docs: update generated docs (#981)

diff --git a/docs/dyn/cloudidentity_v1beta1.groups.memberships.html b/docs/dyn/cloudidentity_v1beta1.groups.memberships.html
index 7310699..1750d5b 100644
--- a/docs/dyn/cloudidentity_v1beta1.groups.memberships.html
+++ b/docs/dyn/cloudidentity_v1beta1.groups.memberships.html
@@ -84,13 +84,13 @@
   <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
 <p class="firstline">Retrieves a `Membership`.</p>
 <p class="toc_element">
-  <code><a href="#list">list(parent, pageToken=None, view=None, pageSize=None, x__xgafv=None)</a></code></p>
+  <code><a href="#list">list(parent, view=None, pageToken=None, pageSize=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Lists the `Membership`s within a `Group`.</p>
 <p class="toc_element">
   <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
 <p class="firstline">Retrieves the next page of results.</p>
 <p class="toc_element">
-  <code><a href="#lookup">lookup(parent, memberKey_id=None, memberKey_namespace=None, x__xgafv=None)</a></code></p>
+  <code><a href="#lookup">lookup(parent, memberKey_namespace=None, memberKey_id=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Looks up the [resource</p>
 <p class="toc_element">
   <code><a href="#modifyMembershipRoles">modifyMembershipRoles(name, body=None, x__xgafv=None)</a></code></p>
@@ -111,33 +111,6 @@
     # 
     # A `Membership` defines a relationship between a `Group` and an entity
     # belonging to that `Group`, referred to as a &quot;member&quot;.
-  &quot;memberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Immutable. The `EntityKey` of the member.
-      # 
-      # Either `member_key` or `preferred_member_key` must be set when calling
-      # MembershipsService.CreateMembership but not both; both shall be set
-      # when returned.
-      #
-      # An entity can represent either a group with an optional `namespace` or a user
-      # without a `namespace`. The combination of `id` and `namespace` must be
-      # unique; however, the same `id` can be used with different `namespace`s.
-    &quot;id&quot;: &quot;A String&quot;, # The ID of the entity.
-        #
-        # For Google-managed entities, the `id` must be the email address of an
-        # existing group or user.
-        #
-        # For external-identity-mapped entities, the `id` must be a string conforming
-        # to the Identity Source&#x27;s requirements.
-        #
-        # Must be unique within a `namespace`.
-    &quot;namespace&quot;: &quot;A String&quot;, # The namespace in which the entity exists.
-        #
-        # If not specified, the `EntityKey` represents a Google-managed entity such
-        # as a Google user or a Google Group.
-        #
-        # If specified, the `EntityKey` represents an external-identity-mapped group.
-        # The namespace must correspond to an identity source created in Admin
-        # Console and must be in the form of `identitysources/{identity_source_id}.
-  },
   &quot;preferredMemberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Required. Immutable. The `EntityKey` of the member.
       # 
       # Either `member_key` or `preferred_member_key` must be set when calling
@@ -166,7 +139,38 @@
         # Console and must be in the form of `identitysources/{identity_source_id}.
   },
   &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was created.
-  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was last updated.
+  &quot;name&quot;: &quot;A String&quot;, # Output only. The [resource name](https://cloud.google.com/apis/design/resource_names) of
+      # the `Membership`.
+      # 
+      # Shall be of the form `groups/{group_id}/memberships/{membership_id}`.
+  &quot;type&quot;: &quot;A String&quot;, # Output only. The type of the membership.
+  &quot;memberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Immutable. The `EntityKey` of the member.
+      # 
+      # Either `member_key` or `preferred_member_key` must be set when calling
+      # MembershipsService.CreateMembership but not both; both shall be set
+      # when returned.
+      #
+      # An entity can represent either a group with an optional `namespace` or a user
+      # without a `namespace`. The combination of `id` and `namespace` must be
+      # unique; however, the same `id` can be used with different `namespace`s.
+    &quot;id&quot;: &quot;A String&quot;, # The ID of the entity.
+        #
+        # For Google-managed entities, the `id` must be the email address of an
+        # existing group or user.
+        #
+        # For external-identity-mapped entities, the `id` must be a string conforming
+        # to the Identity Source&#x27;s requirements.
+        #
+        # Must be unique within a `namespace`.
+    &quot;namespace&quot;: &quot;A String&quot;, # The namespace in which the entity exists.
+        #
+        # If not specified, the `EntityKey` represents a Google-managed entity such
+        # as a Google user or a Google Group.
+        #
+        # If specified, the `EntityKey` represents an external-identity-mapped group.
+        # The namespace must correspond to an identity source created in Admin
+        # Console and must be in the form of `identitysources/{identity_source_id}.
+  },
   &quot;roles&quot;: [ # The `MembershipRole`s that apply to the `Membership`.
       # 
       # If unspecified, defaults to a single `MembershipRole` with `name` `MEMBER`.
@@ -175,15 +179,20 @@
     { # A membership role within the Cloud Identity Groups API.
         #
         # A `MembershipRole` defines the privileges granted to a `Membership`.
+      &quot;expiryDetail&quot;: { # The `MembershipRole` expiry details. # The expiry details of the `MembershipRole`.
+          #
+          # Expiry details are only supported for `MEMBER` `MembershipRoles`.
+          #
+          # May be set if `name` is `MEMBER`. Must not be set if `name` is any other
+          # value.
+        &quot;expireTime&quot;: &quot;A String&quot;, # The time at which the `MembershipRole` will expire.
+      },
       &quot;name&quot;: &quot;A String&quot;, # The name of the `MembershipRole`.
           #
           # Must be one of `OWNER`, `MANAGER`, `MEMBER`.
     },
   ],
-  &quot;name&quot;: &quot;A String&quot;, # Output only. The [resource name](https://cloud.google.com/apis/design/resource_names) of
-      # the `Membership`.
-      # 
-      # Shall be of the form `groups/{group_id}/memberships/{membership_id}`.
+  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was last updated.
 }
 
