\": \"AWS4-HMAC-SHA256+Credential=$credential,+SignedHeaders=host;x-amz-date;x-goog-cloud-target-resource,+Signature=$signature\"}, {\"key\": \"x-goog-cloud-target-resource\", \"value\": \"//iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/\"}, {\"key\": \"host\", \"value\": \"sts.amazonaws.com\"} . ], \"method\": \"POST\", \"url\": \"https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15\" } ``` You can also use a Google-issued OAuth 2.0 access token with this field to obtain an access token with new security attributes applied, such as a Credential Access Boundary. In this case, set `subject_token_type` to `urn:ietf:params:oauth:token-type:access_token`. If an access token already contains security attributes, you cannot apply additional security attributes.",
           "type": "string"
         },
         "subjectTokenType": {
@@ -243,7 +243,7 @@
           "type": "string"
         },
         "username": {
-          "description": "The human-readable identifier for the token principal subject. For example, if the provided token is associated with a workload identity pool, this field contains a value in the following format: `principal://iam.googleapis.com/projects//locations//workloadIdentityPools//subject/`",
+          "description": "The human-readable identifier for the token principal subject. For example, if the provided token is associated with a workload identity pool, this field contains a value in the following format: `principal://iam.googleapis.com/projects//locations/global/workloadIdentityPools//subject/`",
           "type": "string"
         }
       },
diff --git a/googleapiclient/discovery_cache/documents/sts.v1beta.json b/googleapiclient/discovery_cache/documents/sts.v1beta.json
index 31c70eb..8b50a3a 100644
--- a/googleapiclient/discovery_cache/documents/sts.v1beta.json
+++ b/googleapiclient/discovery_cache/documents/sts.v1beta.json
@@ -116,7 +116,7 @@
       }
     }
   },
-  "revision": "20210716",
+  "revision": "20210723",
   "rootUrl": "https://sts.googleapis.com/",
   "schemas": {
     "GoogleIdentityStsV1betaExchangeTokenRequest": {
@@ -124,7 +124,7 @@
       "id": "GoogleIdentityStsV1betaExchangeTokenRequest",
       "properties": {
         "audience": {
-          "description": "The full resource name of the identity provider. For example, `//iam.googleapis.com/projects//workloadIdentityPools//providers/`. Required when exchanging an external credential for a Google access token.",
+          "description": "The full resource name of the identity provider. For example, `//iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/`. Required when exchanging an external credential for a Google access token.",
           "type": "string"
         },
         "grantType": {
@@ -144,7 +144,7 @@
           "type": "string"
         },
         "subjectToken": {
-          "description": "Required. The input token. This token is either an external credential issued by a workload identity pool provider, or a short-lived access token issued by Google. If the token is an OIDC JWT, it must use the JWT format defined in [RFC 7523](https://tools.ietf.org/html/rfc7523), and the `subject_token_type` must be either `urn:ietf:params:oauth:token-type:jwt` or `urn:ietf:params:oauth:token-type:id_token`. The following headers are required: - `kid`: The identifier of the signing key securing the JWT. - `alg`: The cryptographic algorithm securing the JWT. Must be `RS256` or `ES256`. The following payload fields are required. For more information, see [RFC 7523, Section 3](https://tools.ietf.org/html/rfc7523#section-3): - `iss`: The issuer of the token. The issuer must provide a discovery document at the URL `/.well-known/openid-configuration`, where `` is the value of this field. The document must be formatted according to section 4.2 of the [OIDC 1.0 Discovery specification](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). - `iat`: