Blame - docs/dyn/healthcare_v1beta1.projects.locations.datasets.html - platform/external/python/google-api-python-client

2020-05-01 07:42:23 -0700

[diff] [blame]

78

<code><a href="healthcare_v1beta1.projects.locations.datasets.annotationStores.html">annotationStores()</a></code>

79

</p>

80

<p class="firstline">Returns the annotationStores Resource.</p>

81

82

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

83

<code><a href="healthcare_v1beta1.projects.locations.datasets.dicomStores.html">dicomStores()</a></code>

84

</p>

85

<p class="firstline">Returns the dicomStores Resource.</p>

86

87

88

<code><a href="healthcare_v1beta1.projects.locations.datasets.fhirStores.html">fhirStores()</a></code>

89

</p>

90

<p class="firstline">Returns the fhirStores Resource.</p>

91

92

93

<code><a href="healthcare_v1beta1.projects.locations.datasets.hl7V2Stores.html">hl7V2Stores()</a></code>

94

</p>

95

<p class="firstline">Returns the hl7V2Stores Resource.</p>

96

97

98

<code><a href="healthcare_v1beta1.projects.locations.datasets.operations.html">operations()</a></code>

99

</p>

100

<p class="firstline">Returns the operations Resource.</p>

101

102

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

103

<code><a href="#create">create(parent, body=None, datasetId=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

104

<p class="firstline">Creates a new health dataset. Results are returned through the</p>

105

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

106

<code><a href="#deidentify">deidentify(sourceDataset, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

107

<p class="firstline">Creates a new dataset containing de-identified data from the source</p>

108

109

<code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>

110

<p class="firstline">Deletes the specified health dataset and all data contained in the dataset.</p>

111

112

<code><a href="#get">get(name, x__xgafv=None)</a></code></p>

113

<p class="firstline">Gets any metadata associated with a dataset.</p>

114

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

115

<code><a href="#getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

116

<p class="firstline">Gets the access control policy for a resource.</p>

117

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

118

<code><a href="#list">list(parent, pageToken=None, pageSize=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

119

<p class="firstline">Lists the health datasets in the current project.</p>

120

121

<code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>

122

<p class="firstline">Retrieves the next page of results.</p>

123

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

124

<code><a href="#patch">patch(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

125

<p class="firstline">Updates dataset metadata.</p>

126

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

127

<code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

128

<p class="firstline">Sets the access control policy on the specified resource. Replaces any</p>

129

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

130

<code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

131

<p class="firstline">Returns permissions that a caller has on the specified resource.</p>

132

<h3>Method Details</h3>

133

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

134

<code class="details" id="create">create(parent, body=None, datasetId=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

135

<pre>Creates a new health dataset. Results are returned through the

136

Operation interface which returns either an

137

`Operation.response` which contains a Dataset or

138

`Operation.error`. The metadata

139

field type is OperationMetadata.

140

A Google Cloud Platform project can contain up to 500 datasets across all

141

regions.

142

143

Args:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

144

parent: string, The name of the project where the server creates the dataset. For

145

example, `projects/{project_id}/locations/{location_id}`. (required)

146

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

147

The object takes the form of:

148

149

{ # A message representing a health dataset.

150

#

151

# A health dataset represents a collection of healthcare data pertaining to one

152

# or more patients. This may include multiple modalities of healthcare data,

153

# such as electronic medical records or medical imaging data.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

154

"name": "A String", # Output only. Resource name of the dataset, of the form

155

# `projects/{project_id}/locations/{location_id}/datasets/{dataset_id}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

156

"timeZone": "A String", # The default timezone used by this dataset. Must be a either a valid IANA

157

# time zone name such as "America/New_York" or empty, which defaults to UTC.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

158

# This is used for parsing times in resources, such as HL7 messages, where no

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

159

# explicit timezone is specified.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

160

}

161

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

162

datasetId: string, The ID of the dataset that is being created.

163

The string must match the following regex: `[\p{L}\p{N}_\-\.]{1,256}`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

164

x__xgafv: string, V1 error format.

165

Allowed values

166

1 - v1 error format

167

2 - v2 error format

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

168

169

Returns:

170

An object of the form:

171

172

{ # This resource represents a long-running operation that is the result of a

173

# network API call.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

174

"metadata": { # Service-specific metadata associated with the operation. It typically

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

175

# contains progress information and common metadata such as create time.

176

# Some services might not provide such metadata. Any method that returns a

177

# long-running operation should document the metadata type, if any.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

178

"a_key": "", # Properties of the object. Contains field @type with type URL.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

179

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

180

"done": True or False, # If the value is `false`, it means the operation is still in progress.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

181

# If `true`, the operation is completed, and either `error` or `response` is

182

# available.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

183

"response": { # The normal response of the operation in case of success. If the original

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

184

# method returns no data on success, such as `Delete`, the response is

185

# `google.protobuf.Empty`. If the original method is standard

186

# `Get`/`Create`/`Update`, the response should be the resource. For other

187

# methods, the response should have the type `XxxResponse`, where `Xxx`

188

# is the original method name. For example, if the original method name

189

# is `TakeSnapshot()`, the inferred response type is

190

# `TakeSnapshotResponse`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

191

"a_key": "", # Properties of the object. Contains field @type with type URL.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

192

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

193

"name": "A String", # The server-assigned name, which is only unique within the same service that

194

# originally returns it. If you use the default HTTP mapping, the

195

# `name` should be a resource name ending with `operations/{unique_id}`.

196

"error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.

197

# different programming environments, including REST APIs and RPC APIs. It is

198

# used by [gRPC](https://github.com/grpc). Each `Status` message contains

199

# three pieces of data: error code, error message, and error details.

200

#

201

# You can find out more about this error model and how to work with it in the

202

# [API Design Guide](https://cloud.google.com/apis/design/errors).

203

"details": [ # A list of messages that carry the error details. There is a common set of

204

# message types for APIs to use.

205

{

206

"a_key": "", # Properties of the object. Contains field @type with type URL.

207

},

208

],

209

"code": 42, # The status code, which should be an enum value of google.rpc.Code.

