Gitiles
Code Review Sign In
gerrit-public.fairphone.software / platform / external / python / google-api-python-client / f80be181200f4aae910badec3f4bddea08ae5044 / . / docs / dyn / iap_v1beta1.v1beta1.html
blob: e63fdc6c12ea5011c3653daf7298feb8a153d888 [file] [log] [blame]
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1<html><body>
2<style>
3
4body, h1, h2, h3, div, span, p, pre, a {
5 margin: 0;
6 padding: 0;
7 border: 0;
8 font-weight: inherit;
9 font-style: inherit;
10 font-size: 100%;
11 font-family: inherit;
12 vertical-align: baseline;
13}
14
15body {
16 font-size: 13px;
17 padding: 1em;
18}
19
20h1 {
21 font-size: 26px;
22 margin-bottom: 1em;
23}
24
25h2 {
26 font-size: 24px;
27 margin-bottom: 1em;
28}
29
30h3 {
31 font-size: 20px;
32 margin-bottom: 1em;
33 margin-top: 1em;
34}
35
36pre, code {
37 line-height: 1.5;
38 font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
39}
40
41pre {
42 margin-top: 0.5em;
43}
44
45h1, h2, h3, p {
46 font-family: Arial, sans serif;
47}
48
49h1, h2, h3 {
50 border-bottom: solid #CCC 1px;
51}
52
53.toc_element {
54 margin-top: 0.5em;
55}
56
57.firstline {
58 margin-left: 2 em;
59}
60
61.method {
62 margin-top: 1em;
63 border: solid 1px #CCC;
64 padding: 1em;
65 background: #EEE;
66}
67
68.details {
69 font-weight: bold;
70 font-size: 14px;
71}
72
73</style>
74
75<h1><a href="iap_v1beta1.html">Cloud Identity-Aware Proxy API</a> . <a href="iap_v1beta1.v1beta1.html">v1beta1</a></h1>
76<h2>Instance Methods</h2>
77<p class="toc_element">
78 <code><a href="#getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
79<p class="firstline">Gets the access control policy for an Identity-Aware Proxy protected</p>
80<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]81 <code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]82<p class="firstline">Sets the access control policy for an Identity-Aware Proxy protected</p>
83<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]84 <code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]85<p class="firstline">Returns permissions that a caller has on the Identity-Aware Proxy protected</p>
86<h3>Method Details</h3>
87<div class="method">
88 <code class="details" id="getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</code>
89 <pre>Gets the access control policy for an Identity-Aware Proxy protected
90resource.
91More information about managing access via IAP can be found at:
92https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
93
94Args:
95 resource: string, REQUIRED: The resource for which the policy is being requested.
96See the operation documentation for the appropriate value for this field. (required)
97 body: object, The request body.
98 The object takes the form of:
99
100{ # Request message for `GetIamPolicy` method.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]101 "options": { # Encapsulates settings provided to GetIamPolicy. # OPTIONAL: A `GetPolicyOptions` object for specifying options to
102 # `GetIamPolicy`. This field is only used by Cloud IAM.
103 "requestedPolicyVersion": 42, # Optional. The policy format version to be returned.
104 #
105 # Valid values are 0, 1, and 3. Requests specifying an invalid value will be
106 # rejected.
107 #
108 # Requests for policies with any conditional bindings must specify version 3.
109 # Policies without any conditional bindings may specify any valid value or
110 # leave the field unset.
111 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]112 }
113
114 x__xgafv: string, V1 error format.
115 Allowed values
116 1 - v1 error format
117 2 - v2 error format
118
119Returns:
120 An object of the form:
121
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]122 { # An Identity and Access Management (IAM) policy, which specifies access
123 # controls for Google Cloud resources.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]124 #
125 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]126 # A `Policy` is a collection of `bindings`. A `binding` binds one or more
127 # `members` to a single `role`. Members can be user accounts, service accounts,
128 # Google groups, and domains (such as G Suite). A `role` is a named list of
129 # permissions; each `role` can be an IAM predefined role or a user-created
130 # custom role.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]131 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]132 # Optionally, a `binding` can specify a `condition`, which is a logical
133 # expression that allows access to a resource only if the expression evaluates
134 # to `true`. A condition can add constraints based on attributes of the
135 # request, the resource, or both.