The issue time, in seconds, since the Unix epoch. Must be in the past. - `exp`: The expiration time, in seconds, since the Unix epoch. Must be less than 48 hours after `iat`. Shorter expiration times are more secure. If possible, we recommend setting an expiration time less than 6 hours. - `sub`: The identity asserted in the JWT. - `aud`: For workload identity pools, this must be a value specified in the allowed audiences for the workload identity pool provider, or one of the audiences allowed by default if no audiences were specified. See https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.providers#oidc Example header: ``` { \"alg\": \"RS256\", \"kid\": \"us-east-11\" } ``` Example payload: ``` { \"iss\": \"https://accounts.google.com\", \"iat\": 1517963104, \"exp\": 1517966704, \"aud\": \"//iam.googleapis.com/projects/1234567890123/locations/global/workloadIdentityPools/my-pool/providers/my-provider\", \"sub\": \"113475438248934895348\", \"my_claims\": { \"additional_claim\": \"value\" } } ``` If `subject_token` is for AWS, it must be a serialized `GetCallerIdentity` token. This token contains the same information as a request to the AWS [`GetCallerIdentity()`](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity) method, as well as the AWS [signature](https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html) for the request information. Use Signature Version 4. Format the request as URL-encoded JSON, and set the `subject_token_type` parameter to `urn:ietf:params:aws:token-type:aws4_request`. The following parameters are required: - `url`: The URL of the AWS STS endpoint for `GetCallerIdentity()`, such as `https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15`. Regional endpoints are also supported. - `method`: The HTTP request method: `POST`. - `headers`: The HTTP request headers, which must include: - `Authorization`: The request signature. - `x-amz-date`: The time you will send the request, formatted as an [ISO8601 Basic](https://docs.aws.amazon.com/general/latest/gr/sigv4_elements.html#sigv4_elements_date) string. This value is typically set to the current time and is used to help prevent replay attacks. - `host`: The hostname of the `url` field; for example, `sts.amazonaws.com`. - `x-goog-cloud-target-resource`: The full, canonical resource name of the workload identity pool provider, with or without an `https:` prefix. To help ensure data integrity, we recommend including this header in the `SignedHeaders` field of the signed request. For example: //iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ If you are using temporary security credentials provided by AWS, you must also include the header `x-amz-security-token`, with the value set to the session token. The following example shows a `GetCallerIdentity` token: ``` { \"headers\": [ {\"key\": \"x-amz-date\", \"value\": \"20200815T015049Z\"}, {\"key\": \"Authorization\", \"value\": \"AWS4-HMAC-SHA256+Credential=$credential,+SignedHeaders=host;x-amz-date;x-goog-cloud-target-resource,+Signature=$signature\"}, {\"key\": \"x-goog-cloud-target-resource\", \"value\": \"//iam.googleapis.com/projects//locations//workloadIdentityPools//providers/\"}, {\"key\": \"host\", \"value\": \"sts.amazonaws.com\"} . ], \"method\": \"POST\", \"url\": \"https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15\" } ``` You can also use a Google-issued OAuth 2.0 access token with this field to obtain an access token with new security attributes applied, such as a Credential Access Boundary. In this case, set `subject_token_type` to `urn:ietf:params:oauth:token-type:access_token`. If an access token already contains security attributes, you cannot apply additional security attributes.",