210

"message": "A String", # A developer-facing error message, which should be in English. Any

211

# user-facing error message should be localized and sent in the

212

# google.rpc.Status.details field, or localized by the client.

213

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

218

<code class="details" id="deidentify">deidentify(sourceDataset, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

219

<pre>Creates a new dataset containing de-identified data from the source

220

dataset. The metadata field type

221

is OperationMetadata.

222

If the request is successful, the

223

response field type is

224

DeidentifySummary.

225

If errors occur,

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

226

error

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

227

details field type is

228

DeidentifyErrorDetails.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

229

The LRO result may still be successful if de-identification fails for some

230

DICOM instances. The new de-identified dataset will not contain these

231

failed resources. Failed resource totals are tracked in

232

DeidentifySummary.failure_resource_count.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

233

Error details are also logged to Cloud Logging. For more information,

234

see [Viewing logs](/healthcare/docs/how-tos/logging).

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

235

236

Args:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

237

sourceDataset: string, Source dataset resource name. For example,

238

`projects/{project_id}/locations/{location_id}/datasets/{dataset_id}`. (required)

239

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

240

The object takes the form of:

241

242

{ # Redacts identifying information from the specified dataset.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

243

"config": { # Configures de-id options specific to different types of content. # Deidentify configuration.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

244

# Each submessage customizes the handling of an

245

# https://tools.ietf.org/html/rfc6838 media type or subtype. Configs are

246

# applied in a nested manner at runtime.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

247

"text": { # Configures de-identification of text wherever it is found in the

248

# source_dataset.

249

"transformations": [ # The transformations to apply to the detected data.

250

{ # A transformation to apply to text that is identified as a specific

251

# info_type.

252

"dateShiftConfig": { # Shift a date forward or backward in time by a random amount which is # Config for date shift.

253

# consistent for a given patient and crypto key combination.

254

"cryptoKey": "A String", # An AES 128/192/256 bit key. Causes the shift to be computed based on this

255

# key and the patient ID. A default key is generated for each

256

# Deidentify operation and is used wherever crypto_key is not specified.

257

},

258

"characterMaskConfig": { # Mask a string by replacing its characters with a fixed character. # Config for character mask.

259

"maskingCharacter": "A String", # Character to mask the sensitive values. If not supplied, defaults to "*".

260

},

261

"redactConfig": { # Define how to redact sensitive values. Default behaviour is erase. # Config for text redaction.

262

# For example, "My name is Jane." becomes "My name is ."

263

},

264

"infoTypes": [ # InfoTypes to apply this transformation to. If this is not specified, this

265

# transformation becomes the default transformation, and is used for any

266

# info_type that is not specified in another transformation.

267

"A String",

268

],

269

"replaceWithInfoTypeConfig": { # When using the # Config for replace with InfoType.

270

# INSPECT_AND_TRANSFORM

271

# action, each match is replaced with the name of the info_type. For example,

272

# "My name is Jane" becomes "My name is [PERSON_NAME]." The

273

# TRANSFORM

274

# action is equivalent to redacting.

275

},

276

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Config for crypto hash.

277

# Uses SHA-256.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

278

# Outputs a base64-encoded representation of the hashed output.

279

# For example, `L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

280

"cryptoKey": "A String", # An AES 128/192/256 bit key. Causes the hash to be computed based on this

281

# key. A default key is generated for each Deidentify operation and is used

282

# wherever crypto_key is not specified.

283

},

284

},

285

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

286

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

287

"dicom": { # Specifies the parameters needed for de-identification of DICOM stores. # Configures de-id of application/DICOM content.

288

"filterProfile": "A String", # Tag filtering profile that determines which tags to keep/remove.

289

"skipIdRedaction": True or False, # If true, skip replacing StudyInstanceUID, SeriesInstanceUID,

290

# SOPInstanceUID, and MediaStorageSOPInstanceUID and leave them untouched.

291

# The Cloud Healthcare API regenerates these UIDs by default based on the

292

# DICOM Standard's reasoning: "Whilst these UIDs cannot be mapped directly

293

# to an individual out of context, given access to the original images, or

294

# to a database of the original images containing the UIDs, it would be

295

# possible to recover the individual's identity."

296

# http://dicom.nema.org/medical/dicom/current/output/chtml/part15/sect_E.3.9.html

297

"keepList": { # List of tags to be filtered. # List of tags to keep. Remove all other tags.

298

"tags": [ # Tags to be filtered. Tags must be DICOM Data Elements, File Meta

299

# Elements, or Directory Structuring Elements, as defined at:

300

# http://dicom.nema.org/medical/dicom/current/output/html/part06.html#table_6-1,.

301

# They may be provided by "Keyword" or "Tag". For example, "PatientID",

# "00100010".

"A String",

],

},

"removeList": { # List of tags to be filtered. # List of tags to remove. Keep all other tags.

307

"tags": [ # Tags to be filtered. Tags must be DICOM Data Elements, File Meta

308

# Elements, or Directory Structuring Elements, as defined at:

309

# http://dicom.nema.org/medical/dicom/current/output/html/part06.html#table_6-1,.

310

# They may be provided by "Keyword" or "Tag". For example, "PatientID",

# "00100010".

"A String",

],

},

},

"fhir": { # Specifies how to handle de-identification of a FHIR store. # Configures de-id of application/FHIR content.

317

"fieldMetadataList": [ # Specifies FHIR paths to match and how to transform them. Any field that

318

# is not matched by a FieldMetadata is passed through to the output

319

# dataset unmodified. All extensions are removed in the output.

320

# If a field can be matched by more than one FieldMetadata, the first

321

# FieldMetadata.Action is applied.

322

{ # Specifies FHIR paths to match, and how to handle de-identification of

323

# matching fields.

324

"paths": [ # List of paths to FHIR fields to redact. Each path is a

325

# period-separated list where each component is either a field name or

326

# FHIR type name. All types begin with an upper case letter. For example,

327

# the resource field "Patient.Address.city", which uses a string type,

328

# can be matched by "Patient.Address.String". Path also supports partial

329

# matching. For example, "Patient.Address.city" can be matched by

330

# "Address.city" (Patient omitted). Partial matching and type matching

331

# can be combined. For example, "Patient.Address.city" can be matched by

332

# "Address.String". For "choice" types (those defined in the FHIR spec

333

# with the form: field[x]), use two separate components. For example,

334

# "deceasedAge.unit" is matched by "Deceased.Age.unit". Supported types

335

# are: AdministrativeGenderCode, Code, Date, DateTime, Decimal,

336

# HumanName, Id, LanguageCode, Markdown, Oid, String, Uri, Uuid, Xhtml.

337

# The sub-type for HumanName, such as HumanName.given or

338

# HumanName.family, can be omitted.

339

"A String",

340

],

341

"action": "A String", # Deidentify action for one field.