136 #
137 # **JSON example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]138 #
139 # {
140 # "bindings": [
141 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]142 # "role": "roles/resourcemanager.organizationAdmin",
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]143 # "members": [
144 # "user:mike@example.com",
145 # "group:admins@example.com",
146 # "domain:google.com",
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]147 # "serviceAccount:my-project-id@appspot.gserviceaccount.com"
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]148 # ]
149 # },
150 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]151 # "role": "roles/resourcemanager.organizationViewer",
152 # "members": ["user:eve@example.com"],
153 # "condition": {
154 # "title": "expirable access",
155 # "description": "Does not grant access after Sep 2020",
156 # "expression": "request.time &lt; timestamp('2020-10-01T00:00:00.000Z')",
157 # }
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]158 # }
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]159 # ],
160 # "etag": "BwWWja0YfJA=",
161 # "version": 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]162 # }
163 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]164 # **YAML example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]165 #
166 # bindings:
167 # - members:
168 # - user:mike@example.com
169 # - group:admins@example.com
170 # - domain:google.com
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]171 # - serviceAccount:my-project-id@appspot.gserviceaccount.com
172 # role: roles/resourcemanager.organizationAdmin
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]173 # - members:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]174 # - user:eve@example.com
175 # role: roles/resourcemanager.organizationViewer
176 # condition:
177 # title: expirable access
178 # description: Does not grant access after Sep 2020
179 # expression: request.time &lt; timestamp('2020-10-01T00:00:00.000Z')
180 # - etag: BwWWja0YfJA=
181 # - version: 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]182 #
183 # For a description of IAM and its features, see the
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]184 # [IAM documentation](https://cloud.google.com/iam/docs/).
185 "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a
186 # `condition` that determines how and when the `bindings` are applied. Each
187 # of the `bindings` must contain at least one member.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]188 { # Associates `members` with a `role`.
189 "role": "A String", # Role that is assigned to `members`.
190 # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
191 "members": [ # Specifies the identities requesting access for a Cloud Platform resource.
192 # `members` can have the following values:
193 #
194 # * `allUsers`: A special identifier that represents anyone who is
195 # on the internet; with or without a Google account.
196 #
197 # * `allAuthenticatedUsers`: A special identifier that represents anyone
198 # who is authenticated with a Google account or a service account.
199 #
200 # * `user:{emailid}`: An email address that represents a specific Google
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]201 # account. For example, `alice@example.com` .
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]202 #
203 #
204 # * `serviceAccount:{emailid}`: An email address that represents a service
205 # account. For example, `my-other-app@appspot.gserviceaccount.com`.
206 #
207 # * `group:{emailid}`: An email address that represents a Google group.
208 # For example, `admins@example.com`.
209 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]210 # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
211 # identifier) representing a user that has been recently deleted. For
212 # example, `alice@example.com?uid=123456789012345678901`. If the user is
213 # recovered, this value reverts to `user:{emailid}` and the recovered user
214 # retains the role in the binding.
215 #
216 # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
217 # unique identifier) representing a service account that has been recently
218 # deleted. For example,
219 # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
220 # If the service account is undeleted, this value reverts to
221 # `serviceAccount:{emailid}` and the undeleted service account retains the
222 # role in the binding.
223 #
224 # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
225 # identifier) representing a Google group that has been recently
226 # deleted. For example, `admins@example.com?uid=123456789012345678901`. If
227 # the group is recovered, this value reverts to `group:{emailid}` and the
228 # recovered group retains the role in the binding.
229 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]230 #
231 # * `domain:{domain}`: The G Suite domain (primary) that represents all the
232 # users of that domain. For example, `google.com` or `example.com`.
