chore: regens API reference docs (#889)

diff --git a/docs/dyn/cloudidentity_v1beta1.groups.html b/docs/dyn/cloudidentity_v1beta1.groups.html
index 48ceccb..a0921de 100644
--- a/docs/dyn/cloudidentity_v1beta1.groups.html
+++ b/docs/dyn/cloudidentity_v1beta1.groups.html
@@ -80,90 +80,119 @@
 <p class="firstline">Returns the memberships Resource.</p>
 
 <p class="toc_element">
-  <code><a href="#create">create(body, x__xgafv=None)</a></code></p>
-<p class="firstline">Creates a Group.</p>
+  <code><a href="#create">create(body=None, initialGroupConfig=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Creates a `Group`.</p>
 <p class="toc_element">
   <code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>
-<p class="firstline">Deletes a Group.</p>
+<p class="firstline">Deletes a `Group`.</p>
 <p class="toc_element">
   <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
-<p class="firstline">Retrieves a Group.</p>
+<p class="firstline">Retrieves a `Group`.</p>
+<p class="toc_element">
+  <code><a href="#list">list(parent=None, pageToken=None, x__xgafv=None, pageSize=None, view=None)</a></code></p>
+<p class="firstline">Lists the `Group`s under a customer or namespace.</p>
+<p class="toc_element">
+  <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
+<p class="firstline">Retrieves the next page of results.</p>
 <p class="toc_element">
   <code><a href="#lookup">lookup(groupKey_id=None, groupKey_namespace=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Looks up [resource</p>
+<p class="firstline">Looks up the [resource</p>
 <p class="toc_element">
-  <code><a href="#patch">patch(name, body, updateMask=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Updates a Group.</p>
+  <code><a href="#patch">patch(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Updates a `Group`.</p>
 <p class="toc_element">
   <code><a href="#search">search(pageSize=None, pageToken=None, query=None, x__xgafv=None, view=None)</a></code></p>
-<p class="firstline">Searches for Groups.</p>
+<p class="firstline">Searches for `Group`s matching a specified query.</p>
 <p class="toc_element">
   <code><a href="#search_next">search_next(previous_request, previous_response)</a></code></p>
 <p class="firstline">Retrieves the next page of results.</p>
 <h3>Method Details</h3>
 <div class="method">
-    <code class="details" id="create">create(body, x__xgafv=None)</code>
-  <pre>Creates a Group.
+    <code class="details" id="create">create(body=None, initialGroupConfig=None, x__xgafv=None)</code>
+  <pre>Creates a `Group`.
 
 Args:
-  body: object, The request body. (required)
+  body: object, The request body.
     The object takes the form of:
 
-{ # Resource representing a Group
-  "updateTime": "A String", # The time when the Group was last updated.
-      # Output only
-  "additionalGroupKeys": [ # Optional. Additional entity key aliases for a Group
-    { # An EntityKey uniquely identifies an Entity. Namespaces are used to provide
-        # isolation for ids.  A single Id can be reused across namespaces but the
-        # combination of a namespace and an id must be unique.
-      "namespace": "A String", # Namespaces provide isolation for ids, i.e an id only needs to be unique
-          # within its namespace.
+{ # A group within the Cloud Identity Groups API.
+    # 
+    # A `Group` is a collection of entities, where each entity is either a user,
+    # another group or a service account.
+  "updateTime": "A String", # Output only. The time when the `Group` was last updated.
+  "additionalGroupKeys": [ # Additional entity key aliases for a Group.
+    { # A unique identifier for an entity in the Cloud Identity Groups API.
+        #
+        # An entity can represent either a group with an optional `namespace` or a user
+        # without a `namespace`. The combination of `id` and `namespace` must be
+        # unique; however, the same `id` can be used with different `namespace`s.
+      "namespace": "A String", # The namespace in which the entity exists.
           #
-          # Namespaces are currently only created as part of IdentitySource creation
-          # from Admin Console. A namespace `"identitysources/{identity_source_id}"` is
-          # created corresponding to every Identity Source `identity_source_id`.
-      "id": "A String", # The id of the entity within the given namespace. The id must be unique
-          # within its namespace.
+          # If not specified, the `EntityKey` represents a Google-managed entity such
+          # as a Google user or a Google Group.
+          #
+          # If specified, the `EntityKey` represents an external-identity-mapped group.
+          # The namespace must correspond to an identity source created in Admin
+          # Console and must be in the form of `identitysources/{identity_source_id}.
+      "id": "A String", # The ID of the entity.
+          #
+          # For Google-managed entities, the `id` must be the email address of an
+          # existing group or user.
+          #
+          # For external-identity-mapped entities, the `id` must be a string conforming
+          # to the Identity Source's requirements.
+          #
+          # Must be unique within a `namespace`.
     },
   ],
-  "displayName": "A String", # The Group's display name.
-  "name": "A String", # [Resource name](https://cloud.google.com/apis/design/resource_names) of the
-      # Group in the format: `groups/{group_id}`, where group_id is the unique id
-      # assigned to the Group.
+  "displayName": "A String", # The display name of the `Group`.
+  "name": "A String", # Output only. The [resource name](https://cloud.google.com/apis/design/resource_names) of
+      # the `Group`.
       # 
-      # Must be left blank while creating a Group
-  "parent": "A String", # The entity under which this Group resides in Cloud Identity resource
-      # hierarchy. Must be set when creating a Group, read-only afterwards.
+      # Shall be of the form `groups/{group_id}`.
+  "parent": "A String", # Required. Immutable. The resource name of the entity under which this `Group` resides in the
+      # Cloud Identity resource hierarchy.
       # 
-      # Currently allowed types: 'identitysources'.
-  "labels": { # Labels for Group resource.
-      # Required.
-      # For creating Groups under a namespace, set label key to
-      # 'labels/system/groups/external' and label value as empty.
+      # Must be of the form `identitysources/{identity_source_id}` for external-
+      # identity-mapped groups or `customers/{customer_id}` for Google Groups.
+  "labels": { # Required. The labels that apply to the `Group`.
+      # 
+      # Must not contain more than one entry. Must contain the entry
+      # `'cloudidentity.googleapis.com/groups.discussion_forum': ''` if the `Group`
+      # is a Google Group or `'system/groups/external': ''` if the `Group` is an
+      # external-identity-mapped group.
     "a_key": "A String",
   },
-  "groupKey": { # An EntityKey uniquely identifies an Entity. Namespaces are used to provide # EntityKey of the Group.
-      # 
-      # Must be set when creating a Group, read-only afterwards.
-      # isolation for ids.  A single Id can be reused across namespaces but the
-      # combination of a namespace and an id must be unique.
-    "namespace": "A String", # Namespaces provide isolation for ids, i.e an id only needs to be unique
-        # within its namespace.
+  "groupKey": { # A unique identifier for an entity in the Cloud Identity Groups API. # Required. Immutable. The `EntityKey` of the `Group`.
+      #
+      # An entity can represent either a group with an optional `namespace` or a user
+      # without a `namespace`. The combination of `id` and `namespace` must be
+      # unique; however, the same `id` can be used with different `namespace`s.
+    "namespace": "A String", # The namespace in which the entity exists.
         #
-        # Namespaces are currently only created as part of IdentitySource creation
-        # from Admin Console. A namespace `"identitysources/{identity_source_id}"` is
-        # created corresponding to every Identity Source `identity_source_id`.
-    "id": "A String", # The id of the entity within the given namespace. The id must be unique
-        # within its namespace.
+        # If not specified, the `EntityKey` represents a Google-managed entity such
+        # as a Google user or a Google Group.
+        #
+        # If specified, the `EntityKey` represents an external-identity-mapped group.
+        # The namespace must correspond to an identity source created in Admin
+        # Console and must be in the form of `identitysources/{identity_source_id}.
+    "id": "A String", # The ID of the entity.
+        #
+        # For Google-managed entities, the `id` must be the email address of an
+        # existing group or user.
+        #
+        # For external-identity-mapped entities, the `id` must be a string conforming
+        # to the Identity Source's requirements.
+        #
+        # Must be unique within a `namespace`.
   },
-  "createTime": "A String", # The time when the Group was created.
-      # Output only
-  "description": "A String", # An extended description to help users determine the purpose of a Group. For
-      # example, you can include information about who should join the Group, the
-      # types of messages to send to the Group, links to FAQs about the Group, or
-      # related Groups. Maximum length is 4,096 characters.
+  "createTime": "A String", # Output only. The time when the `Group` was created.
+  "description": "A String", # An extended description to help users determine the purpose of a `Group`.
+      # 
+      # Must not be longer than 4,096 characters.
 }
 