   x__xgafv: string, V1 error format.
@@ -196,6 +205,9 @@
 
     { # This resource represents a long-running operation that is the result of a
       # network API call.
+    &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that
+        # originally returns it. If you use the default HTTP mapping, the
+        # `name` should be a resource name ending with `operations/{unique_id}`.
     &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.
         # different programming environments, including REST APIs and RPC APIs. It is
         # used by [gRPC](https://github.com/grpc). Each `Status` message contains
@@ -203,16 +215,16 @@
         #
         # You can find out more about this error model and how to work with it in the
         # [API Design Guide](https://cloud.google.com/apis/design/errors).
-      &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any
-          # user-facing error message should be localized and sent in the
-          # google.rpc.Status.details field, or localized by the client.
+      &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
       &quot;details&quot;: [ # A list of messages that carry the error details.  There is a common set of
           # message types for APIs to use.
         {
           &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
         },
       ],
-      &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+      &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any
+          # user-facing error message should be localized and sent in the
+          # google.rpc.Status.details field, or localized by the client.
     },
     &quot;metadata&quot;: { # Service-specific metadata associated with the operation.  It typically
         # contains progress information and common metadata such as create time.
@@ -220,9 +232,6 @@
         # long-running operation should document the metadata type, if any.
       &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
     },
-    &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that
-        # originally returns it. If you use the default HTTP mapping, the
-        # `name` should be a resource name ending with `operations/{unique_id}`.
     &quot;response&quot;: { # The normal response of the operation in case of success.  If the original
         # method returns no data on success, such as `Delete`, the response is
         # `google.protobuf.Empty`.  If the original method is standard
@@ -258,6 +267,9 @@
 