+          "description": "Required. The input token. This token is either an external credential issued by a workload identity pool provider, or a short-lived access token issued by Google. If the token is an OIDC JWT, it must use the JWT format defined in [RFC 7523](https://tools.ietf.org/html/rfc7523), and the `subject_token_type` must be either `urn:ietf:params:oauth:token-type:jwt` or `urn:ietf:params:oauth:token-type:id_token`. The following headers are required: - `kid`: The identifier of the signing key securing the JWT. - `alg`: The cryptographic algorithm securing the JWT. Must be `RS256` or `ES256`. The following payload fields are required. For more information, see [RFC 7523, Section 3](https://tools.ietf.org/html/rfc7523#section-3): - `iss`: The issuer of the token. The issuer must provide a discovery document at the URL `/.well-known/openid-configuration`, where `` is the value of this field. The document must be formatted according to section 4.2 of the [OIDC 1.0 Discovery specification](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). - `iat`: The issue time, in seconds, since the Unix epoch. Must be in the past. - `exp`: The expiration time, in seconds, since the Unix epoch. Must be less than 48 hours after `iat`. Shorter expiration times are more secure. If possible, we recommend setting an expiration time less than 6 hours. - `sub`: The identity asserted in the JWT. - `aud`: For workload identity pools, this must be a value specified in the allowed audiences for the workload identity pool provider, or one of the audiences allowed by default if no audiences were specified. See https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.providers#oidc Example header: ``` { \"alg\": \"RS256\", \"kid\": \"us-east-11\" } ``` Example payload: ``` { \"iss\": \"https://accounts.google.com\", \"iat\": 1517963104, \"exp\": 1517966704, \"aud\": \"//iam.googleapis.com/projects/1234567890123/locations/global/workloadIdentityPools/my-pool/providers/my-provider\", \"sub\": \"113475438248934895348\", \"my_claims\": { \"additional_claim\": \"value\" } } ``` If `subject_token` is for AWS, it must be a serialized `GetCallerIdentity` token. This token contains the same information as a request to the AWS [`GetCallerIdentity()`](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity) method, as well as the AWS [signature](https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html) for the request information. Use Signature Version 4. Format the request as URL-encoded JSON, and set the `subject_token_type` parameter to `urn:ietf:params:aws:token-type:aws4_request`. The following parameters are required: - `url`: The URL of the AWS STS endpoint for `GetCallerIdentity()`, such as `https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15`. Regional endpoints are also supported. - `method`: The HTTP request method: `POST`. - `headers`: The HTTP request headers, which must include: - `Authorization`: The request signature. - `x-amz-date`: The time you will send the request, formatted as an [ISO8601 Basic](https://docs.aws.amazon.com/general/latest/gr/sigv4_elements.html#sigv4_elements_date) string. This value is typically set to the current time and is used to help prevent replay attacks. - `host`: The hostname of the `url` field; for example, `sts.amazonaws.com`. - `x-goog-cloud-target-resource`: The full, canonical resource name of the workload identity pool provider, with or without an `https:` prefix. To help ensure data integrity, we recommend including this header in the `SignedHeaders` field of the signed request. For example: //iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ If you are using temporary security credentials provided by AWS, you must also include the header `x-amz-security-token`, with the value set to the session token. The following example shows a `GetCallerIdentity` token: ``` { \"headers\": [ {\"key\": \"x-amz-date\", \"value\": \"20200815T015049Z\"}, {\"key\": \"Authorization\", \"value\": \"AWS4-HMAC-SHA256+Credential=$credential,+SignedHeaders=host;x-amz-date;x-goog-cloud-target-resource,+Signature=$signature\"}, {\"key\": \"x-goog-cloud-target-resource\", \"value\": \"//iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/\"}, {\"key\": \"host\", \"value\": \"sts.amazonaws.com\"} . ], \"method\": \"POST\", \"url\": \"https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15\" } ``` You can also use a Google-issued OAuth 2.0 access token with this field to obtain an access token with new security attributes applied, such as a Credential Access Boundary. In this case, set `subject_token_type` to `urn:ietf:params:oauth:token-type:access_token`. If an access token already contains security attributes, you cannot apply additional security attributes.",
           "type": "string"
         },
         "subjectTokenType": {
diff --git a/googleapiclient/discovery_cache/documents/tagmanager.v1.json b/googleapiclient/discovery_cache/documents/tagmanager.v1.json
index 6b59c5b..ab8dd07 100644
--- a/googleapiclient/discovery_cache/documents/tagmanager.v1.json
+++ b/googleapiclient/discovery_cache/documents/tagmanager.v1.json
@@ -1932,7 +1932,7 @@
       }
     }
   },
-  "revision": "20210721",
+  "revision": "20210728",
   "rootUrl": "https://tagmanager.googleapis.com/",
   "schemas": {
     "Account": {
diff --git a/googleapiclient/discovery_cache/documents/tagmanager.v2.json b/googleapiclient/discovery_cache/documents/tagmanager.v2.json
index 009efa7..68b840f 100644
--- a/googleapiclient/discovery_cache/documents/tagmanager.v2.json
+++ b/googleapiclient/discovery_cache/documents/tagmanager.v2.json
@@ -3143,7 +3143,7 @@
       }
     }
   },
-  "revision": "20210721",
+  "revision": "20210728",
   "rootUrl": "https://tagmanager.googleapis.com/",
   "schemas": {
     "Account": {
diff --git a/googleapiclient/discovery_cache/documents/tasks.v1.json b/googleapiclient/discovery_cache/documents/tasks.v1.json
index 686d4cc..4323ecd 100644
--- a/googleapiclient/discovery_cache/documents/tasks.v1.json
+++ b/googleapiclient/discovery_cache/documents/tasks.v1.json
@@ -566,7 +566,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://tasks.googleapis.com/",
   "schemas": {
     "Task": {
diff --git a/googleapiclient/discovery_cache/documents/testing.v1.json b/googleapiclient/discovery_cache/documents/testing.v1.json
index 8562746..43afdf8 100644
--- a/googleapiclient/discovery_cache/documents/testing.v1.json
+++ b/googleapiclient/discovery_cache/documents/testing.v1.json
@@ -282,7 +282,7 @@
       }
     }
   },
-  "revision": "20210719",
+  "revision": "20210728",
   "rootUrl": "https://testing.googleapis.com/",
   "schemas": {
     "Account": {
diff --git a/googleapiclient/discovery_cache/documents/toolresults.v1beta3.json b/googleapiclient/discovery_cache/documents/toolresults.v1beta3.json
index 61a934d..d620817 100644
--- a/googleapiclient/discovery_cache/documents/toolresults.v1beta3.json
+++ b/googleapiclient/discovery_cache/documents/toolresults.v1beta3.json
@@ -1463,7 +1463,7 @@
       }
     }
   },
-  "revision": "20210726",
+  "revision": "20210731",
   "rootUrl": "https://toolresults.googleapis.com/",
   "schemas": {
     "ANR": {
diff --git a/googleapiclient/discovery_cache/documents/transcoder.v1beta1.json b/googleapiclient/discovery_cache/documents/transcoder.v1beta1.json
index d93b0f7..865217a 100644
--- a/googleapiclient/discovery_cache/documents/transcoder.v1beta1.json
+++ b/googleapiclient/discovery_cache/documents/transcoder.v1beta1.json
@@ -355,7 +355,7 @@
       }
     }
   },
-  "revision": "20210719",
+  "revision": "20210731",
   "rootUrl": "https://transcoder.googleapis.com/",
   "schemas": {
     "AdBreak": {
@@ -1123,7 +1123,7 @@
           "type": "string"
         },
         "cancelRequested": {
-          "description": "Output only. Identifies whether the user has requested cancellation of the operation. Operations that have successfully been cancelled have Operation.error value with a google.rpc.Status.code of 1, corresponding to `Code.CANCELLED`.",