+  initialGroupConfig: string, Required. The initial configuration option for the `Group`.
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
@@ -174,6 +203,28 @@
 
     { # This resource represents a long-running operation that is the result of a
       # network API call.
+    "response": { # The normal response of the operation in case of success.  If the original
+        # method returns no data on success, such as `Delete`, the response is
+        # `google.protobuf.Empty`.  If the original method is standard
+        # `Get`/`Create`/`Update`, the response should be the resource.  For other
+        # methods, the response should have the type `XxxResponse`, where `Xxx`
+        # is the original method name.  For example, if the original method name
+        # is `TakeSnapshot()`, the inferred response type is
+        # `TakeSnapshotResponse`.
+      "a_key": "", # Properties of the object. Contains field @type with type URL.
+    },
+    "metadata": { # Service-specific metadata associated with the operation.  It typically
+        # contains progress information and common metadata such as create time.
+        # Some services might not provide such metadata.  Any method that returns a
+        # long-running operation should document the metadata type, if any.
+      "a_key": "", # Properties of the object. Contains field @type with type URL.
+    },
+    "done": True or False, # If the value is `false`, it means the operation is still in progress.
+        # If `true`, the operation is completed, and either `error` or `response` is
+        # available.
+    "name": "A String", # The server-assigned name, which is only unique within the same service that
+        # originally returns it. If you use the default HTTP mapping, the
+        # `name` should be a resource name ending with `operations/{unique_id}`.
     "error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.
         # different programming environments, including REST APIs and RPC APIs. It is
         # used by [gRPC](https://github.com/grpc). Each `Status` message contains
@@ -192,39 +243,18 @@
         },
       ],
     },
-    "done": True or False, # If the value is `false`, it means the operation is still in progress.
-        # If `true`, the operation is completed, and either `error` or `response` is
-        # available.
-    "response": { # The normal response of the operation in case of success.  If the original
-        # method returns no data on success, such as `Delete`, the response is
-        # `google.protobuf.Empty`.  If the original method is standard
-        # `Get`/`Create`/`Update`, the response should be the resource.  For other
-        # methods, the response should have the type `XxxResponse`, where `Xxx`
-        # is the original method name.  For example, if the original method name
-        # is `TakeSnapshot()`, the inferred response type is
-        # `TakeSnapshotResponse`.
-      "a_key": "", # Properties of the object. Contains field @type with type URL.
-    },
-    "name": "A String", # The server-assigned name, which is only unique within the same service that
-        # originally returns it. If you use the default HTTP mapping, the
-        # `name` should be a resource name ending with `operations/{unique_id}`.
-    "metadata": { # Service-specific metadata associated with the operation.  It typically
-        # contains progress information and common metadata such as create time.
-        # Some services might not provide such metadata.  Any method that returns a
-        # long-running operation should document the metadata type, if any.
-      "a_key": "", # Properties of the object. Contains field @type with type URL.
-    },
   }</pre>
 </div>
 
 <div class="method">
     <code class="details" id="delete">delete(name, x__xgafv=None)</code>
-  <pre>Deletes a Group.
+  <pre>Deletes a `Group`.
 