     { # This resource represents a long-running operation that is the result of a
       # network API call.
+    &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that
+        # originally returns it. If you use the default HTTP mapping, the
+        # `name` should be a resource name ending with `operations/{unique_id}`.
     &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.
         # different programming environments, including REST APIs and RPC APIs. It is
         # used by [gRPC](https://github.com/grpc). Each `Status` message contains
@@ -265,16 +277,16 @@
         #
         # You can find out more about this error model and how to work with it in the
         # [API Design Guide](https://cloud.google.com/apis/design/errors).
-      &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any
-          # user-facing error message should be localized and sent in the
-          # google.rpc.Status.details field, or localized by the client.
+      &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
       &quot;details&quot;: [ # A list of messages that carry the error details.  There is a common set of
           # message types for APIs to use.
         {
           &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
         },
       ],
-      &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+      &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any
+          # user-facing error message should be localized and sent in the
+          # google.rpc.Status.details field, or localized by the client.
     },
     &quot;metadata&quot;: { # Service-specific metadata associated with the operation.  It typically
         # contains progress information and common metadata such as create time.
@@ -282,9 +294,6 @@
         # long-running operation should document the metadata type, if any.
       &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
     },
-    &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that
-        # originally returns it. If you use the default HTTP mapping, the
-        # `name` should be a resource name ending with `operations/{unique_id}`.
     &quot;response&quot;: { # The normal response of the operation in case of success.  If the original
         # method returns no data on success, such as `Delete`, the response is
         # `google.protobuf.Empty`.  If the original method is standard
@@ -322,33 +331,6 @@
       #
       # A `Membership` defines a relationship between a `Group` and an entity
       # belonging to that `Group`, referred to as a &quot;member&quot;.
-    &quot;memberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Immutable. The `EntityKey` of the member.
-        #
-        # Either `member_key` or `preferred_member_key` must be set when calling
-        # MembershipsService.CreateMembership but not both; both shall be set
-        # when returned.
-        #
-        # An entity can represent either a group with an optional `namespace` or a user
-        # without a `namespace`. The combination of `id` and `namespace` must be
-        # unique; however, the same `id` can be used with different `namespace`s.
-      &quot;id&quot;: &quot;A String&quot;, # The ID of the entity.
-          #
-          # For Google-managed entities, the `id` must be the email address of an
-          # existing group or user.
-          #
-          # For external-identity-mapped entities, the `id` must be a string conforming
-          # to the Identity Source&#x27;s requirements.
-          #
-          # Must be unique within a `namespace`.
-      &quot;namespace&quot;: &quot;A String&quot;, # The namespace in which the entity exists.
-          #
-          # If not specified, the `EntityKey` represents a Google-managed entity such
-          # as a Google user or a Google Group.
-          #
-          # If specified, the `EntityKey` represents an external-identity-mapped group.
-          # The namespace must correspond to an identity source created in Admin
-          # Console and must be in the form of `identitysources/{identity_source_id}.
-    },
     &quot;preferredMemberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Required. Immutable. The `EntityKey` of the member.
         #
         # Either `member_key` or `preferred_member_key` must be set when calling
@@ -377,7 +359,38 @@
           # Console and must be in the form of `identitysources/{identity_source_id}.
     },
     &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was created.
-    &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was last updated.
+    &quot;name&quot;: &quot;A String&quot;, # Output only. The [resource name](https://cloud.google.com/apis/design/resource_names) of
+        # the `Membership`.
+        #
+        # Shall be of the form `groups/{group_id}/memberships/{membership_id}`.
+    &quot;type&quot;: &quot;A String&quot;, # Output only. The type of the membership.
+    &quot;memberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Immutable. The `EntityKey` of the member.
+        #
+        # Either `member_key` or `preferred_member_key` must be set when calling
+        # MembershipsService.CreateMembership but not both; both shall be set
+        # when returned.
+        #
+        # An entity can represent either a group with an optional `namespace` or a user
+        # without a `namespace`. The combination of `id` and `namespace` must be
+        # unique; however, the same `id` can be used with different `namespace`s.
+      &quot;id&quot;: &quot;A String&quot;, # The ID of the entity.
+          #
+          # For Google-managed entities, the `id` must be the email address of an
+          # existing group or user.
+          #
+          # For external-identity-mapped entities, the `id` must be a string conforming
+          # to the Identity Source&#x27;s requirements.
+          #
+          # Must be unique within a `namespace`.
+      &quot;namespace&quot;: &quot;A String&quot;, # The namespace in which the entity exists.
+          #
+          # If not specified, the `EntityKey` represents a Google-managed entity such
+          # as a Google user or a Google Group.
+          #
+          # If specified, the `EntityKey` represents an external-identity-mapped group.
+          # The namespace must correspond to an identity source created in Admin
+          # Console and must be in the form of `identitysources/{identity_source_id}.
+    },
     &quot;roles&quot;: [ # The `MembershipRole`s that apply to the `Membership`.
         #
         # If unspecified, defaults to a single `MembershipRole` with `name` `MEMBER`.
@@ -386,31 +399,36 @@
       { # A membership role within the Cloud Identity Groups API.
           #
           # A `MembershipRole` defines the privileges granted to a `Membership`.
+        &quot;expiryDetail&quot;: { # The `MembershipRole` expiry details. # The expiry details of the `MembershipRole`.
+            #
+            # Expiry details are only supported for `MEMBER` `MembershipRoles`.
+            #
+            # May be set if `name` is `MEMBER`. Must not be set if `name` is any other
+            # value.
+          &quot;expireTime&quot;: &quot;A String&quot;, # The time at which the `MembershipRole` will expire.
+        },
         &quot;name&quot;: &quot;A String&quot;, # The name of the `MembershipRole`.
             #
             # Must be one of `OWNER`, `MANAGER`, `MEMBER`.
       },
     ],
-    &quot;name&quot;: &quot;A String&quot;, # Output only. The [resource name](https://cloud.google.com/apis/design/resource_names) of
-        # the `Membership`.
-        #
-        # Shall be of the form `groups/{group_id}/memberships/{membership_id}`.
+    &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was last updated.
   }</pre>
 </div>
 