+          "description": "Output only. Identifies whether the user has requested cancellation of the operation. Operations that have been cancelled successfully have Operation.error value with a google.rpc.Status.code of 1, corresponding to `Code.CANCELLED`.",
           "readOnly": true,
           "type": "boolean"
         },
diff --git a/googleapiclient/discovery_cache/documents/translate.v3.json b/googleapiclient/discovery_cache/documents/translate.v3.json
index 89a5b9b..917b1a1 100644
--- a/googleapiclient/discovery_cache/documents/translate.v3.json
+++ b/googleapiclient/discovery_cache/documents/translate.v3.json
@@ -687,7 +687,7 @@
       }
     }
   },
-  "revision": "20210625",
+  "revision": "20210729",
   "rootUrl": "https://translation.googleapis.com/",
   "schemas": {
     "BatchTranslateTextRequest": {
diff --git a/googleapiclient/discovery_cache/documents/translate.v3beta1.json b/googleapiclient/discovery_cache/documents/translate.v3beta1.json
index b1dd0a1..0b63407 100644
--- a/googleapiclient/discovery_cache/documents/translate.v3beta1.json
+++ b/googleapiclient/discovery_cache/documents/translate.v3beta1.json
@@ -744,7 +744,7 @@
       }
     }
   },
-  "revision": "20210625",
+  "revision": "20210729",
   "rootUrl": "https://translation.googleapis.com/",
   "schemas": {
     "BatchDocumentInputConfig": {
diff --git a/googleapiclient/discovery_cache/documents/vectortile.v1.json b/googleapiclient/discovery_cache/documents/vectortile.v1.json
index e0b0089..4cb6db0 100644
--- a/googleapiclient/discovery_cache/documents/vectortile.v1.json
+++ b/googleapiclient/discovery_cache/documents/vectortile.v1.json
@@ -343,7 +343,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://vectortile.googleapis.com/",
   "schemas": {
     "Area": {
diff --git a/googleapiclient/discovery_cache/documents/videointelligence.v1.json b/googleapiclient/discovery_cache/documents/videointelligence.v1.json
index f001665..9231f5d 100644
--- a/googleapiclient/discovery_cache/documents/videointelligence.v1.json
+++ b/googleapiclient/discovery_cache/documents/videointelligence.v1.json
@@ -350,7 +350,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210722",
   "rootUrl": "https://videointelligence.googleapis.com/",
   "schemas": {
     "GoogleCloudVideointelligenceV1_AnnotateVideoProgress": {
diff --git a/googleapiclient/discovery_cache/documents/videointelligence.v1beta2.json b/googleapiclient/discovery_cache/documents/videointelligence.v1beta2.json
index bf409d2..b42c7ce 100644
--- a/googleapiclient/discovery_cache/documents/videointelligence.v1beta2.json
+++ b/googleapiclient/discovery_cache/documents/videointelligence.v1beta2.json
@@ -128,7 +128,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210722",
   "rootUrl": "https://videointelligence.googleapis.com/",
   "schemas": {
     "GoogleCloudVideointelligenceV1_AnnotateVideoProgress": {
diff --git a/googleapiclient/discovery_cache/documents/videointelligence.v1p1beta1.json b/googleapiclient/discovery_cache/documents/videointelligence.v1p1beta1.json
index 0094e3b..2081170 100644
--- a/googleapiclient/discovery_cache/documents/videointelligence.v1p1beta1.json
+++ b/googleapiclient/discovery_cache/documents/videointelligence.v1p1beta1.json
@@ -128,7 +128,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210722",
   "rootUrl": "https://videointelligence.googleapis.com/",
   "schemas": {
     "GoogleCloudVideointelligenceV1_AnnotateVideoProgress": {
diff --git a/googleapiclient/discovery_cache/documents/videointelligence.v1p2beta1.json b/googleapiclient/discovery_cache/documents/videointelligence.v1p2beta1.json
index fae868b..5d472df 100644
--- a/googleapiclient/discovery_cache/documents/videointelligence.v1p2beta1.json
+++ b/googleapiclient/discovery_cache/documents/videointelligence.v1p2beta1.json
@@ -128,7 +128,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210722",