 Args:
-  name: string, [Resource name](https://cloud.google.com/apis/design/resource_names) of the
-Group in the format: `groups/{group_id}`, where `group_id` is the unique id
-assigned to the Group. (required)
+  name: string, Required. The [resource name](https://cloud.google.com/apis/design/resource_names) of
+the `Group` to retrieve.
+
+Must be of the form `groups/{group_id}`. (required)
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
@@ -235,6 +265,28 @@
 
     { # This resource represents a long-running operation that is the result of a
       # network API call.
+    "response": { # The normal response of the operation in case of success.  If the original
+        # method returns no data on success, such as `Delete`, the response is
+        # `google.protobuf.Empty`.  If the original method is standard
+        # `Get`/`Create`/`Update`, the response should be the resource.  For other
+        # methods, the response should have the type `XxxResponse`, where `Xxx`
+        # is the original method name.  For example, if the original method name
+        # is `TakeSnapshot()`, the inferred response type is
+        # `TakeSnapshotResponse`.
+      "a_key": "", # Properties of the object. Contains field @type with type URL.
+    },
+    "metadata": { # Service-specific metadata associated with the operation.  It typically
+        # contains progress information and common metadata such as create time.
+        # Some services might not provide such metadata.  Any method that returns a
+        # long-running operation should document the metadata type, if any.
+      "a_key": "", # Properties of the object. Contains field @type with type URL.
+    },
+    "done": True or False, # If the value is `false`, it means the operation is still in progress.
+        # If `true`, the operation is completed, and either `error` or `response` is
+        # available.
+    "name": "A String", # The server-assigned name, which is only unique within the same service that
+        # originally returns it. If you use the default HTTP mapping, the
+        # `name` should be a resource name ending with `operations/{unique_id}`.
     "error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.
         # different programming environments, including REST APIs and RPC APIs. It is
         # used by [gRPC](https://github.com/grpc). Each `Status` message contains
@@ -253,39 +305,18 @@
         },
       ],
     },
-    "done": True or False, # If the value is `false`, it means the operation is still in progress.
-        # If `true`, the operation is completed, and either `error` or `response` is
-        # available.
-    "response": { # The normal response of the operation in case of success.  If the original
-        # method returns no data on success, such as `Delete`, the response is
-        # `google.protobuf.Empty`.  If the original method is standard
-        # `Get`/`Create`/`Update`, the response should be the resource.  For other
-        # methods, the response should have the type `XxxResponse`, where `Xxx`
-        # is the original method name.  For example, if the original method name
-        # is `TakeSnapshot()`, the inferred response type is
-        # `TakeSnapshotResponse`.
-      "a_key": "", # Properties of the object. Contains field @type with type URL.
-    },
-    "name": "A String", # The server-assigned name, which is only unique within the same service that
-        # originally returns it. If you use the default HTTP mapping, the
-        # `name` should be a resource name ending with `operations/{unique_id}`.
-    "metadata": { # Service-specific metadata associated with the operation.  It typically
-        # contains progress information and common metadata such as create time.
-        # Some services might not provide such metadata.  Any method that returns a
-        # long-running operation should document the metadata type, if any.
-      "a_key": "", # Properties of the object. Contains field @type with type URL.
-    },
   }</pre>
 </div>
 
 <div class="method">
     <code class="details" id="get">get(name, x__xgafv=None)</code>
-  <pre>Retrieves a Group.
+  <pre>Retrieves a `Group`.
 
 Args:
-  name: string, [Resource name](https://cloud.google.com/apis/design/resource_names) of the
-Group in the format: `groups/{group_id}`, where `group_id` is the unique id
-assigned to the Group. (required)
+  name: string, Required. The [resource name](https://cloud.google.com/apis/design/resource_names) of
+the `Group` to retrieve.
+
+Must be of the form `groups/{group_id}`. (required)
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
@@ -294,77 +325,237 @@
 Returns:
   An object of the form:
 