 <div class="method">
-    <code class="details" id="list">list(parent, pageToken=None, view=None, pageSize=None, x__xgafv=None)</code>
+    <code class="details" id="list">list(parent, view=None, pageToken=None, pageSize=None, x__xgafv=None)</code>
   <pre>Lists the `Membership`s within a `Group`.
 
 Args:
   parent: string, Required. The parent `Group` resource under which to lookup the `Membership` name.
 
 Must be of the form `groups/{group_id}`. (required)
-  pageToken: string, The `next_page_token` value returned from a previous search request, if
-any.
   view: string, The level of detail to be returned.
 
 If unspecified, defaults to `MembershipView.BASIC`.
+  pageToken: string, The `next_page_token` value returned from a previous search request, if
+any.
   pageSize: integer, The maximum number of results to return.
 
 Note that the number of results returned may be less than this value even
@@ -437,33 +455,6 @@
           #
           # A `Membership` defines a relationship between a `Group` and an entity
           # belonging to that `Group`, referred to as a &quot;member&quot;.
-        &quot;memberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Immutable. The `EntityKey` of the member.
-            #
-            # Either `member_key` or `preferred_member_key` must be set when calling
-            # MembershipsService.CreateMembership but not both; both shall be set
-            # when returned.
-            #
-            # An entity can represent either a group with an optional `namespace` or a user
-            # without a `namespace`. The combination of `id` and `namespace` must be
-            # unique; however, the same `id` can be used with different `namespace`s.
-          &quot;id&quot;: &quot;A String&quot;, # The ID of the entity.
-              #
-              # For Google-managed entities, the `id` must be the email address of an
-              # existing group or user.
-              #
-              # For external-identity-mapped entities, the `id` must be a string conforming
-              # to the Identity Source&#x27;s requirements.
-              #
-              # Must be unique within a `namespace`.
-          &quot;namespace&quot;: &quot;A String&quot;, # The namespace in which the entity exists.
-              #
-              # If not specified, the `EntityKey` represents a Google-managed entity such
-              # as a Google user or a Google Group.
-              #
-              # If specified, the `EntityKey` represents an external-identity-mapped group.
-              # The namespace must correspond to an identity source created in Admin
-              # Console and must be in the form of `identitysources/{identity_source_id}.
-        },
         &quot;preferredMemberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Required. Immutable. The `EntityKey` of the member.
             #
             # Either `member_key` or `preferred_member_key` must be set when calling
@@ -492,7 +483,38 @@
               # Console and must be in the form of `identitysources/{identity_source_id}.
         },
         &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was created.
-        &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was last updated.
+        &quot;name&quot;: &quot;A String&quot;, # Output only. The [resource name](https://cloud.google.com/apis/design/resource_names) of
+            # the `Membership`.
+            #
+            # Shall be of the form `groups/{group_id}/memberships/{membership_id}`.
+        &quot;type&quot;: &quot;A String&quot;, # Output only. The type of the membership.
+        &quot;memberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Immutable. The `EntityKey` of the member.
+            #
+            # Either `member_key` or `preferred_member_key` must be set when calling
+            # MembershipsService.CreateMembership but not both; both shall be set
+            # when returned.