},

],

},

"image": { # Specifies how to handle de-identification of image pixels. # Configures de-identification of image pixels wherever they are found in the

346

# source_dataset.

347

"textRedactionMode": "A String", # Determines how to redact text from image.

348

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

349

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

350

"destinationDataset": "A String", # The name of the dataset resource to create and write the redacted data to.

351

#

352

# * The destination dataset must not exist.

353

# * The destination dataset must be in the same project and location as the

354

# source dataset. De-identifying data across multiple projects or locations

355

# is not supported.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

356

}

357

358

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

365

366

{ # This resource represents a long-running operation that is the result of a

367

# network API call.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

368

"metadata": { # Service-specific metadata associated with the operation. It typically

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

369

# contains progress information and common metadata such as create time.

370

# Some services might not provide such metadata. Any method that returns a

371

# long-running operation should document the metadata type, if any.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

372

"a_key": "", # Properties of the object. Contains field @type with type URL.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

373

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

374

"done": True or False, # If the value is `false`, it means the operation is still in progress.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

375

# If `true`, the operation is completed, and either `error` or `response` is

376

# available.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

377

"response": { # The normal response of the operation in case of success. If the original

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

378

# method returns no data on success, such as `Delete`, the response is

379

# `google.protobuf.Empty`. If the original method is standard

380

# `Get`/`Create`/`Update`, the response should be the resource. For other

381

# methods, the response should have the type `XxxResponse`, where `Xxx`

382

# is the original method name. For example, if the original method name

383

# is `TakeSnapshot()`, the inferred response type is

384

# `TakeSnapshotResponse`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

385

"a_key": "", # Properties of the object. Contains field @type with type URL.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

386

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

387

"name": "A String", # The server-assigned name, which is only unique within the same service that

388

# originally returns it. If you use the default HTTP mapping, the

389

# `name` should be a resource name ending with `operations/{unique_id}`.

390

"error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.

391

# different programming environments, including REST APIs and RPC APIs. It is

392

# used by [gRPC](https://github.com/grpc). Each `Status` message contains

393

# three pieces of data: error code, error message, and error details.

394

#

395

# You can find out more about this error model and how to work with it in the

396

# [API Design Guide](https://cloud.google.com/apis/design/errors).

397

"details": [ # A list of messages that carry the error details. There is a common set of

398

# message types for APIs to use.

399

{

400

"a_key": "", # Properties of the object. Contains field @type with type URL.

401

},

402

],

403

"code": 42, # The status code, which should be an enum value of google.rpc.Code.

404

"message": "A String", # A developer-facing error message, which should be in English. Any

405

# user-facing error message should be localized and sent in the

406

# google.rpc.Status.details field, or localized by the client.

407

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

<code class="details" id="delete">delete(name, x__xgafv=None)</code>

413

<pre>Deletes the specified health dataset and all data contained in the dataset.

414

Deleting a dataset does not affect the sources from which the dataset was

415

imported (if any).

416

417

Args:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

418

419

`projects/{project_id}/locations/{location_id}/datasets/{dataset_id}`. (required)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

420

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

427

428

{ # A generic empty message that you can re-use to avoid defining duplicated

429

# empty messages in your APIs. A typical example is to use it as the request

430

# or the response type of an API method. For instance:

431

#

432

# service Foo {

433

# rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);

434

# }

435

#

436

# The JSON representation for `Empty` is empty JSON object `{}`.

}</pre>

</div>

<code class="details" id="get">get(name, x__xgafv=None)</code>

442

<pre>Gets any metadata associated with a dataset.

443

444

Args:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

445

446

`projects/{project_id}/locations/{location_id}/datasets/{dataset_id}`. (required)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

447

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

454

455

{ # A message representing a health dataset.

456

#

457

# A health dataset represents a collection of healthcare data pertaining to one

458

# or more patients. This may include multiple modalities of healthcare data,

459

# such as electronic medical records or medical imaging data.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

460

"name": "A String", # Output only. Resource name of the dataset, of the form

461

# `projects/{project_id}/locations/{location_id}/datasets/{dataset_id}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

462

"timeZone": "A String", # The default timezone used by this dataset. Must be a either a valid IANA

463

# time zone name such as "America/New_York" or empty, which defaults to UTC.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

464

# This is used for parsing times in resources, such as HL7 messages, where no

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

465

# explicit timezone is specified.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

470

<code class="details" id="getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

471

<pre>Gets the access control policy for a resource.

472

Returns an empty policy if the resource exists and does not have a policy

set.

Args:

resource: string, REQUIRED: The resource for which the policy is being requested.

477

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

478

options_requestedPolicyVersion: integer, Optional. The policy format version to be returned.

479

480

Valid values are 0, 1, and 3. Requests specifying an invalid value will be

481

rejected.

482

483

Requests for policies with any conditional bindings must specify version 3.