-    { # Resource representing a Group
-    "updateTime": "A String", # The time when the Group was last updated.
-        # Output only
-    "additionalGroupKeys": [ # Optional. Additional entity key aliases for a Group
-      { # An EntityKey uniquely identifies an Entity. Namespaces are used to provide
-          # isolation for ids.  A single Id can be reused across namespaces but the
-          # combination of a namespace and an id must be unique.
-        "namespace": "A String", # Namespaces provide isolation for ids, i.e an id only needs to be unique
-            # within its namespace.
+    { # A group within the Cloud Identity Groups API.
+      #
+      # A `Group` is a collection of entities, where each entity is either a user,
+      # another group or a service account.
+    "updateTime": "A String", # Output only. The time when the `Group` was last updated.
+    "additionalGroupKeys": [ # Additional entity key aliases for a Group.
+      { # A unique identifier for an entity in the Cloud Identity Groups API.
+          #
+          # An entity can represent either a group with an optional `namespace` or a user
+          # without a `namespace`. The combination of `id` and `namespace` must be
+          # unique; however, the same `id` can be used with different `namespace`s.
+        "namespace": "A String", # The namespace in which the entity exists.
             #
-            # Namespaces are currently only created as part of IdentitySource creation
-            # from Admin Console. A namespace `"identitysources/{identity_source_id}"` is
-            # created corresponding to every Identity Source `identity_source_id`.
-        "id": "A String", # The id of the entity within the given namespace. The id must be unique
-            # within its namespace.
+            # If not specified, the `EntityKey` represents a Google-managed entity such
+            # as a Google user or a Google Group.
+            #
+            # If specified, the `EntityKey` represents an external-identity-mapped group.
+            # The namespace must correspond to an identity source created in Admin
+            # Console and must be in the form of `identitysources/{identity_source_id}.
+        "id": "A String", # The ID of the entity.
+            #
+            # For Google-managed entities, the `id` must be the email address of an
+            # existing group or user.
+            #
+            # For external-identity-mapped entities, the `id` must be a string conforming
+            # to the Identity Source's requirements.
+            #
+            # Must be unique within a `namespace`.
       },
     ],
-    "displayName": "A String", # The Group's display name.
-    "name": "A String", # [Resource name](https://cloud.google.com/apis/design/resource_names) of the
-        # Group in the format: `groups/{group_id}`, where group_id is the unique id
-        # assigned to the Group.
+    "displayName": "A String", # The display name of the `Group`.
+    "name": "A String", # Output only. The [resource name](https://cloud.google.com/apis/design/resource_names) of
+        # the `Group`.
         #
-        # Must be left blank while creating a Group
-    "parent": "A String", # The entity under which this Group resides in Cloud Identity resource
-        # hierarchy. Must be set when creating a Group, read-only afterwards.
+        # Shall be of the form `groups/{group_id}`.
+    "parent": "A String", # Required. Immutable. The resource name of the entity under which this `Group` resides in the
+        # Cloud Identity resource hierarchy.
         #
-        # Currently allowed types: 'identitysources'.
-    "labels": { # Labels for Group resource.
-        # Required.
-        # For creating Groups under a namespace, set label key to
-        # 'labels/system/groups/external' and label value as empty.
+        # Must be of the form `identitysources/{identity_source_id}` for external-
+        # identity-mapped groups or `customers/{customer_id}` for Google Groups.
+    "labels": { # Required. The labels that apply to the `Group`.
+        #
+        # Must not contain more than one entry. Must contain the entry
+        # `'cloudidentity.googleapis.com/groups.discussion_forum': ''` if the `Group`
+        # is a Google Group or `'system/groups/external': ''` if the `Group` is an
+        # external-identity-mapped group.
       "a_key": "A String",
     },
-    "groupKey": { # An EntityKey uniquely identifies an Entity. Namespaces are used to provide # EntityKey of the Group.
+    "groupKey": { # A unique identifier for an entity in the Cloud Identity Groups API. # Required. Immutable. The `EntityKey` of the `Group`.
         #
-        # Must be set when creating a Group, read-only afterwards.
-        # isolation for ids.  A single Id can be reused across namespaces but the
-        # combination of a namespace and an id must be unique.
-      "namespace": "A String", # Namespaces provide isolation for ids, i.e an id only needs to be unique
-          # within its namespace.
+        # An entity can represent either a group with an optional `namespace` or a user
+        # without a `namespace`. The combination of `id` and `namespace` must be
+        # unique; however, the same `id` can be used with different `namespace`s.
+      "namespace": "A String", # The namespace in which the entity exists.
           #
-          # Namespaces are currently only created as part of IdentitySource creation
-          # from Admin Console. A namespace `"identitysources/{identity_source_id}"` is
-          # created corresponding to every Identity Source `identity_source_id`.
-      "id": "A String", # The id of the entity within the given namespace. The id must be unique
-          # within its namespace.
+          # If not specified, the `EntityKey` represents a Google-managed entity such
+          # as a Google user or a Google Group.
+          #
+          # If specified, the `EntityKey` represents an external-identity-mapped group.
+          # The namespace must correspond to an identity source created in Admin
+          # Console and must be in the form of `identitysources/{identity_source_id}.
+      "id": "A String", # The ID of the entity.
+          #
+          # For Google-managed entities, the `id` must be the email address of an
+          # existing group or user.
+          #
+          # For external-identity-mapped entities, the `id` must be a string conforming
+          # to the Identity Source's requirements.
+          #
+          # Must be unique within a `namespace`.
     },
-    "createTime": "A String", # The time when the Group was created.
-        # Output only
-    "description": "A String", # An extended description to help users determine the purpose of a Group. For
-        # example, you can include information about who should join the Group, the
-        # types of messages to send to the Group, links to FAQs about the Group, or
-        # related Groups. Maximum length is 4,096 characters.
+    "createTime": "A String", # Output only. The time when the `Group` was created.
+    "description": "A String", # An extended description to help users determine the purpose of a `Group`.
+        #
+        # Must not be longer than 4,096 characters.
   }</pre>
 </div>
 