+            #
+            # An entity can represent either a group with an optional `namespace` or a user
+            # without a `namespace`. The combination of `id` and `namespace` must be
+            # unique; however, the same `id` can be used with different `namespace`s.
+          &quot;id&quot;: &quot;A String&quot;, # The ID of the entity.
+              #
+              # For Google-managed entities, the `id` must be the email address of an
+              # existing group or user.
+              #
+              # For external-identity-mapped entities, the `id` must be a string conforming
+              # to the Identity Source&#x27;s requirements.
+              #
+              # Must be unique within a `namespace`.
+          &quot;namespace&quot;: &quot;A String&quot;, # The namespace in which the entity exists.
+              #
+              # If not specified, the `EntityKey` represents a Google-managed entity such
+              # as a Google user or a Google Group.
+              #
+              # If specified, the `EntityKey` represents an external-identity-mapped group.
+              # The namespace must correspond to an identity source created in Admin
+              # Console and must be in the form of `identitysources/{identity_source_id}.
+        },
         &quot;roles&quot;: [ # The `MembershipRole`s that apply to the `Membership`.
             #
             # If unspecified, defaults to a single `MembershipRole` with `name` `MEMBER`.
@@ -501,15 +523,20 @@
           { # A membership role within the Cloud Identity Groups API.
               #
               # A `MembershipRole` defines the privileges granted to a `Membership`.
+            &quot;expiryDetail&quot;: { # The `MembershipRole` expiry details. # The expiry details of the `MembershipRole`.
+                #
+                # Expiry details are only supported for `MEMBER` `MembershipRoles`.
+                #
+                # May be set if `name` is `MEMBER`. Must not be set if `name` is any other
+                # value.
+              &quot;expireTime&quot;: &quot;A String&quot;, # The time at which the `MembershipRole` will expire.
+            },
             &quot;name&quot;: &quot;A String&quot;, # The name of the `MembershipRole`.
                 #
                 # Must be one of `OWNER`, `MANAGER`, `MEMBER`.
           },
         ],
-        &quot;name&quot;: &quot;A String&quot;, # Output only. The [resource name](https://cloud.google.com/apis/design/resource_names) of
-            # the `Membership`.
-            #
-            # Shall be of the form `groups/{group_id}/memberships/{membership_id}`.
+        &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was last updated.
       },
     ],
     &quot;nextPageToken&quot;: &quot;A String&quot;, # A continuation token to retrieve the next page of results, or empty if
@@ -532,7 +559,7 @@
 </div>
 
 <div class="method">
-    <code class="details" id="lookup">lookup(parent, memberKey_id=None, memberKey_namespace=None, x__xgafv=None)</code>
+    <code class="details" id="lookup">lookup(parent, memberKey_namespace=None, memberKey_id=None, x__xgafv=None)</code>
   <pre>Looks up the [resource
 name](https://cloud.google.com/apis/design/resource_names) of a
 `Membership` by its `EntityKey`.
@@ -541,6 +568,14 @@
   parent: string, Required. The parent `Group` resource under which to lookup the `Membership` name.
 
 Must be of the form `groups/{group_id}`. (required)
+  memberKey_namespace: string, The namespace in which the entity exists.
+
+If not specified, the `EntityKey` represents a Google-managed entity such
+as a Google user or a Google Group.
+
+If specified, the `EntityKey` represents an external-identity-mapped group.
+The namespace must correspond to an identity source created in Admin
+Console and must be in the form of `identitysources/{identity_source_id}.
   memberKey_id: string, The ID of the entity.
 
