Gitiles
Code Review Sign In
gerrit-public.fairphone.software / platform / external / python / google-api-python-client / a527de24cda7c7d62a371203158fd5f617a1c08c / . / docs / dyn / iamcredentials_v1.projects.serviceAccounts.html
blob: c192221c281f5d245e0494a174a99cdc7eb7b086 [file] [log] [blame]
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1<html><body>
2<style>
3
4body, h1, h2, h3, div, span, p, pre, a {
5 margin: 0;
6 padding: 0;
7 border: 0;
8 font-weight: inherit;
9 font-style: inherit;
10 font-size: 100%;
11 font-family: inherit;
12 vertical-align: baseline;
13}
14
15body {
16 font-size: 13px;
17 padding: 1em;
18}
19
20h1 {
21 font-size: 26px;
22 margin-bottom: 1em;
23}
24
25h2 {
26 font-size: 24px;
27 margin-bottom: 1em;
28}
29
30h3 {
31 font-size: 20px;
32 margin-bottom: 1em;
33 margin-top: 1em;
34}
35
36pre, code {
37 line-height: 1.5;
38 font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
39}
40
41pre {
42 margin-top: 0.5em;
43}
44
45h1, h2, h3, p {
46 font-family: Arial, sans serif;
47}
48
49h1, h2, h3 {
50 border-bottom: solid #CCC 1px;
51}
52
53.toc_element {
54 margin-top: 0.5em;
55}
56
57.firstline {
58 margin-left: 2 em;
59}
60
61.method {
62 margin-top: 1em;
63 border: solid 1px #CCC;
64 padding: 1em;
65 background: #EEE;
66}
67
68.details {
69 font-weight: bold;
70 font-size: 14px;
71}
72
73</style>
74
75<h1><a href="iamcredentials_v1.html">IAM Service Account Credentials API</a> . <a href="iamcredentials_v1.projects.html">projects</a> . <a href="iamcredentials_v1.projects.serviceAccounts.html">serviceAccounts</a></h1>
76<h2>Instance Methods</h2>
77<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]78 <code><a href="#generateAccessToken">generateAccessToken(name, body=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]79<p class="firstline">Generates an OAuth 2.0 access token for a service account.</p>
80<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]81 <code><a href="#generateIdToken">generateIdToken(name, body=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]82<p class="firstline">Generates an OpenID Connect ID token for a service account.</p>
83<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]84 <code><a href="#signBlob">signBlob(name, body=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]85<p class="firstline">Signs a blob using a service account's system-managed private key.</p>
86<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]87 <code><a href="#signJwt">signJwt(name, body=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]88<p class="firstline">Signs a JWT using a service account's system-managed private key.</p>
89<h3>Method Details</h3>
90<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]91 <code class="details" id="generateAccessToken">generateAccessToken(name, body=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]92 <pre>Generates an OAuth 2.0 access token for a service account.
93
94Args:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]95 name: string, Required. The resource name of the service account for which the credentials
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]96are requested, in the following format:
97`projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard
98character is required; replacing it with a project ID is invalid. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]99 body: object, The request body.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]100 The object takes the form of:
101
102{
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]103 &quot;delegates&quot;: [ # The sequence of service accounts in a delegation chain. Each service
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]104 # account must be granted the `roles/iam.serviceAccountTokenCreator` role
105 # on its next service account in the chain. The last service account in the
106 # chain must be granted the `roles/iam.serviceAccountTokenCreator` role
107 # on the service account that is specified in the `name` field of the
108 # request.
109 #
110 # The delegates must have the following format:
111 # `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard
112 # character is required; replacing it with a project ID is invalid.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]113 &quot;A String&quot;,
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]114 ],
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame]115 &quot;scope&quot;: [ # Required. Code to identify the scopes to be included in the OAuth 2.0 access token.
116 # See https://developers.google.com/identity/protocols/googlescopes for more
117 # information.
118 # At least one value required.