233 #
234 "A String",
235 ],
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]236 "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]237 # NOTE: An unsatisfied condition will not allow user access via current
238 # binding. Different bindings, including their conditions, are examined
239 # independently.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]240 # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
241 # are documented at https://github.com/google/cel-spec.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]242 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]243 # Example (Comparison):
244 #
245 # title: "Summary size limit"
246 # description: "Determines if a summary is less than 100 chars"
247 # expression: "document.summary.size() &lt; 100"
248 #
249 # Example (Equality):
250 #
251 # title: "Requestor is owner"
252 # description: "Determines if requestor is the document owner"
253 # expression: "document.owner == request.auth.claims.email"
254 #
255 # Example (Logic):
256 #
257 # title: "Public documents"
258 # description: "Determine whether the document should be publicly visible"
259 # expression: "document.type != 'private' &amp;&amp; document.type != 'internal'"
260 #
261 # Example (Data Manipulation):
262 #
263 # title: "Notification string"
264 # description: "Create a notification string with a timestamp."
265 # expression: "'New message received at ' + string(document.create_time)"
266 #
267 # The exact variables and functions that may be referenced within an expression
268 # are determined by the service that evaluates it. See the service
269 # documentation for additional information.
270 "description": "A String", # Optional. Description of the expression. This is a longer text which
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]271 # describes the expression, e.g. when hovered over it in a UI.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]272 "expression": "A String", # Textual representation of an expression in Common Expression Language
273 # syntax.
274 "location": "A String", # Optional. String indicating the location of the expression for error
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]275 # reporting, e.g. a file name and a position in the file.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]276 "title": "A String", # Optional. Title for the expression, i.e. a short string describing
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]277 # its purpose. This can be used e.g. in UIs which allow to enter the
278 # expression.
279 },
280 },
281 ],
282 "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help
283 # prevent simultaneous updates of a policy from overwriting each other.
284 # It is strongly suggested that systems make use of the `etag` in the
285 # read-modify-write cycle to perform policy updates in order to avoid race
286 # conditions: An `etag` is returned in the response to `getIamPolicy`, and
287 # systems are expected to put that etag in the request to `setIamPolicy` to
288 # ensure that their change will be applied to the same version of the policy.
289 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]290 # **Important:** If you use IAM Conditions, you must include the `etag` field
291 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
292 # you to overwrite a version `3` policy with a version `1` policy, and all of
293 # the conditions in the version `3` policy are lost.
294 "version": 42, # Specifies the format of the policy.
295 #
296 # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
297 # are rejected.
298 #
299 # Any operation that affects conditional role bindings must specify version
300 # `3`. This requirement applies to the following operations:
301 #
302 # * Getting a policy that includes a conditional role binding
303 # * Adding a conditional role binding to a policy
304 # * Changing a conditional role binding in a policy
305 # * Removing any role binding, with or without a condition, from a policy
306 # that includes conditions
307 #
308 # **Important:** If you use IAM Conditions, you must include the `etag` field
309 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
310 # you to overwrite a version `3` policy with a version `1` policy, and all of
311 # the conditions in the version `3` policy are lost.
312 #
313 # If a policy does not include any conditions, operations on that policy may
314 # specify any valid version or leave the field unset.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]315 }</pre>
316</div>
317
318<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]319 <code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]320 <pre>Sets the access control policy for an Identity-Aware Proxy protected
321resource. Replaces any existing policy.
322More information about managing access via IAP can be found at:
323https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
324
325Args:
326 resource: string, REQUIRED: The resource for which the policy is being specified.
327See the operation documentation for the appropriate value for this field. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]328 body: object, The request body.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]329 The object takes the form of:
330
331{ # Request message for `SetIamPolicy` method.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]332 "policy": { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the `resource`. The size of
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]333 # the policy is limited to a few 10s of KB. An empty policy is a
334 # valid policy but certain Cloud Platform services (such as Projects)
335 # might reject them.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]336 # controls for Google Cloud resources.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]337 #
338 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]339 # A `Policy` is a collection of `bindings`. A `binding` binds one or more
340 # `members` to a single `role`. Members can be user accounts, service accounts,
341 # Google groups, and domains (such as G Suite). A `role` is a named list of
342 # permissions; each `role` can be an IAM predefined role or a user-created
343 # custom role.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]344 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]345 # Optionally, a `binding` can specify a `condition`, which is a logical
346 # expression that allows access to a resource only if the expression evaluates
347 # to `true`. A condition can add constraints based on attributes of the
348 # request, the resource, or both.