 For Google-managed entities, the `id` must be the email address of an
@@ -550,14 +585,6 @@
 to the Identity Source&#x27;s requirements.
 
 Must be unique within a `namespace`.
-  memberKey_namespace: string, The namespace in which the entity exists.
-
-If not specified, the `EntityKey` represents a Google-managed entity such
-as a Google user or a Google Group.
-
-If specified, the `EntityKey` represents an external-identity-mapped group.
-The namespace must correspond to an identity source created in Admin
-Console and must be in the form of `identitysources/{identity_source_id}.
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
@@ -604,12 +631,42 @@
             # May only contain a `MembershipRole` with `name` `MEMBER`.
             #
             # A `MembershipRole` defines the privileges granted to a `Membership`.
+          &quot;expiryDetail&quot;: { # The `MembershipRole` expiry details. # The expiry details of the `MembershipRole`.
+              #
+              # Expiry details are only supported for `MEMBER` `MembershipRoles`.
+              #
+              # May be set if `name` is `MEMBER`. Must not be set if `name` is any other
+              # value.
+            &quot;expireTime&quot;: &quot;A String&quot;, # The time at which the `MembershipRole` will expire.
+          },
           &quot;name&quot;: &quot;A String&quot;, # The name of the `MembershipRole`.
               #
               # Must be one of `OWNER`, `MANAGER`, `MEMBER`.
         },
       },
     ],
+    &quot;addRoles&quot;: [ # The `MembershipRole`s to be added.
+        # 
+        # Adding or removing roles in the same request as updating roles is not
+        # supported.
+        # 
+        # Must not be set if `update_roles_params` is set.
+      { # A membership role within the Cloud Identity Groups API.
+          #
+          # A `MembershipRole` defines the privileges granted to a `Membership`.
+        &quot;expiryDetail&quot;: { # The `MembershipRole` expiry details. # The expiry details of the `MembershipRole`.
+            #
+            # Expiry details are only supported for `MEMBER` `MembershipRoles`.
+            #
+            # May be set if `name` is `MEMBER`. Must not be set if `name` is any other
+            # value.
+          &quot;expireTime&quot;: &quot;A String&quot;, # The time at which the `MembershipRole` will expire.
+        },
+        &quot;name&quot;: &quot;A String&quot;, # The name of the `MembershipRole`.
+            #
+            # Must be one of `OWNER`, `MANAGER`, `MEMBER`.
+      },
+    ],
     &quot;removeRoles&quot;: [ # The `name`s of the `MembershipRole`s to be removed.
         # 
         # Adding or removing roles in the same request as updating roles is not
@@ -622,20 +679,6 @@
         # Must not contain `MEMBER`. Must not be set if `update_roles_params` is set.
       &quot;A String&quot;,
     ],
-    &quot;addRoles&quot;: [ # The `MembershipRole`s to be added.
-        # 
-        # Adding or removing roles in the same request as updating roles is not
-        # supported.
-        # 
-        # Must not be set if `update_roles_params` is set.
-      { # A membership role within the Cloud Identity Groups API.
-          #
-          # A `MembershipRole` defines the privileges granted to a `Membership`.
-        &quot;name&quot;: &quot;A String&quot;, # The name of the `MembershipRole`.
-            #
-            # Must be one of `OWNER`, `MANAGER`, `MEMBER`.
-      },
-    ],
   }
 