119 &quot;A String&quot;,
120 ],
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]121 &quot;lifetime&quot;: &quot;A String&quot;, # The desired lifetime duration of the access token in seconds.
122 # Must be set to a value less than or equal to 3600 (1 hour). If a value is
123 # not specified, the token&#x27;s lifetime will be set to a default value of one
124 # hour.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]125 }
126
127 x__xgafv: string, V1 error format.
128 Allowed values
129 1 - v1 error format
130 2 - v2 error format
131
132Returns:
133 An object of the form:
134
135 {
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]136 &quot;expireTime&quot;: &quot;A String&quot;, # Token expiration time.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]137 # The expiration time is always set.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]138 &quot;accessToken&quot;: &quot;A String&quot;, # The OAuth 2.0 access token.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]139 }</pre>
140</div>
141
142<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]143 <code class="details" id="generateIdToken">generateIdToken(name, body=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]144 <pre>Generates an OpenID Connect ID token for a service account.
145
146Args:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]147 name: string, Required. The resource name of the service account for which the credentials
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]148are requested, in the following format:
149`projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard
150character is required; replacing it with a project ID is invalid. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]151 body: object, The request body.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]152 The object takes the form of:
153
154{
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]155 &quot;audience&quot;: &quot;A String&quot;, # Required. The audience for the token, such as the API or account that this token
156 # grants access to.
157 &quot;includeEmail&quot;: True or False, # Include the service account email in the token. If set to `true`, the
158 # token will contain `email` and `email_verified` claims.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]159 &quot;delegates&quot;: [ # The sequence of service accounts in a delegation chain. Each service
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]160 # account must be granted the `roles/iam.serviceAccountTokenCreator` role
161 # on its next service account in the chain. The last service account in the
162 # chain must be granted the `roles/iam.serviceAccountTokenCreator` role
163 # on the service account that is specified in the `name` field of the
164 # request.
165 #
166 # The delegates must have the following format:
167 # `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard
168 # character is required; replacing it with a project ID is invalid.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]169 &quot;A String&quot;,
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]170 ],
171 }
172
173 x__xgafv: string, V1 error format.
174 Allowed values
175 1 - v1 error format
176 2 - v2 error format
177
178Returns:
179 An object of the form:
180
181 {
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]182 &quot;token&quot;: &quot;A String&quot;, # The OpenId Connect ID token.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]183 }</pre>
184</div>
185
186<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]187 <code class="details" id="signBlob">signBlob(name, body=None, x__xgafv=None)</code>
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]188 <pre>Signs a blob using a service account&#x27;s system-managed private key.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]189
190Args:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]191 name: string, Required. The resource name of the service account for which the credentials
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]192are requested, in the following format:
193`projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard
194character is required; replacing it with a project ID is invalid. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]195 body: object, The request body.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]196 The object takes the form of:
197
198{
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]199 &quot;payload&quot;: &quot;A String&quot;, # Required. The bytes to sign.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]200 &quot;delegates&quot;: [ # The sequence of service accounts in a delegation chain. Each service
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]201 # account must be granted the `roles/iam.serviceAccountTokenCreator` role
202 # on its next service account in the chain. The last service account in the
203 # chain must be granted the `roles/iam.serviceAccountTokenCreator` role
204 # on the service account that is specified in the `name` field of the
205 # request.
206 #
207 # The delegates must have the following format:
208 # `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard
209 # character is required; replacing it with a project ID is invalid.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]210 &quot;A String&quot;,
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]211 ],
212 }
213
214 x__xgafv: string, V1 error format.