349 #
350 # **JSON example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]351 #
352 # {
353 # "bindings": [
354 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]355 # "role": "roles/resourcemanager.organizationAdmin",
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]356 # "members": [
357 # "user:mike@example.com",
358 # "group:admins@example.com",
359 # "domain:google.com",
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]360 # "serviceAccount:my-project-id@appspot.gserviceaccount.com"
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]361 # ]
362 # },
363 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]364 # "role": "roles/resourcemanager.organizationViewer",
365 # "members": ["user:eve@example.com"],
366 # "condition": {
367 # "title": "expirable access",
368 # "description": "Does not grant access after Sep 2020",
369 # "expression": "request.time &lt; timestamp('2020-10-01T00:00:00.000Z')",
370 # }
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]371 # }
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]372 # ],
373 # "etag": "BwWWja0YfJA=",
374 # "version": 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]375 # }
376 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]377 # **YAML example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]378 #
379 # bindings:
380 # - members:
381 # - user:mike@example.com
382 # - group:admins@example.com
383 # - domain:google.com
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]384 # - serviceAccount:my-project-id@appspot.gserviceaccount.com
385 # role: roles/resourcemanager.organizationAdmin
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]386 # - members:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]387 # - user:eve@example.com
388 # role: roles/resourcemanager.organizationViewer
389 # condition:
390 # title: expirable access
391 # description: Does not grant access after Sep 2020
392 # expression: request.time &lt; timestamp('2020-10-01T00:00:00.000Z')
393 # - etag: BwWWja0YfJA=
394 # - version: 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]395 #
396 # For a description of IAM and its features, see the
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]397 # [IAM documentation](https://cloud.google.com/iam/docs/).
398 "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a
399 # `condition` that determines how and when the `bindings` are applied. Each
400 # of the `bindings` must contain at least one member.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]401 { # Associates `members` with a `role`.
402 "role": "A String", # Role that is assigned to `members`.
403 # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
404 "members": [ # Specifies the identities requesting access for a Cloud Platform resource.
405 # `members` can have the following values:
406 #
407 # * `allUsers`: A special identifier that represents anyone who is
408 # on the internet; with or without a Google account.
409 #
410 # * `allAuthenticatedUsers`: A special identifier that represents anyone
411 # who is authenticated with a Google account or a service account.
412 #
413 # * `user:{emailid}`: An email address that represents a specific Google
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]414 # account. For example, `alice@example.com` .
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]415 #
416 #
417 # * `serviceAccount:{emailid}`: An email address that represents a service
418 # account. For example, `my-other-app@appspot.gserviceaccount.com`.
419 #
420 # * `group:{emailid}`: An email address that represents a Google group.
421 # For example, `admins@example.com`.
422 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]423 # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
424 # identifier) representing a user that has been recently deleted. For
425 # example, `alice@example.com?uid=123456789012345678901`. If the user is
426 # recovered, this value reverts to `user:{emailid}` and the recovered user
427 # retains the role in the binding.
428 #
429 # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
430 # unique identifier) representing a service account that has been recently
431 # deleted. For example,
432 # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
433 # If the service account is undeleted, this value reverts to
434 # `serviceAccount:{emailid}` and the undeleted service account retains the
435 # role in the binding.
436 #
437 # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
438 # identifier) representing a Google group that has been recently
439 # deleted. For example, `admins@example.com?uid=123456789012345678901`. If
440 # the group is recovered, this value reverts to `group:{emailid}` and the
441 # recovered group retains the role in the binding.
442 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]443 #
444 # * `domain:{domain}`: The G Suite domain (primary) that represents all the
445 # users of that domain. For example, `google.com` or `example.com`.