 <div class="method">
+    <code class="details" id="list">list(parent=None, pageToken=None, x__xgafv=None, pageSize=None, view=None)</code>
+  <pre>Lists the `Group`s under a customer or namespace.
+
+Args:
+  parent: string, Required. The parent resource under which to list all `Group`s.
+
+Must be of the form `identitysources/{identity_source_id}` for external-
+identity-mapped groups or `customers/{customer_id}` for Google Groups.
+  pageToken: string, The `next_page_token` value returned from a previous list request, if any.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+  pageSize: integer, The maximum number of results to return.
+
+Note that the number of results returned may be less than this value even
+if there are more available results. To fetch all results, clients must
+continue calling this method repeatedly until the response no longer
+contains a `next_page_token`.
+
+If unspecified, defaults to 200 for `View.BASIC` and to 50 for `View.FULL`.
+
+Must not be greater than 1000 for `View.BASIC` or 500 for `View.FULL`.
+  view: string, The level of detail to be returned.
+
+If unspecified, defaults to `View.BASIC`.
+
+Returns:
+  An object of the form:
+
+    { # The response message for GroupsService.ListGroups.
+    "nextPageToken": "A String", # A continuation token to retrieve the next page of results, or empty if
+        # there are no more results available.
+    "groups": [ # The `Group`s under the specified `parent`.
+      { # A group within the Cloud Identity Groups API.
+          #
+          # A `Group` is a collection of entities, where each entity is either a user,
+          # another group or a service account.
+        "updateTime": "A String", # Output only. The time when the `Group` was last updated.
+        "additionalGroupKeys": [ # Additional entity key aliases for a Group.
+          { # A unique identifier for an entity in the Cloud Identity Groups API.
+              #
+              # An entity can represent either a group with an optional `namespace` or a user
+              # without a `namespace`. The combination of `id` and `namespace` must be
+              # unique; however, the same `id` can be used with different `namespace`s.
+            "namespace": "A String", # The namespace in which the entity exists.
+                #
+                # If not specified, the `EntityKey` represents a Google-managed entity such
+                # as a Google user or a Google Group.
+                #
+                # If specified, the `EntityKey` represents an external-identity-mapped group.
+                # The namespace must correspond to an identity source created in Admin
+                # Console and must be in the form of `identitysources/{identity_source_id}.
+            "id": "A String", # The ID of the entity.
+                #
+                # For Google-managed entities, the `id` must be the email address of an
+                # existing group or user.
+                #
+                # For external-identity-mapped entities, the `id` must be a string conforming
+                # to the Identity Source's requirements.
+                #
+                # Must be unique within a `namespace`.
+          },
+        ],
+        "displayName": "A String", # The display name of the `Group`.
+        "name": "A String", # Output only. The [resource name](https://cloud.google.com/apis/design/resource_names) of
+            # the `Group`.
+            #
+            # Shall be of the form `groups/{group_id}`.
+        "parent": "A String", # Required. Immutable. The resource name of the entity under which this `Group` resides in the
+            # Cloud Identity resource hierarchy.
+            #
+            # Must be of the form `identitysources/{identity_source_id}` for external-
+            # identity-mapped groups or `customers/{customer_id}` for Google Groups.
+        "labels": { # Required. The labels that apply to the `Group`.
+            #
+            # Must not contain more than one entry. Must contain the entry
+            # `'cloudidentity.googleapis.com/groups.discussion_forum': ''` if the `Group`
+            # is a Google Group or `'system/groups/external': ''` if the `Group` is an
+            # external-identity-mapped group.
+          "a_key": "A String",
+        },
+        "groupKey": { # A unique identifier for an entity in the Cloud Identity Groups API. # Required. Immutable. The `EntityKey` of the `Group`.
+            #
+            # An entity can represent either a group with an optional `namespace` or a user
+            # without a `namespace`. The combination of `id` and `namespace` must be
+            # unique; however, the same `id` can be used with different `namespace`s.
+          "namespace": "A String", # The namespace in which the entity exists.
+              #
+              # If not specified, the `EntityKey` represents a Google-managed entity such
+              # as a Google user or a Google Group.
+              #
+              # If specified, the `EntityKey` represents an external-identity-mapped group.
+              # The namespace must correspond to an identity source created in Admin
+              # Console and must be in the form of `identitysources/{identity_source_id}.
+          "id": "A String", # The ID of the entity.
+              #
+              # For Google-managed entities, the `id` must be the email address of an
+              # existing group or user.
+              #
+              # For external-identity-mapped entities, the `id` must be a string conforming
+              # to the Identity Source's requirements.
+              #
+              # Must be unique within a `namespace`.
+        },
+        "createTime": "A String", # Output only. The time when the `Group` was created.
+        "description": "A String", # An extended description to help users determine the purpose of a `Group`.
+            #
+            # Must not be longer than 4,096 characters.
+      },
+    ],
+  }</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
+  <pre>Retrieves the next page of results.
+
+Args:
+  previous_request: The request for the previous page. (required)
+  previous_response: The response from the request for the previous page. (required)
+
+Returns:
+  A request object that you can call 'execute()' on to request the next
+  page. Returns None if there are no more items in the collection.
+    </pre>
+</div>
+
+<div class="method">
     <code class="details" id="lookup">lookup(groupKey_id=None, groupKey_namespace=None, x__xgafv=None)</code>
-  <pre>Looks up [resource
-name](https://cloud.google.com/apis/design/resource_names) of a Group by
-its EntityKey.
+  <pre>Looks up the [resource
+name](https://cloud.google.com/apis/design/resource_names) of a `Group` by
+its `EntityKey`.
 
 Args:
-  groupKey_id: string, The id of the entity within the given namespace. The id must be unique
-within its namespace.
-  groupKey_namespace: string, Namespaces provide isolation for ids, i.e an id only needs to be unique
-within its namespace.
+  groupKey_id: string, The ID of the entity.
 
-Namespaces are currently only created as part of IdentitySource creation
-from Admin Console. A namespace `"identitysources/{identity_source_id}"` is
-created corresponding to every Identity Source `identity_source_id`.
+For Google-managed entities, the `id` must be the email address of an
+existing group or user.
+
+For external-identity-mapped entities, the `id` must be a string conforming
+to the Identity Source's requirements.
+
+Must be unique within a `namespace`.
+  groupKey_namespace: string, The namespace in which the entity exists.
+
+If not specified, the `EntityKey` represents a Google-managed entity such
+as a Google user or a Google Group.
+
+If specified, the `EntityKey` represents an external-identity-mapped group.
+The namespace must correspond to an identity source created in Admin
+Console and must be in the form of `identitysources/{identity_source_id}.
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
@@ -373,82 +564,104 @@
 Returns:
   An object of the form:
 
-    {
-    "name": "A String", # [Resource name](https://cloud.google.com/apis/design/resource_names) of the
-        # Group in the format: `groups/{group_id}`, where `group_id` is the unique id
-        # assigned to the Group.
+    { # The response message for GroupsService.LookupGroupName.
+    "name": "A String", # Output only. The [resource name](https://cloud.google.com/apis/design/resource_names) of
+        # the looked-up `Group`.
   }</pre>
 </div>
 
 <div class="method">
-    <code class="details" id="patch">patch(name, body, updateMask=None, x__xgafv=None)</code>
-  <pre>Updates a Group.
+    <code class="details" id="patch">patch(name, body=None, updateMask=None, x__xgafv=None)</code>
+  <pre>Updates a `Group`.
 
 Args:
-  name: string, [Resource name](https://cloud.google.com/apis/design/resource_names) of the
-Group in the format: `groups/{group_id}`, where group_id is the unique id
-assigned to the Group.
+  name: string, Output only. The [resource name](https://cloud.google.com/apis/design/resource_names) of
+the `Group`.
 