   x__xgafv: string, V1 error format.
@@ -651,33 +694,6 @@
         #
         # A `Membership` defines a relationship between a `Group` and an entity
         # belonging to that `Group`, referred to as a &quot;member&quot;.
-      &quot;memberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Immutable. The `EntityKey` of the member.
-          #
-          # Either `member_key` or `preferred_member_key` must be set when calling
-          # MembershipsService.CreateMembership but not both; both shall be set
-          # when returned.
-          #
-          # An entity can represent either a group with an optional `namespace` or a user
-          # without a `namespace`. The combination of `id` and `namespace` must be
-          # unique; however, the same `id` can be used with different `namespace`s.
-        &quot;id&quot;: &quot;A String&quot;, # The ID of the entity.
-            #
-            # For Google-managed entities, the `id` must be the email address of an
-            # existing group or user.
-            #
-            # For external-identity-mapped entities, the `id` must be a string conforming
-            # to the Identity Source&#x27;s requirements.
-            #
-            # Must be unique within a `namespace`.
-        &quot;namespace&quot;: &quot;A String&quot;, # The namespace in which the entity exists.
-            #
-            # If not specified, the `EntityKey` represents a Google-managed entity such
-            # as a Google user or a Google Group.
-            #
-            # If specified, the `EntityKey` represents an external-identity-mapped group.
-            # The namespace must correspond to an identity source created in Admin
-            # Console and must be in the form of `identitysources/{identity_source_id}.
-      },
       &quot;preferredMemberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Required. Immutable. The `EntityKey` of the member.
           #
           # Either `member_key` or `preferred_member_key` must be set when calling
@@ -706,7 +722,38 @@
             # Console and must be in the form of `identitysources/{identity_source_id}.
       },
       &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was created.
-      &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was last updated.
+      &quot;name&quot;: &quot;A String&quot;, # Output only. The [resource name](https://cloud.google.com/apis/design/resource_names) of
+          # the `Membership`.
+          #
+          # Shall be of the form `groups/{group_id}/memberships/{membership_id}`.
+      &quot;type&quot;: &quot;A String&quot;, # Output only. The type of the membership.
+      &quot;memberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Immutable. The `EntityKey` of the member.
+          #
+          # Either `member_key` or `preferred_member_key` must be set when calling
+          # MembershipsService.CreateMembership but not both; both shall be set
+          # when returned.
+          #
+          # An entity can represent either a group with an optional `namespace` or a user
+          # without a `namespace`. The combination of `id` and `namespace` must be
+          # unique; however, the same `id` can be used with different `namespace`s.
+        &quot;id&quot;: &quot;A String&quot;, # The ID of the entity.
+            #
+            # For Google-managed entities, the `id` must be the email address of an
+            # existing group or user.
+            #
+            # For external-identity-mapped entities, the `id` must be a string conforming
+            # to the Identity Source&#x27;s requirements.
+            #
+            # Must be unique within a `namespace`.
+        &quot;namespace&quot;: &quot;A String&quot;, # The namespace in which the entity exists.
+            #
+            # If not specified, the `EntityKey` represents a Google-managed entity such
+            # as a Google user or a Google Group.
+            #
+            # If specified, the `EntityKey` represents an external-identity-mapped group.
+            # The namespace must correspond to an identity source created in Admin
+            # Console and must be in the form of `identitysources/{identity_source_id}.
+      },
       &quot;roles&quot;: [ # The `MembershipRole`s that apply to the `Membership`.
           #
           # If unspecified, defaults to a single `MembershipRole` with `name` `MEMBER`.
@@ -715,15 +762,20 @@
         { # A membership role within the Cloud Identity Groups API.
             #
             # A `MembershipRole` defines the privileges granted to a `Membership`.
+          &quot;expiryDetail&quot;: { # The `MembershipRole` expiry details. # The expiry details of the `MembershipRole`.
+              #
+              # Expiry details are only supported for `MEMBER` `MembershipRoles`.
+              #
+              # May be set if `name` is `MEMBER`. Must not be set if `name` is any other
+              # value.
+            &quot;expireTime&quot;: &quot;A String&quot;, # The time at which the `MembershipRole` will expire.
+          },
           &quot;name&quot;: &quot;A String&quot;, # The name of the `MembershipRole`.
               #
               # Must be one of `OWNER`, `MANAGER`, `MEMBER`.
         },
       ],
-      &quot;name&quot;: &quot;A String&quot;, # Output only. The [resource name](https://cloud.google.com/apis/design/resource_names) of
-          # the `Membership`.
-          #
-          # Shall be of the form `groups/{group_id}/memberships/{membership_id}`.
+      &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was last updated.
     },
   }</pre>
 </div>