   "rootUrl": "https://videointelligence.googleapis.com/",
   "schemas": {
     "GoogleCloudVideointelligenceV1_AnnotateVideoProgress": {
diff --git a/googleapiclient/discovery_cache/documents/videointelligence.v1p3beta1.json b/googleapiclient/discovery_cache/documents/videointelligence.v1p3beta1.json
index d79e046..8473492 100644
--- a/googleapiclient/discovery_cache/documents/videointelligence.v1p3beta1.json
+++ b/googleapiclient/discovery_cache/documents/videointelligence.v1p3beta1.json
@@ -128,7 +128,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210722",
   "rootUrl": "https://videointelligence.googleapis.com/",
   "schemas": {
     "GoogleCloudVideointelligenceV1_AnnotateVideoProgress": {
diff --git a/googleapiclient/discovery_cache/documents/vision.v1.json b/googleapiclient/discovery_cache/documents/vision.v1.json
index b5cf614..5d631c9 100644
--- a/googleapiclient/discovery_cache/documents/vision.v1.json
+++ b/googleapiclient/discovery_cache/documents/vision.v1.json
@@ -1282,7 +1282,7 @@
       }
     }
   },
-  "revision": "20210716",
+  "revision": "20210723",
   "rootUrl": "https://vision.googleapis.com/",
   "schemas": {
     "AddProductToProductSetRequest": {
diff --git a/googleapiclient/discovery_cache/documents/vision.v1p1beta1.json b/googleapiclient/discovery_cache/documents/vision.v1p1beta1.json
index 017c8cb..9342aef 100644
--- a/googleapiclient/discovery_cache/documents/vision.v1p1beta1.json
+++ b/googleapiclient/discovery_cache/documents/vision.v1p1beta1.json
@@ -449,7 +449,7 @@
       }
     }
   },
-  "revision": "20210716",
+  "revision": "20210723",
   "rootUrl": "https://vision.googleapis.com/",
   "schemas": {
     "AnnotateFileResponse": {
diff --git a/googleapiclient/discovery_cache/documents/vision.v1p2beta1.json b/googleapiclient/discovery_cache/documents/vision.v1p2beta1.json
index f1588da..af8ebfd 100644
--- a/googleapiclient/discovery_cache/documents/vision.v1p2beta1.json
+++ b/googleapiclient/discovery_cache/documents/vision.v1p2beta1.json
@@ -449,7 +449,7 @@
       }
     }
   },
-  "revision": "20210716",
+  "revision": "20210723",
   "rootUrl": "https://vision.googleapis.com/",
   "schemas": {
     "AnnotateFileResponse": {
diff --git a/googleapiclient/discovery_cache/documents/webrisk.v1.json b/googleapiclient/discovery_cache/documents/webrisk.v1.json
index a998db4..2935623 100644
--- a/googleapiclient/discovery_cache/documents/webrisk.v1.json
+++ b/googleapiclient/discovery_cache/documents/webrisk.v1.json
@@ -446,7 +446,7 @@
       }
     }
   },
-  "revision": "20210723",
+  "revision": "20210731",
   "rootUrl": "https://webrisk.googleapis.com/",
   "schemas": {
     "GoogleCloudWebriskV1ComputeThreatListDiffResponse": {
diff --git a/googleapiclient/discovery_cache/documents/websecurityscanner.v1.json b/googleapiclient/discovery_cache/documents/websecurityscanner.v1.json
index 49f124a..2e454d7 100644
--- a/googleapiclient/discovery_cache/documents/websecurityscanner.v1.json
+++ b/googleapiclient/discovery_cache/documents/websecurityscanner.v1.json
@@ -526,7 +526,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210723",
   "rootUrl": "https://websecurityscanner.googleapis.com/",
   "schemas": {
     "Authentication": {
diff --git a/googleapiclient/discovery_cache/documents/websecurityscanner.v1alpha.json b/googleapiclient/discovery_cache/documents/websecurityscanner.v1alpha.json
index 14ff655..3bc26ab 100644
--- a/googleapiclient/discovery_cache/documents/websecurityscanner.v1alpha.json
+++ b/googleapiclient/discovery_cache/documents/websecurityscanner.v1alpha.json
@@ -526,7 +526,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210723",
   "rootUrl": "https://websecurityscanner.googleapis.com/",
   "schemas": {
     "Authentication": {
diff --git a/googleapiclient/discovery_cache/documents/websecurityscanner.v1beta.json b/googleapiclient/discovery_cache/documents/websecurityscanner.v1beta.json
index 3eba8ae..fa60f09 100644