446 #
447 "A String",
448 ],
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]449 "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]450 # NOTE: An unsatisfied condition will not allow user access via current
451 # binding. Different bindings, including their conditions, are examined
452 # independently.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]453 # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
454 # are documented at https://github.com/google/cel-spec.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]455 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]456 # Example (Comparison):
457 #
458 # title: "Summary size limit"
459 # description: "Determines if a summary is less than 100 chars"
460 # expression: "document.summary.size() &lt; 100"
461 #
462 # Example (Equality):
463 #
464 # title: "Requestor is owner"
465 # description: "Determines if requestor is the document owner"
466 # expression: "document.owner == request.auth.claims.email"
467 #
468 # Example (Logic):
469 #
470 # title: "Public documents"
471 # description: "Determine whether the document should be publicly visible"
472 # expression: "document.type != 'private' &amp;&amp; document.type != 'internal'"
473 #
474 # Example (Data Manipulation):
475 #
476 # title: "Notification string"
477 # description: "Create a notification string with a timestamp."
478 # expression: "'New message received at ' + string(document.create_time)"
479 #
480 # The exact variables and functions that may be referenced within an expression
481 # are determined by the service that evaluates it. See the service
482 # documentation for additional information.
483 "description": "A String", # Optional. Description of the expression. This is a longer text which
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]484 # describes the expression, e.g. when hovered over it in a UI.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]485 "expression": "A String", # Textual representation of an expression in Common Expression Language
486 # syntax.
487 "location": "A String", # Optional. String indicating the location of the expression for error
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]488 # reporting, e.g. a file name and a position in the file.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]489 "title": "A String", # Optional. Title for the expression, i.e. a short string describing
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]490 # its purpose. This can be used e.g. in UIs which allow to enter the
491 # expression.
492 },
493 },
494 ],
495 "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help
496 # prevent simultaneous updates of a policy from overwriting each other.
497 # It is strongly suggested that systems make use of the `etag` in the
498 # read-modify-write cycle to perform policy updates in order to avoid race
499 # conditions: An `etag` is returned in the response to `getIamPolicy`, and
500 # systems are expected to put that etag in the request to `setIamPolicy` to
501 # ensure that their change will be applied to the same version of the policy.
502 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]503 # **Important:** If you use IAM Conditions, you must include the `etag` field
504 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
505 # you to overwrite a version `3` policy with a version `1` policy, and all of
506 # the conditions in the version `3` policy are lost.
507 "version": 42, # Specifies the format of the policy.
508 #
509 # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
510 # are rejected.
511 #
512 # Any operation that affects conditional role bindings must specify version
513 # `3`. This requirement applies to the following operations:
514 #
515 # * Getting a policy that includes a conditional role binding
516 # * Adding a conditional role binding to a policy
517 # * Changing a conditional role binding in a policy
518 # * Removing any role binding, with or without a condition, from a policy
519 # that includes conditions
520 #
521 # **Important:** If you use IAM Conditions, you must include the `etag` field
522 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
523 # you to overwrite a version `3` policy with a version `1` policy, and all of
524 # the conditions in the version `3` policy are lost.
525 #
526 # If a policy does not include any conditions, operations on that policy may
527 # specify any valid version or leave the field unset.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]528 },
529 }
530
531 x__xgafv: string, V1 error format.
532 Allowed values
533 1 - v1 error format
534 2 - v2 error format
535
536Returns:
537 An object of the form:
538
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]539 { # An Identity and Access Management (IAM) policy, which specifies access
540 # controls for Google Cloud resources.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]541 #
542 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]543 # A `Policy` is a collection of `bindings`. A `binding` binds one or more
544 # `members` to a single `role`. Members can be user accounts, service accounts,
545 # Google groups, and domains (such as G Suite). A `role` is a named list of
546 # permissions; each `role` can be an IAM predefined role or a user-created
547 # custom role.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]548 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]549 # Optionally, a `binding` can specify a `condition`, which is a logical
550 # expression that allows access to a resource only if the expression evaluates
551 # to `true`. A condition can add constraints based on attributes of the
552 # request, the resource, or both.