215 Allowed values
216 1 - v1 error format
217 2 - v2 error format
218
219Returns:
220 An object of the form:
221
222 {
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]223 &quot;keyId&quot;: &quot;A String&quot;, # The ID of the key used to sign the blob. The key used for signing will
224 # remain valid for at least 12 hours after the blob is signed. To verify the
225 # signature, you can retrieve the public key in several formats from the
226 # following endpoints:
227 #
228 # - RSA public key wrapped in an X.509 v3 certificate:
229 # `https://www.googleapis.com/service_accounts/v1/metadata/x509/{ACCOUNT_EMAIL}`
230 # - Raw key in JSON format:
231 # `https://www.googleapis.com/service_accounts/v1/metadata/raw/{ACCOUNT_EMAIL}`
232 # - JSON Web Key (JWK):
233 # `https://www.googleapis.com/service_accounts/v1/metadata/jwk/{ACCOUNT_EMAIL}`
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]234 &quot;signedBlob&quot;: &quot;A String&quot;, # The signature for the blob. Does not include the original blob.
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]235 #
236 # After the key pair referenced by the `key_id` response field expires,
237 # Google no longer exposes the public key that can be used to verify the
238 # blob. As a result, the receiver can no longer verify the signature.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]239 }</pre>
240</div>
241
242<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]243 <code class="details" id="signJwt">signJwt(name, body=None, x__xgafv=None)</code>
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]244 <pre>Signs a JWT using a service account&#x27;s system-managed private key.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]245
246Args:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]247 name: string, Required. The resource name of the service account for which the credentials
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]248are requested, in the following format:
249`projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard
250character is required; replacing it with a project ID is invalid. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]251 body: object, The request body.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]252 The object takes the form of:
253
254{
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]255 &quot;payload&quot;: &quot;A String&quot;, # Required. The JWT payload to sign. Must be a serialized JSON object that contains a
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame]256 # JWT Claims Set. For example: `{&quot;sub&quot;: &quot;user@example.com&quot;, &quot;iat&quot;: 313435}`
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]257 #
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame]258 # If the JWT Claims Set contains an expiration time (`exp`) claim, it must be
259 # an integer timestamp that is not in the past and no more than 12 hours in
260 # the future.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]261 &quot;delegates&quot;: [ # The sequence of service accounts in a delegation chain. Each service
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]262 # account must be granted the `roles/iam.serviceAccountTokenCreator` role
263 # on its next service account in the chain. The last service account in the
264 # chain must be granted the `roles/iam.serviceAccountTokenCreator` role
265 # on the service account that is specified in the `name` field of the
266 # request.
267 #
268 # The delegates must have the following format:
269 # `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard
270 # character is required; replacing it with a project ID is invalid.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]271 &quot;A String&quot;,
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]272 ],
273 }
274
275 x__xgafv: string, V1 error format.
276 Allowed values
277 1 - v1 error format
278 2 - v2 error format
279
280Returns:
281 An object of the form:
282
283 {
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]284 &quot;keyId&quot;: &quot;A String&quot;, # The ID of the key used to sign the JWT. The key used for signing will
285 # remain valid for at least 12 hours after the JWT is signed. To verify the
286 # signature, you can retrieve the public key in several formats from the
287 # following endpoints:
288 #
289 # - RSA public key wrapped in an X.509 v3 certificate:
290 # `https://www.googleapis.com/service_accounts/v1/metadata/x509/{ACCOUNT_EMAIL}`
291 # - Raw key in JSON format:
292 # `https://www.googleapis.com/service_accounts/v1/metadata/raw/{ACCOUNT_EMAIL}`
293 # - JSON Web Key (JWK):
294 # `https://www.googleapis.com/service_accounts/v1/metadata/jwk/{ACCOUNT_EMAIL}`
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]295 &quot;signedJwt&quot;: &quot;A String&quot;, # The signed JWT. Contains the automatically generated header; the
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]296 # client-supplied payload; and the signature, which is generated using the
297 # key referenced by the `kid` field in the header.
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]298 #
299 # After the key pair referenced by the `key_id` response field expires,
300 # Google no longer exposes the public key that can be used to verify the JWT.
301 # As a result, the receiver can no longer verify the signature.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]302 }</pre>
303</div>
304
305</body></html>