--- a/googleapiclient/discovery_cache/documents/websecurityscanner.v1beta.json
+++ b/googleapiclient/discovery_cache/documents/websecurityscanner.v1beta.json
@@ -526,7 +526,7 @@
       }
     }
   },
-  "revision": "20210715",
+  "revision": "20210723",
   "rootUrl": "https://websecurityscanner.googleapis.com/",
   "schemas": {
     "Authentication": {
diff --git a/googleapiclient/discovery_cache/documents/workflowexecutions.v1.json b/googleapiclient/discovery_cache/documents/workflowexecutions.v1.json
index 66078b7..d6b630c 100644
--- a/googleapiclient/discovery_cache/documents/workflowexecutions.v1.json
+++ b/googleapiclient/discovery_cache/documents/workflowexecutions.v1.json
@@ -269,7 +269,7 @@
       }
     }
   },
-  "revision": "20210713",
+  "revision": "20210720",
   "rootUrl": "https://workflowexecutions.googleapis.com/",
   "schemas": {
     "CancelExecutionRequest": {
diff --git a/googleapiclient/discovery_cache/documents/workflowexecutions.v1beta.json b/googleapiclient/discovery_cache/documents/workflowexecutions.v1beta.json
index b1c0f59..9e701b3 100644
--- a/googleapiclient/discovery_cache/documents/workflowexecutions.v1beta.json
+++ b/googleapiclient/discovery_cache/documents/workflowexecutions.v1beta.json
@@ -269,7 +269,7 @@
       }
     }
   },
-  "revision": "20210713",
+  "revision": "20210720",
   "rootUrl": "https://workflowexecutions.googleapis.com/",
   "schemas": {
     "CancelExecutionRequest": {
diff --git a/googleapiclient/discovery_cache/documents/workflows.v1.json b/googleapiclient/discovery_cache/documents/workflows.v1.json
index b7e40b5..c7130e9 100644
--- a/googleapiclient/discovery_cache/documents/workflows.v1.json
+++ b/googleapiclient/discovery_cache/documents/workflows.v1.json
@@ -444,7 +444,7 @@
       }
     }
   },
-  "revision": "20210714",
+  "revision": "20210721",
   "rootUrl": "https://workflows.googleapis.com/",
   "schemas": {
     "Empty": {
diff --git a/googleapiclient/discovery_cache/documents/workflows.v1beta.json b/googleapiclient/discovery_cache/documents/workflows.v1beta.json
index aaf8597..154d9d6 100644
--- a/googleapiclient/discovery_cache/documents/workflows.v1beta.json
+++ b/googleapiclient/discovery_cache/documents/workflows.v1beta.json
@@ -444,7 +444,7 @@
       }
     }
   },
-  "revision": "20210714",
+  "revision": "20210721",
   "rootUrl": "https://workflows.googleapis.com/",
   "schemas": {
     "Empty": {
diff --git a/googleapiclient/discovery_cache/documents/youtube.v3.json b/googleapiclient/discovery_cache/documents/youtube.v3.json
index f4757b1..5f250a7 100644
--- a/googleapiclient/discovery_cache/documents/youtube.v3.json
+++ b/googleapiclient/discovery_cache/documents/youtube.v3.json
@@ -3765,7 +3765,7 @@
       }
     }
   },
-  "revision": "20210724",
+  "revision": "20210731",
   "rootUrl": "https://youtube.googleapis.com/",
   "schemas": {
     "AbuseReport": {
diff --git a/googleapiclient/discovery_cache/documents/youtubeAnalytics.v2.json b/googleapiclient/discovery_cache/documents/youtubeAnalytics.v2.json
index 8ddd2c7..70ee799 100644
--- a/googleapiclient/discovery_cache/documents/youtubeAnalytics.v2.json
+++ b/googleapiclient/discovery_cache/documents/youtubeAnalytics.v2.json
@@ -421,7 +421,7 @@
       }
     }
   },
-  "revision": "20210719",
+  "revision": "20210731",
   "rootUrl": "https://youtubeanalytics.googleapis.com/",
   "schemas": {
     "EmptyResponse": {
diff --git a/googleapiclient/discovery_cache/documents/youtubereporting.v1.json b/googleapiclient/discovery_cache/documents/youtubereporting.v1.json
index e0e3c6e..94b45c4 100644
--- a/googleapiclient/discovery_cache/documents/youtubereporting.v1.json
+++ b/googleapiclient/discovery_cache/documents/youtubereporting.v1.json
@@ -411,7 +411,7 @@
       }
     }
   },
-  "revision": "20210720",
+  "revision": "20210731",
   "rootUrl": "https://youtubereporting.googleapis.com/",
   "schemas": {
     "Empty": {