-Must be left blank while creating a Group (required)
-  body: object, The request body. (required)
+Shall be of the form `groups/{group_id}`. (required)
+  body: object, The request body.
     The object takes the form of:
 
-{ # Resource representing a Group
-  "updateTime": "A String", # The time when the Group was last updated.
-      # Output only
-  "additionalGroupKeys": [ # Optional. Additional entity key aliases for a Group
-    { # An EntityKey uniquely identifies an Entity. Namespaces are used to provide
-        # isolation for ids.  A single Id can be reused across namespaces but the
-        # combination of a namespace and an id must be unique.
-      "namespace": "A String", # Namespaces provide isolation for ids, i.e an id only needs to be unique
-          # within its namespace.
+{ # A group within the Cloud Identity Groups API.
+    # 
+    # A `Group` is a collection of entities, where each entity is either a user,
+    # another group or a service account.
+  "updateTime": "A String", # Output only. The time when the `Group` was last updated.
+  "additionalGroupKeys": [ # Additional entity key aliases for a Group.
+    { # A unique identifier for an entity in the Cloud Identity Groups API.
+        #
+        # An entity can represent either a group with an optional `namespace` or a user
+        # without a `namespace`. The combination of `id` and `namespace` must be
+        # unique; however, the same `id` can be used with different `namespace`s.
+      "namespace": "A String", # The namespace in which the entity exists.
           #
-          # Namespaces are currently only created as part of IdentitySource creation
-          # from Admin Console. A namespace `"identitysources/{identity_source_id}"` is
-          # created corresponding to every Identity Source `identity_source_id`.
-      "id": "A String", # The id of the entity within the given namespace. The id must be unique
-          # within its namespace.
+          # If not specified, the `EntityKey` represents a Google-managed entity such
+          # as a Google user or a Google Group.
+          #
+          # If specified, the `EntityKey` represents an external-identity-mapped group.
+          # The namespace must correspond to an identity source created in Admin
+          # Console and must be in the form of `identitysources/{identity_source_id}.
+      "id": "A String", # The ID of the entity.
+          #
+          # For Google-managed entities, the `id` must be the email address of an
+          # existing group or user.
+          #
+          # For external-identity-mapped entities, the `id` must be a string conforming
+          # to the Identity Source's requirements.
+          #
+          # Must be unique within a `namespace`.
     },
   ],
-  "displayName": "A String", # The Group's display name.
-  "name": "A String", # [Resource name](https://cloud.google.com/apis/design/resource_names) of the
-      # Group in the format: `groups/{group_id}`, where group_id is the unique id
-      # assigned to the Group.
+  "displayName": "A String", # The display name of the `Group`.
+  "name": "A String", # Output only. The [resource name](https://cloud.google.com/apis/design/resource_names) of
+      # the `Group`.
       # 
-      # Must be left blank while creating a Group
-  "parent": "A String", # The entity under which this Group resides in Cloud Identity resource
-      # hierarchy. Must be set when creating a Group, read-only afterwards.
+      # Shall be of the form `groups/{group_id}`.
+  "parent": "A String", # Required. Immutable. The resource name of the entity under which this `Group` resides in the
+      # Cloud Identity resource hierarchy.
       # 
-      # Currently allowed types: 'identitysources'.
-  "labels": { # Labels for Group resource.
-      # Required.
-      # For creating Groups under a namespace, set label key to
-      # 'labels/system/groups/external' and label value as empty.
+      # Must be of the form `identitysources/{identity_source_id}` for external-
+      # identity-mapped groups or `customers/{customer_id}` for Google Groups.
+  "labels": { # Required. The labels that apply to the `Group`.
+      # 
+      # Must not contain more than one entry. Must contain the entry
+      # `'cloudidentity.googleapis.com/groups.discussion_forum': ''` if the `Group`
+      # is a Google Group or `'system/groups/external': ''` if the `Group` is an
+      # external-identity-mapped group.
     "a_key": "A String",
   },
-  "groupKey": { # An EntityKey uniquely identifies an Entity. Namespaces are used to provide # EntityKey of the Group.
-      # 
-      # Must be set when creating a Group, read-only afterwards.
-      # isolation for ids.  A single Id can be reused across namespaces but the
-      # combination of a namespace and an id must be unique.
-    "namespace": "A String", # Namespaces provide isolation for ids, i.e an id only needs to be unique
-        # within its namespace.
+  "groupKey": { # A unique identifier for an entity in the Cloud Identity Groups API. # Required. Immutable. The `EntityKey` of the `Group`.
+      #
+      # An entity can represent either a group with an optional `namespace` or a user
+      # without a `namespace`. The combination of `id` and `namespace` must be
+      # unique; however, the same `id` can be used with different `namespace`s.
+    "namespace": "A String", # The namespace in which the entity exists.
         #
-        # Namespaces are currently only created as part of IdentitySource creation
-        # from Admin Console. A namespace `"identitysources/{identity_source_id}"` is
-        # created corresponding to every Identity Source `identity_source_id`.
-    "id": "A String", # The id of the entity within the given namespace. The id must be unique
-        # within its namespace.
+        # If not specified, the `EntityKey` represents a Google-managed entity such
+        # as a Google user or a Google Group.
+        #
+        # If specified, the `EntityKey` represents an external-identity-mapped group.
+        # The namespace must correspond to an identity source created in Admin
+        # Console and must be in the form of `identitysources/{identity_source_id}.
+    "id": "A String", # The ID of the entity.
+        #
+        # For Google-managed entities, the `id` must be the email address of an
+        # existing group or user.
+        #
+        # For external-identity-mapped entities, the `id` must be a string conforming
+        # to the Identity Source's requirements.
+        #
+        # Must be unique within a `namespace`.
   },
-  "createTime": "A String", # The time when the Group was created.
-      # Output only
-  "description": "A String", # An extended description to help users determine the purpose of a Group. For
-      # example, you can include information about who should join the Group, the
-      # types of messages to send to the Group, links to FAQs about the Group, or
-      # related Groups. Maximum length is 4,096 characters.
+  "createTime": "A String", # Output only. The time when the `Group` was created.
+  "description": "A String", # An extended description to help users determine the purpose of a `Group`.
+      # 
+      # Must not be longer than 4,096 characters.
 }
 