484

Policies without any conditional bindings may specify any valid value or

485

leave the field unset.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

486

487

To learn which resources support conditions in their IAM policies, see the

488

[IAM

489

documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

490

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

497

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

498

{ # An Identity and Access Management (IAM) policy, which specifies access

499

# controls for Google Cloud resources.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

500

#

501

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

502

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

503

# `members` to a single `role`. Members can be user accounts, service accounts,

504

# Google groups, and domains (such as G Suite). A `role` is a named list of

505

# permissions; each `role` can be an IAM predefined role or a user-created

506

# custom role.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

507

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

508

# For some types of Google Cloud resources, a `binding` can also specify a

509

# `condition`, which is a logical expression that allows access to a resource

510

# only if the expression evaluates to `true`. A condition can add constraints

511

# based on attributes of the request, the resource, or both. To learn which

512

# resources support conditions in their IAM policies, see the

513

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

514

#

515

# **JSON example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

516

#

517

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

518

# "bindings": [

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

519

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

520

# "role": "roles/resourcemanager.organizationAdmin",

521

# "members": [

522

# "user:mike@example.com",

523

# "group:admins@example.com",

524

# "domain:google.com",

525

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

526

# ]

527

# },

528

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

529

# "role": "roles/resourcemanager.organizationViewer",

530

# "members": [

531

# "user:eve@example.com"

532

# ],

533

# "condition": {

534

# "title": "expirable access",

535

# "description": "Does not grant access after Sep 2020",

536

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

537

# }

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

538

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

539

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

540

# "etag": "BwWWja0YfJA=",

541

# "version": 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

542

# }

543

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

544

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

549

# - group:admins@example.com

550

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

551

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

552

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

553

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

554

# - user:eve@example.com

555

# role: roles/resourcemanager.organizationViewer

556

# condition:

557

# title: expirable access

558

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

559

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

560

# - etag: BwWWja0YfJA=

561

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

562

#

563

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

564

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

565

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

566

# prevent simultaneous updates of a policy from overwriting each other.

567

# It is strongly suggested that systems make use of the `etag` in the

568

# read-modify-write cycle to perform policy updates in order to avoid race

569

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

570

# systems are expected to put that etag in the request to `setIamPolicy` to

571

# ensure that their change will be applied to the same version of the policy.

572

#

573

# **Important:** If you use IAM Conditions, you must include the `etag` field

574

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

575

# you to overwrite a version `3` policy with a version `1` policy, and all of

576

# the conditions in the version `3` policy are lost.

577

"version": 42, # Specifies the format of the policy.

578

#

579

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

580

# are rejected.

581

#

582

# Any operation that affects conditional role bindings must specify version

583

# `3`. This requirement applies to the following operations:

584

#

585

# * Getting a policy that includes a conditional role binding

586

# * Adding a conditional role binding to a policy

587

# * Changing a conditional role binding in a policy

588

# * Removing any role binding, with or without a condition, from a policy

589

# that includes conditions

590

#

591

# **Important:** If you use IAM Conditions, you must include the `etag` field

592

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

593

# you to overwrite a version `3` policy with a version `1` policy, and all of

594

# the conditions in the version `3` policy are lost.

595

#

596

# If a policy does not include any conditions, operations on that policy may

597

# specify any valid version or leave the field unset.

598

#

599

# To learn which resources support conditions in their IAM policies, see the

600

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

601

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

602

{ # Specifies the audit configuration for a service.

603

# The configuration determines which permission types are logged, and what

604

# identities, if any, are exempted from logging.

605

# An AuditConfig must have one or more AuditLogConfigs.

606

#

607

# If there are AuditConfigs for both `allServices` and a specific service,

608

# the union of the two AuditConfigs is used for that service: the log_types

609

# specified in each AuditConfig are enabled, and the exempted_members in each

610

# AuditLogConfig are exempted.

611

#

612

# Example Policy with multiple AuditConfigs:

#

# {

# "audit_configs": [

# {

# "service": "allServices"

618

# "audit_log_configs": [

619

# {

620

# "log_type": "DATA_READ",

621

# "exempted_members": [

622

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

627

# },

628

# {

629

# "log_type": "ADMIN_READ",

# }

# ]

# },

# {

# "service": "sampleservice.googleapis.com"

635

# "audit_log_configs": [

636

# {

637

# "log_type": "DATA_READ",

638

# },

639

# {

640

# "log_type": "DATA_WRITE",

641

# "exempted_members": [

642

# "user:aliya@example.com"

# ]

# }

# ]

# }

# ]

# }

#

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

651

# logging. It also exempts jose@example.com from DATA_READ logging, and

652

# aliya@example.com from DATA_WRITE logging.

653

"auditLogConfigs": [ # The configuration for logging of each type of permission.

654

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

659

# {

660

# "log_type": "DATA_READ",

661

# "exempted_members": [

662

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

672

# jose@example.com from DATA_READ logging.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

673

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

674

# permission.

675

# Follows the same format of Binding.members.

676

"A String",

677

],

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

678

"logType": "A String", # The log type that this config enables.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

679

},

680

],

681

"service": "A String", # Specifies a service that will be enabled for audit logging.

682

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

683

# `allServices` is a special value that covers all services.

684

},

685

],

686

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

687

# `condition` that determines how and when the `bindings` are applied. Each

688

# of the `bindings` must contain at least one member.

689

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

690

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

691

#

692

# If the condition evaluates to `true`, then this binding applies to the

693

# current request.

694

#

695

# If the condition evaluates to `false`, then this binding does not apply to

696

# the current request. However, a different role binding might grant the same

697

# role to one or more of the members in this binding.

698

#

699

# To learn which resources support conditions in their IAM policies, see the

700

# [IAM

701

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

702

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

703

# are documented at https://github.com/google/cel-spec.

704

#

705

# Example (Comparison):

706

#

707

# title: "Summary size limit"

708

# description: "Determines if a summary is less than 100 chars"

709

# expression: "document.summary.size() < 100"

710

#

711

# Example (Equality):

712

#

713

# title: "Requestor is owner"

714

# description: "Determines if requestor is the document owner"

715

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

720

# description: "Determine whether the document should be publicly visible"

721

# expression: "document.type != 'private' && document.type != 'internal'"

722

#

723

# Example (Data Manipulation):

724

#

725

# title: "Notification string"

726

# description: "Create a notification string with a timestamp."

727

# expression: "'New message received at ' + string(document.create_time)"

728

#

729

# The exact variables and functions that may be referenced within an expression

730

# are determined by the service that evaluates it. See the service

731

# documentation for additional information.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

732

"expression": "A String", # Textual representation of an expression in Common Expression Language

733

# syntax.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

734

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

735

# its purpose. This can be used e.g. in UIs which allow to enter the

736

# expression.

737

"location": "A String", # Optional. String indicating the location of the expression for error

738

# reporting, e.g. a file name and a position in the file.

739

"description": "A String", # Optional. Description of the expression. This is a longer text which

740

# describes the expression, e.g. when hovered over it in a UI.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

741

},

742

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

743

# `members` can have the following values:

744

#

745

# * `allUsers`: A special identifier that represents anyone who is

746

# on the internet; with or without a Google account.

747

#

748

# * `allAuthenticatedUsers`: A special identifier that represents anyone

749

# who is authenticated with a Google account or a service account.

750

#

751

# * `user:{emailid}`: An email address that represents a specific Google

752

# account. For example, `alice@example.com` .

753

#

754

#

755

# * `serviceAccount:{emailid}`: An email address that represents a service

756

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

757

#

758

# * `group:{emailid}`: An email address that represents a Google group.

759

# For example, `admins@example.com`.

760

#

761

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

762

# identifier) representing a user that has been recently deleted. For

763

# example, `alice@example.com?uid=123456789012345678901`. If the user is

764

# recovered, this value reverts to `user:{emailid}` and the recovered user

765

# retains the role in the binding.

766

#

767

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

768

# unique identifier) representing a service account that has been recently

769

# deleted. For example,

770

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

771

# If the service account is undeleted, this value reverts to

772

# `serviceAccount:{emailid}` and the undeleted service account retains the

773

# role in the binding.

774

#

775

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

776

# identifier) representing a Google group that has been recently

777

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

778

# the group is recovered, this value reverts to `group:{emailid}` and the

779

# recovered group retains the role in the binding.

780

#

781

#

782

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

783

# users of that domain. For example, `google.com` or `example.com`.

784

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

785

"A String",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

786

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

787

"role": "A String", # Role that is assigned to `members`.

788

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

789

},

790

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

795

<code class="details" id="list">list(parent, pageToken=None, pageSize=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

796

<pre>Lists the health datasets in the current project.

797

798

Args:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

799

parent: string, The name of the project whose datasets should be listed.

800

For example, `projects/{project_id}/locations/{location_id}`. (required)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

801

pageToken: string, The next_page_token value returned from a previous List request, if any.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

802

pageSize: integer, The maximum number of items to return. Capped to 100 if not specified.

803

May not be larger than 1000.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

804

x__xgafv: string, V1 error format.

805

Allowed values

806

1 - v1 error format

807

2 - v2 error format

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

808

809

Returns:

810

An object of the form:

811

812

{ # Lists the available datasets.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

813

"datasets": [ # The first page of datasets.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

814

{ # A message representing a health dataset.

815

#

816

# A health dataset represents a collection of healthcare data pertaining to one

817

# or more patients. This may include multiple modalities of healthcare data,

818

# such as electronic medical records or medical imaging data.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

819

"name": "A String", # Output only. Resource name of the dataset, of the form

820

# `projects/{project_id}/locations/{location_id}/datasets/{dataset_id}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

821

"timeZone": "A String", # The default timezone used by this dataset. Must be a either a valid IANA

822

# time zone name such as "America/New_York" or empty, which defaults to UTC.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

823

# This is used for parsing times in resources, such as HL7 messages, where no

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

824

# explicit timezone is specified.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

825

},

826

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

827

"nextPageToken": "A String", # Token to retrieve the next page of results, or empty if there are no

828

# more results in the list.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

<code class="details" id="list_next">list_next(previous_request, previous_response)</code>

834

<pre>Retrieves the next page of results.

835

836

Args:

837

previous_request: The request for the previous page. (required)

838

previous_response: The response from the request for the previous page. (required)

839

840

Returns:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

841

A request object that you can call 'execute()' on to request the next

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

842

page. Returns None if there are no more items in the collection.

</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

847

<code class="details" id="patch">patch(name, body=None, updateMask=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

848

<pre>Updates dataset metadata.

Args:

`projects/{project_id}/locations/{location_id}/datasets/{dataset_id}`. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

853

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

854

The object takes the form of:

855

856

{ # A message representing a health dataset.

857

#

858

# A health dataset represents a collection of healthcare data pertaining to one

859

# or more patients. This may include multiple modalities of healthcare data,

860

# such as electronic medical records or medical imaging data.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

861

"name": "A String", # Output only. Resource name of the dataset, of the form

862

# `projects/{project_id}/locations/{location_id}/datasets/{dataset_id}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

863

"timeZone": "A String", # The default timezone used by this dataset. Must be a either a valid IANA

864

# time zone name such as "America/New_York" or empty, which defaults to UTC.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

865

# This is used for parsing times in resources, such as HL7 messages, where no

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

866

# explicit timezone is specified.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

867

}

868

869

updateMask: string, The update mask applies to the resource. For the `FieldMask` definition,

870

see

871

https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask

872

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

879

880

{ # A message representing a health dataset.

881

#

882

# A health dataset represents a collection of healthcare data pertaining to one

883

# or more patients. This may include multiple modalities of healthcare data,

884

# such as electronic medical records or medical imaging data.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

885

"name": "A String", # Output only. Resource name of the dataset, of the form

886

# `projects/{project_id}/locations/{location_id}/datasets/{dataset_id}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

887

"timeZone": "A String", # The default timezone used by this dataset. Must be a either a valid IANA

888

# time zone name such as "America/New_York" or empty, which defaults to UTC.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

889

# This is used for parsing times in resources, such as HL7 messages, where no

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

890

# explicit timezone is specified.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

895

<code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

896

<pre>Sets the access control policy on the specified resource. Replaces any

897

existing policy.

898

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

899

Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

900

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

901

Args:

902

resource: string, REQUIRED: The resource for which the policy is being specified.