-  updateMask: string, Editable fields: `display_name`, `description`
+  updateMask: string, Required. The fully-qualified names of fields to update.
+
+May only contain the following fields: `display_name`, `description`.
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
@@ -459,6 +672,28 @@
 
     { # This resource represents a long-running operation that is the result of a
       # network API call.
+    "response": { # The normal response of the operation in case of success.  If the original
+        # method returns no data on success, such as `Delete`, the response is
+        # `google.protobuf.Empty`.  If the original method is standard
+        # `Get`/`Create`/`Update`, the response should be the resource.  For other
+        # methods, the response should have the type `XxxResponse`, where `Xxx`
+        # is the original method name.  For example, if the original method name
+        # is `TakeSnapshot()`, the inferred response type is
+        # `TakeSnapshotResponse`.
+      "a_key": "", # Properties of the object. Contains field @type with type URL.
+    },
+    "metadata": { # Service-specific metadata associated with the operation.  It typically
+        # contains progress information and common metadata such as create time.
+        # Some services might not provide such metadata.  Any method that returns a
+        # long-running operation should document the metadata type, if any.
+      "a_key": "", # Properties of the object. Contains field @type with type URL.
+    },
+    "done": True or False, # If the value is `false`, it means the operation is still in progress.
+        # If `true`, the operation is completed, and either `error` or `response` is
+        # available.
+    "name": "A String", # The server-assigned name, which is only unique within the same service that
+        # originally returns it. If you use the default HTTP mapping, the
+        # `name` should be a resource name ending with `operations/{unique_id}`.
     "error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.
         # different programming environments, including REST APIs and RPC APIs. It is
         # used by [gRPC](https://github.com/grpc). Each `Status` message contains
@@ -477,113 +712,125 @@
         },
       ],
     },
-    "done": True or False, # If the value is `false`, it means the operation is still in progress.
-        # If `true`, the operation is completed, and either `error` or `response` is
-        # available.
-    "response": { # The normal response of the operation in case of success.  If the original
-        # method returns no data on success, such as `Delete`, the response is
-        # `google.protobuf.Empty`.  If the original method is standard
-        # `Get`/`Create`/`Update`, the response should be the resource.  For other
-        # methods, the response should have the type `XxxResponse`, where `Xxx`
-        # is the original method name.  For example, if the original method name
-        # is `TakeSnapshot()`, the inferred response type is
-        # `TakeSnapshotResponse`.
-      "a_key": "", # Properties of the object. Contains field @type with type URL.
-    },
-    "name": "A String", # The server-assigned name, which is only unique within the same service that
-        # originally returns it. If you use the default HTTP mapping, the
-        # `name` should be a resource name ending with `operations/{unique_id}`.
-    "metadata": { # Service-specific metadata associated with the operation.  It typically
-        # contains progress information and common metadata such as create time.
-        # Some services might not provide such metadata.  Any method that returns a
-        # long-running operation should document the metadata type, if any.
-      "a_key": "", # Properties of the object. Contains field @type with type URL.
-    },
   }</pre>
 </div>
 
 <div class="method">
     <code class="details" id="search">search(pageSize=None, pageToken=None, query=None, x__xgafv=None, view=None)</code>
-  <pre>Searches for Groups.
+  <pre>Searches for `Group`s matching a specified query.
 
 Args:
-  pageSize: integer, The default page size is 200 (max 1000) for the BASIC view, and 50
-(max 500) for the FULL view.
-  pageToken: string, The next_page_token value returned from a previous search request, if any.
-  query: string, Query string for performing search on groups.
-Users can search on namespace and label attributes of groups.
-EXACT match ('=') is supported on namespace, and CONTAINS match (':') is
-supported on labels. This is a `required` field.
-Multiple queries can be combined using `AND` operator. The operator is case
-sensitive.
-An example query would be:
-"namespace=<namespace_value> AND labels:<labels_value>".
+  pageSize: integer, The maximum number of results to return.
+
+Note that the number of results returned may be less than this value even
+if there are more available results. To fetch all results, clients must
+continue calling this method repeatedly until the response no longer
+contains a `next_page_token`.
+
+If unspecified, defaults to 200 for `GroupView.BASIC` and to 50 for
+`GroupView.FULL`.
+
+Must not be greater than 1000 for `GroupView.BASIC` or 500 for
+`GroupView.FULL`.
+  pageToken: string, The `next_page_token` value returned from a previous search request, if
+any.
+  query: string, Required. The search query.
+
+Must be specified in [Common Expression
+Language](https://opensource.google/projects/cel). May only contain
+equality operators on the parent and inclusion operators on labels (e.g.,
+`parent == 'customers/{customer_id}' &amp;&amp;
+'cloudidentity.googleapis.com/groups.discussion_forum' in labels`).
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
       2 - v2 error format
-  view: string, Group resource view to be returned. Defaults to [GroupView.BASIC]().
+  view: string, The level of detail to be returned.
+
+If unspecified, defaults to `View.BASIC`.
 
 Returns:
   An object of the form:
 
-    {
-    "nextPageToken": "A String", # Token to retrieve the next page of results, or empty if there are no
-        # more results available for specified query.
-    "groups": [ # List of Groups satisfying the search query.
-      { # Resource representing a Group
-        "updateTime": "A String", # The time when the Group was last updated.
-            # Output only
-        "additionalGroupKeys": [ # Optional. Additional entity key aliases for a Group
-          { # An EntityKey uniquely identifies an Entity. Namespaces are used to provide
-              # isolation for ids.  A single Id can be reused across namespaces but the
-              # combination of a namespace and an id must be unique.
-            "namespace": "A String", # Namespaces provide isolation for ids, i.e an id only needs to be unique
-                # within its namespace.
+    { # The response message for GroupsService.SearchGroups.
+    "nextPageToken": "A String", # A continuation token to retrieve the next page of results, or empty if
+        # there are no more results available.
+    "groups": [ # The `Group`s that match the search query.
+      { # A group within the Cloud Identity Groups API.
+          #
+          # A `Group` is a collection of entities, where each entity is either a user,
+          # another group or a service account.
+        "updateTime": "A String", # Output only. The time when the `Group` was last updated.
+        "additionalGroupKeys": [ # Additional entity key aliases for a Group.
+          { # A unique identifier for an entity in the Cloud Identity Groups API.
+              #
+              # An entity can represent either a group with an optional `namespace` or a user
+              # without a `namespace`. The combination of `id` and `namespace` must be
+              # unique; however, the same `id` can be used with different `namespace`s.
+            "namespace": "A String", # The namespace in which the entity exists.
                 #
-                # Namespaces are currently only created as part of IdentitySource creation
-                # from Admin Console. A namespace `"identitysources/{identity_source_id}"` is
-                # created corresponding to every Identity Source `identity_source_id`.
-            "id": "A String", # The id of the entity within the given namespace. The id must be unique
-                # within its namespace.
+                # If not specified, the `EntityKey` represents a Google-managed entity such
+                # as a Google user or a Google Group.
+                #
+                # If specified, the `EntityKey` represents an external-identity-mapped group.
+                # The namespace must correspond to an identity source created in Admin
+                # Console and must be in the form of `identitysources/{identity_source_id}.
+            "id": "A String", # The ID of the entity.
+                #
+                # For Google-managed entities, the `id` must be the email address of an
+                # existing group or user.
+                #
+                # For external-identity-mapped entities, the `id` must be a string conforming
+                # to the Identity Source's requirements.
+                #
+                # Must be unique within a `namespace`.
           },
         ],
-        "displayName": "A String", # The Group's display name.
-        "name": "A String", # [Resource name](https://cloud.google.com/apis/design/resource_names) of the
-            # Group in the format: `groups/{group_id}`, where group_id is the unique id
-            # assigned to the Group.
+        "displayName": "A String", # The display name of the `Group`.
+        "name": "A String", # Output only. The [resource name](https://cloud.google.com/apis/design/resource_names) of
+            # the `Group`.
             #
-            # Must be left blank while creating a Group
-        "parent": "A String", # The entity under which this Group resides in Cloud Identity resource
-            # hierarchy. Must be set when creating a Group, read-only afterwards.
+            # Shall be of the form `groups/{group_id}`.
+        "parent": "A String", # Required. Immutable. The resource name of the entity under which this `Group` resides in the
+            # Cloud Identity resource hierarchy.
             #
-            # Currently allowed types: 'identitysources'.
-        "labels": { # Labels for Group resource.
-            # Required.
-            # For creating Groups under a namespace, set label key to
-            # 'labels/system/groups/external' and label value as empty.
+            # Must be of the form `identitysources/{identity_source_id}` for external-
+            # identity-mapped groups or `customers/{customer_id}` for Google Groups.
+        "labels": { # Required. The labels that apply to the `Group`.
+            #
+            # Must not contain more than one entry. Must contain the entry
+            # `'cloudidentity.googleapis.com/groups.discussion_forum': ''` if the `Group`
+            # is a Google Group or `'system/groups/external': ''` if the `Group` is an
+            # external-identity-mapped group.
           "a_key": "A String",
         },
-        "groupKey": { # An EntityKey uniquely identifies an Entity. Namespaces are used to provide # EntityKey of the Group.
+        "groupKey": { # A unique identifier for an entity in the Cloud Identity Groups API. # Required. Immutable. The `EntityKey` of the `Group`.
             #
-            # Must be set when creating a Group, read-only afterwards.
-            # isolation for ids.  A single Id can be reused across namespaces but the
-            # combination of a namespace and an id must be unique.
-          "namespace": "A String", # Namespaces provide isolation for ids, i.e an id only needs to be unique
-              # within its namespace.
+            # An entity can represent either a group with an optional `namespace` or a user
+            # without a `namespace`. The combination of `id` and `namespace` must be
+            # unique; however, the same `id` can be used with different `namespace`s.
+          "namespace": "A String", # The namespace in which the entity exists.
               #
-              # Namespaces are currently only created as part of IdentitySource creation
-              # from Admin Console. A namespace `"identitysources/{identity_source_id}"` is
-              # created corresponding to every Identity Source `identity_source_id`.
-          "id": "A String", # The id of the entity within the given namespace. The id must be unique
-              # within its namespace.
+              # If not specified, the `EntityKey` represents a Google-managed entity such
+              # as a Google user or a Google Group.
+              #
+              # If specified, the `EntityKey` represents an external-identity-mapped group.
+              # The namespace must correspond to an identity source created in Admin
+              # Console and must be in the form of `identitysources/{identity_source_id}.
+          "id": "A String", # The ID of the entity.
+              #
+              # For Google-managed entities, the `id` must be the email address of an
+              # existing group or user.
+              #
+              # For external-identity-mapped entities, the `id` must be a string conforming
+              # to the Identity Source's requirements.
+              #
+              # Must be unique within a `namespace`.
         },
-        "createTime": "A String", # The time when the Group was created.
-            # Output only
-        "description": "A String", # An extended description to help users determine the purpose of a Group. For
-            # example, you can include information about who should join the Group, the
-            # types of messages to send to the Group, links to FAQs about the Group, or
-            # related Groups. Maximum length is 4,096 characters.
+        "createTime": "A String", # Output only. The time when the `Group` was created.
+        "description": "A String", # An extended description to help users determine the purpose of a `Group`.
+            #
+            # Must not be longer than 4,096 characters.
       },
     ],
   }</pre>