903

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

904

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

905

The object takes the form of:

906

907

{ # Request message for `SetIamPolicy` method.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

908

"updateMask": "A String", # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only

909

# the fields in the mask will be modified. If no mask is provided, the

910

# following default mask is used:

911

#

912

# `paths: "bindings, etag"`

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

913

"policy": { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the `resource`. The size of

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

914

# the policy is limited to a few 10s of KB. An empty policy is a

915

# valid policy but certain Cloud Platform services (such as Projects)

916

# might reject them.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

917

# controls for Google Cloud resources.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

918

#

919

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

920

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

921

# `members` to a single `role`. Members can be user accounts, service accounts,

922

# Google groups, and domains (such as G Suite). A `role` is a named list of

923

# permissions; each `role` can be an IAM predefined role or a user-created

924

# custom role.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

925

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

926

# For some types of Google Cloud resources, a `binding` can also specify a

927

# `condition`, which is a logical expression that allows access to a resource

928

# only if the expression evaluates to `true`. A condition can add constraints

929

# based on attributes of the request, the resource, or both. To learn which

930

# resources support conditions in their IAM policies, see the

931

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

932

#

933

# **JSON example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

934

#

935

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

936

# "bindings": [

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

937

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

938

# "role": "roles/resourcemanager.organizationAdmin",

939

# "members": [

940

# "user:mike@example.com",

941

# "group:admins@example.com",

942

# "domain:google.com",

943

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

944

# ]

945

# },

946

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

947

# "role": "roles/resourcemanager.organizationViewer",

948

# "members": [

949

# "user:eve@example.com"

950

# ],

951

# "condition": {

952

# "title": "expirable access",

953

# "description": "Does not grant access after Sep 2020",

954

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

955

# }

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

956

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

957

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

958

# "etag": "BwWWja0YfJA=",

959

# "version": 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

960

# }

961

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

962

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

967

# - group:admins@example.com

968

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

969

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

970

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

971

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

972

# - user:eve@example.com

973

# role: roles/resourcemanager.organizationViewer

974

# condition:

975

# title: expirable access

976

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

977

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

978

# - etag: BwWWja0YfJA=

979

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

980

#

981

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

982

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

983

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

984

# prevent simultaneous updates of a policy from overwriting each other.

985

# It is strongly suggested that systems make use of the `etag` in the

986

# read-modify-write cycle to perform policy updates in order to avoid race

987

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

988

# systems are expected to put that etag in the request to `setIamPolicy` to

989

# ensure that their change will be applied to the same version of the policy.

990

#

991

# **Important:** If you use IAM Conditions, you must include the `etag` field

992

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

993

# you to overwrite a version `3` policy with a version `1` policy, and all of

994

# the conditions in the version `3` policy are lost.

995

"version": 42, # Specifies the format of the policy.

996

#

997

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

998

# are rejected.

999

#

1000

# Any operation that affects conditional role bindings must specify version

1001

# `3`. This requirement applies to the following operations:

1002

#

1003

# * Getting a policy that includes a conditional role binding

1004

# * Adding a conditional role binding to a policy

1005

# * Changing a conditional role binding in a policy

1006

# * Removing any role binding, with or without a condition, from a policy

1007

# that includes conditions

1008

#

1009

# **Important:** If you use IAM Conditions, you must include the `etag` field

1010

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1011

# you to overwrite a version `3` policy with a version `1` policy, and all of

1012

# the conditions in the version `3` policy are lost.

1013

#

1014

# If a policy does not include any conditions, operations on that policy may

1015

# specify any valid version or leave the field unset.

1016

#

1017

# To learn which resources support conditions in their IAM policies, see the

1018

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

1019

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

1020

{ # Specifies the audit configuration for a service.

1021

# The configuration determines which permission types are logged, and what

1022

# identities, if any, are exempted from logging.

1023

# An AuditConfig must have one or more AuditLogConfigs.

1024

#

1025

# If there are AuditConfigs for both `allServices` and a specific service,

1026

# the union of the two AuditConfigs is used for that service: the log_types

1027

# specified in each AuditConfig are enabled, and the exempted_members in each

1028

# AuditLogConfig are exempted.

1029

#

1030

# Example Policy with multiple AuditConfigs:

#

# {

# "audit_configs": [

# {

# "service": "allServices"

1036

# "audit_log_configs": [

1037

# {

1038

# "log_type": "DATA_READ",

1039

# "exempted_members": [

1040

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

1045

# },

1046

# {

1047

# "log_type": "ADMIN_READ",

# }

# ]

# },

# {

# "service": "sampleservice.googleapis.com"

1053

# "audit_log_configs": [

1054

# {

1055

# "log_type": "DATA_READ",

1056

# },

1057

# {

1058

# "log_type": "DATA_WRITE",

1059

# "exempted_members": [

1060

# "user:aliya@example.com"

# ]

# }

# ]

# }

# ]

# }

#

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

1069

# logging. It also exempts jose@example.com from DATA_READ logging, and

1070

# aliya@example.com from DATA_WRITE logging.

1071

"auditLogConfigs": [ # The configuration for logging of each type of permission.

1072

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

1077

# {

1078

# "log_type": "DATA_READ",

1079

# "exempted_members": [

1080

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

1090

# jose@example.com from DATA_READ logging.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1091

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

1092

# permission.

1093

# Follows the same format of Binding.members.

1094

"A String",

1095

],

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1096

"logType": "A String", # The log type that this config enables.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1097

},

1098

],

1099

"service": "A String", # Specifies a service that will be enabled for audit logging.

1100

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

1101

# `allServices` is a special value that covers all services.

1102

},

1103

],

1104

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1105

# `condition` that determines how and when the `bindings` are applied. Each

1106

# of the `bindings` must contain at least one member.

1107

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1108

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

1109

#

1110

# If the condition evaluates to `true`, then this binding applies to the

1111

# current request.

1112

#

1113

# If the condition evaluates to `false`, then this binding does not apply to

1114

# the current request. However, a different role binding might grant the same

1115

# role to one or more of the members in this binding.

1116

#

1117

# To learn which resources support conditions in their IAM policies, see the

1118

# [IAM

1119

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

1120

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

1121

# are documented at https://github.com/google/cel-spec.

1122

#

1123

# Example (Comparison):

1124

#

1125

# title: "Summary size limit"

1126

# description: "Determines if a summary is less than 100 chars"

1127

# expression: "document.summary.size() < 100"

1128

#

1129

# Example (Equality):

1130

#

1131

# title: "Requestor is owner"

1132

# description: "Determines if requestor is the document owner"

1133

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

1138

# description: "Determine whether the document should be publicly visible"

1139

# expression: "document.type != 'private' && document.type != 'internal'"

1140

#

1141

# Example (Data Manipulation):

1142

#

1143

# title: "Notification string"

1144

# description: "Create a notification string with a timestamp."

1145

# expression: "'New message received at ' + string(document.create_time)"

1146

#

1147

# The exact variables and functions that may be referenced within an expression

1148

# are determined by the service that evaluates it. See the service

1149

# documentation for additional information.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1150

"expression": "A String", # Textual representation of an expression in Common Expression Language

1151

# syntax.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1152

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

1153

# its purpose. This can be used e.g. in UIs which allow to enter the

1154

# expression.

1155

"location": "A String", # Optional. String indicating the location of the expression for error

1156

# reporting, e.g. a file name and a position in the file.

1157

"description": "A String", # Optional. Description of the expression. This is a longer text which

1158

# describes the expression, e.g. when hovered over it in a UI.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1159

},

1160

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1161

# `members` can have the following values:

1162

#

1163

# * `allUsers`: A special identifier that represents anyone who is

1164

# on the internet; with or without a Google account.

1165

#

1166

# * `allAuthenticatedUsers`: A special identifier that represents anyone

1167

# who is authenticated with a Google account or a service account.

1168

#

1169

# * `user:{emailid}`: An email address that represents a specific Google

1170

# account. For example, `alice@example.com` .

1171

#

1172

#

1173

# * `serviceAccount:{emailid}`: An email address that represents a service

1174

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

1175

#

1176

# * `group:{emailid}`: An email address that represents a Google group.

1177

# For example, `admins@example.com`.

1178

#

1179

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

1180

# identifier) representing a user that has been recently deleted. For

1181

# example, `alice@example.com?uid=123456789012345678901`. If the user is

1182

# recovered, this value reverts to `user:{emailid}` and the recovered user

1183

# retains the role in the binding.

1184

#

1185

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

1186

# unique identifier) representing a service account that has been recently

1187

# deleted. For example,

1188

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

1189

# If the service account is undeleted, this value reverts to

1190

# `serviceAccount:{emailid}` and the undeleted service account retains the

1191

# role in the binding.

1192

#

1193

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

1194

# identifier) representing a Google group that has been recently

1195

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

1196

# the group is recovered, this value reverts to `group:{emailid}` and the

1197

# recovered group retains the role in the binding.

1198

#

1199

#

1200

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

1201

# users of that domain. For example, `google.com` or `example.com`.

1202

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1203

"A String",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1204

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1205

"role": "A String", # Role that is assigned to `members`.

1206

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1207

},

1208

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1209

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1210

}

1211

1212

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1219

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1220

{ # An Identity and Access Management (IAM) policy, which specifies access

1221

# controls for Google Cloud resources.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1222

#

1223

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1224

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

1225

# `members` to a single `role`. Members can be user accounts, service accounts,

1226

# Google groups, and domains (such as G Suite). A `role` is a named list of

1227

# permissions; each `role` can be an IAM predefined role or a user-created

1228

# custom role.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1229

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1230

# For some types of Google Cloud resources, a `binding` can also specify a

1231

# `condition`, which is a logical expression that allows access to a resource

1232

# only if the expression evaluates to `true`. A condition can add constraints

1233

# based on attributes of the request, the resource, or both. To learn which

1234

# resources support conditions in their IAM policies, see the

1235

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1236

#

1237

# **JSON example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1238

#

1239

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1240

# "bindings": [

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1241

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1242

# "role": "roles/resourcemanager.organizationAdmin",

1243

# "members": [

1244

# "user:mike@example.com",

1245

# "group:admins@example.com",

1246

# "domain:google.com",

1247

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1248

# ]

1249

# },

1250

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1251

# "role": "roles/resourcemanager.organizationViewer",

1252

# "members": [

1253

# "user:eve@example.com"

1254

# ],

1255

# "condition": {

1256

# "title": "expirable access",

1257

# "description": "Does not grant access after Sep 2020",

1258

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1259

# }

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1260

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1261

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1262

# "etag": "BwWWja0YfJA=",

1263

# "version": 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1264

# }

1265

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1266

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

1271

# - group:admins@example.com

1272

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1273

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

1274

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1275

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1276

# - user:eve@example.com

1277

# role: roles/resourcemanager.organizationViewer

1278

# condition:

1279

# title: expirable access

1280

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1281

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1282

# - etag: BwWWja0YfJA=

1283

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1284

#

1285

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1286

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1287

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

1288

# prevent simultaneous updates of a policy from overwriting each other.

1289

# It is strongly suggested that systems make use of the `etag` in the

1290

# read-modify-write cycle to perform policy updates in order to avoid race

1291

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

1292

# systems are expected to put that etag in the request to `setIamPolicy` to

1293

# ensure that their change will be applied to the same version of the policy.

1294

#

1295

# **Important:** If you use IAM Conditions, you must include the `etag` field

1296

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1297

# you to overwrite a version `3` policy with a version `1` policy, and all of

1298

# the conditions in the version `3` policy are lost.

1299

"version": 42, # Specifies the format of the policy.

1300

#

1301

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

1302

# are rejected.

1303

#

1304

# Any operation that affects conditional role bindings must specify version

1305

# `3`. This requirement applies to the following operations:

1306

#

1307

# * Getting a policy that includes a conditional role binding

1308

# * Adding a conditional role binding to a policy

1309

# * Changing a conditional role binding in a policy

1310

# * Removing any role binding, with or without a condition, from a policy

1311

# that includes conditions

1312

#

1313

# **Important:** If you use IAM Conditions, you must include the `etag` field

1314

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1315

# you to overwrite a version `3` policy with a version `1` policy, and all of

1316

# the conditions in the version `3` policy are lost.

1317

#

1318

# If a policy does not include any conditions, operations on that policy may

1319

# specify any valid version or leave the field unset.

1320

#

1321

# To learn which resources support conditions in their IAM policies, see the

1322

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

1323

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

1324

{ # Specifies the audit configuration for a service.

1325

# The configuration determines which permission types are logged, and what

1326

# identities, if any, are exempted from logging.

1327

# An AuditConfig must have one or more AuditLogConfigs.

1328

#

1329

# If there are AuditConfigs for both `allServices` and a specific service,

1330

# the union of the two AuditConfigs is used for that service: the log_types

1331

# specified in each AuditConfig are enabled, and the exempted_members in each

1332

# AuditLogConfig are exempted.

1333

#

1334

# Example Policy with multiple AuditConfigs:

#

# {

# "audit_configs": [

# {

# "service": "allServices"

1340

# "audit_log_configs": [

1341

# {

1342

# "log_type": "DATA_READ",

1343

# "exempted_members": [

1344

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

1349

# },

1350

# {

1351

# "log_type": "ADMIN_READ",

# }

# ]

# },

# {

# "service": "sampleservice.googleapis.com"

1357

# "audit_log_configs": [

1358

# {

1359

# "log_type": "DATA_READ",

1360

# },

1361

# {

1362

# "log_type": "DATA_WRITE",

1363

# "exempted_members": [

1364

# "user:aliya@example.com"

# ]

# }

# ]

# }

# ]

# }

#

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

1373

# logging. It also exempts jose@example.com from DATA_READ logging, and

1374

# aliya@example.com from DATA_WRITE logging.

1375

"auditLogConfigs": [ # The configuration for logging of each type of permission.

1376

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

1381

# {

1382

# "log_type": "DATA_READ",

1383

# "exempted_members": [

1384

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

1394

# jose@example.com from DATA_READ logging.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1395

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

1396

# permission.

1397

# Follows the same format of Binding.members.

1398

"A String",

1399

],

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1400

"logType": "A String", # The log type that this config enables.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1401

},

1402

],

1403

"service": "A String", # Specifies a service that will be enabled for audit logging.

1404

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

1405

# `allServices` is a special value that covers all services.

1406

},

1407

],

1408

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1409

# `condition` that determines how and when the `bindings` are applied. Each

1410

# of the `bindings` must contain at least one member.

1411

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1412

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

1413

#

1414

# If the condition evaluates to `true`, then this binding applies to the

1415

# current request.

1416

#

1417

# If the condition evaluates to `false`, then this binding does not apply to

1418

# the current request. However, a different role binding might grant the same

1419

# role to one or more of the members in this binding.

1420

#

1421

# To learn which resources support conditions in their IAM policies, see the

1422

# [IAM

1423

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

1424

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

1425

# are documented at https://github.com/google/cel-spec.

1426

#

1427

# Example (Comparison):

1428

#

1429

# title: "Summary size limit"

1430

# description: "Determines if a summary is less than 100 chars"

1431

# expression: "document.summary.size() < 100"

1432

#

1433

# Example (Equality):

1434

#

1435

# title: "Requestor is owner"

1436

# description: "Determines if requestor is the document owner"

1437

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

1442

# description: "Determine whether the document should be publicly visible"

1443

# expression: "document.type != 'private' && document.type != 'internal'"

1444

#

1445

# Example (Data Manipulation):

1446

#

1447

# title: "Notification string"

1448

# description: "Create a notification string with a timestamp."

1449

# expression: "'New message received at ' + string(document.create_time)"

1450

#

1451

# The exact variables and functions that may be referenced within an expression

1452

# are determined by the service that evaluates it. See the service

1453

# documentation for additional information.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1454

"expression": "A String", # Textual representation of an expression in Common Expression Language

1455

# syntax.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1456

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

1457

# its purpose. This can be used e.g. in UIs which allow to enter the

1458

# expression.

1459

"location": "A String", # Optional. String indicating the location of the expression for error

1460

# reporting, e.g. a file name and a position in the file.

1461

"description": "A String", # Optional. Description of the expression. This is a longer text which

1462

# describes the expression, e.g. when hovered over it in a UI.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1463

},

1464

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1465

# `members` can have the following values:

1466

#

1467

# * `allUsers`: A special identifier that represents anyone who is

1468

# on the internet; with or without a Google account.

1469

#

1470

# * `allAuthenticatedUsers`: A special identifier that represents anyone

1471

# who is authenticated with a Google account or a service account.

1472

#

1473

# * `user:{emailid}`: An email address that represents a specific Google

1474

# account. For example, `alice@example.com` .

1475

#

1476

#

1477

# * `serviceAccount:{emailid}`: An email address that represents a service

1478

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

1479

#

1480

# * `group:{emailid}`: An email address that represents a Google group.

1481

# For example, `admins@example.com`.

1482

#

1483

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

1484

# identifier) representing a user that has been recently deleted. For

1485

# example, `alice@example.com?uid=123456789012345678901`. If the user is

1486

# recovered, this value reverts to `user:{emailid}` and the recovered user

1487

# retains the role in the binding.

1488

#

1489

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

1490

# unique identifier) representing a service account that has been recently

1491

# deleted. For example,

1492

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

1493

# If the service account is undeleted, this value reverts to

1494

# `serviceAccount:{emailid}` and the undeleted service account retains the

1495

# role in the binding.

1496

#

1497

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

1498

# identifier) representing a Google group that has been recently

1499

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

1500

# the group is recovered, this value reverts to `group:{emailid}` and the

1501

# recovered group retains the role in the binding.

1502

#

1503

#

1504

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

1505

# users of that domain. For example, `google.com` or `example.com`.

1506

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1507

"A String",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1508

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1509

"role": "A String", # Role that is assigned to `members`.

1510

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1511

},

1512

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1517

<code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1518

<pre>Returns permissions that a caller has on the specified resource.

1519

If the resource does not exist, this will return an empty set of

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1520

permissions, not a `NOT_FOUND` error.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1521

1522

Note: This operation is designed to be used for building permission-aware

1523

UIs and command-line tools, not for authorization checking. This operation

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1524

may "fail open" without warning.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1525

1526

Args:

1527

resource: string, REQUIRED: The resource for which the policy detail is being requested.

1528

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1529

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1530

The object takes the form of:

1531

1532

{ # Request message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1533

"permissions": [ # The set of permissions to check for the `resource`. Permissions with

1534

# wildcards (such as '*' or 'storage.*') are not allowed. For more

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1535

# information see

1536

# [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1537

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

],

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1548

1549

{ # Response message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1550

"permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1551

# allowed.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1552

"A String",

Bu Sun Kim