553 #
554 # **JSON example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]555 #
556 # {
557 # "bindings": [
558 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]559 # "role": "roles/resourcemanager.organizationAdmin",
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]560 # "members": [
561 # "user:mike@example.com",
562 # "group:admins@example.com",
563 # "domain:google.com",
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]564 # "serviceAccount:my-project-id@appspot.gserviceaccount.com"
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]565 # ]
566 # },
567 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]568 # "role": "roles/resourcemanager.organizationViewer",
569 # "members": ["user:eve@example.com"],
570 # "condition": {
571 # "title": "expirable access",
572 # "description": "Does not grant access after Sep 2020",
573 # "expression": "request.time &lt; timestamp('2020-10-01T00:00:00.000Z')",
574 # }
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]575 # }
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]576 # ],
577 # "etag": "BwWWja0YfJA=",
578 # "version": 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]579 # }
580 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]581 # **YAML example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]582 #
583 # bindings:
584 # - members:
585 # - user:mike@example.com
586 # - group:admins@example.com
587 # - domain:google.com
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]588 # - serviceAccount:my-project-id@appspot.gserviceaccount.com
589 # role: roles/resourcemanager.organizationAdmin
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]590 # - members:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]591 # - user:eve@example.com
592 # role: roles/resourcemanager.organizationViewer
593 # condition:
594 # title: expirable access
595 # description: Does not grant access after Sep 2020
596 # expression: request.time &lt; timestamp('2020-10-01T00:00:00.000Z')
597 # - etag: BwWWja0YfJA=
598 # - version: 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]599 #
600 # For a description of IAM and its features, see the
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]601 # [IAM documentation](https://cloud.google.com/iam/docs/).
602 "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a
603 # `condition` that determines how and when the `bindings` are applied. Each
604 # of the `bindings` must contain at least one member.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]605 { # Associates `members` with a `role`.
606 "role": "A String", # Role that is assigned to `members`.
607 # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
608 "members": [ # Specifies the identities requesting access for a Cloud Platform resource.
609 # `members` can have the following values:
610 #
611 # * `allUsers`: A special identifier that represents anyone who is
612 # on the internet; with or without a Google account.
613 #
614 # * `allAuthenticatedUsers`: A special identifier that represents anyone
615 # who is authenticated with a Google account or a service account.
616 #
617 # * `user:{emailid}`: An email address that represents a specific Google
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]618 # account. For example, `alice@example.com` .
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]619 #
620 #
621 # * `serviceAccount:{emailid}`: An email address that represents a service
622 # account. For example, `my-other-app@appspot.gserviceaccount.com`.
623 #
624 # * `group:{emailid}`: An email address that represents a Google group.
625 # For example, `admins@example.com`.
626 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]627 # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
628 # identifier) representing a user that has been recently deleted. For
629 # example, `alice@example.com?uid=123456789012345678901`. If the user is
630 # recovered, this value reverts to `user:{emailid}` and the recovered user
631 # retains the role in the binding.
632 #
633 # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
634 # unique identifier) representing a service account that has been recently
635 # deleted. For example,
636 # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
637 # If the service account is undeleted, this value reverts to
638 # `serviceAccount:{emailid}` and the undeleted service account retains the
639 # role in the binding.
640 #
641 # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
642 # identifier) representing a Google group that has been recently
643 # deleted. For example, `admins@example.com?uid=123456789012345678901`. If
644 # the group is recovered, this value reverts to `group:{emailid}` and the
645 # recovered group retains the role in the binding.
646 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]647 #
648 # * `domain:{domain}`: The G Suite domain (primary) that represents all the
649 # users of that domain. For example, `google.com` or `example.com`.
650 #
651 "A String",
652 ],
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]653 "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]654 # NOTE: An unsatisfied condition will not allow user access via current
655 # binding. Different bindings, including their conditions, are examined
656 # independently.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]657 # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
658 # are documented at https://github.com/google/cel-spec.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]659 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]660 # Example (Comparison):
661 #
662 # title: "Summary size limit"
663 # description: "Determines if a summary is less than 100 chars"
664 # expression: "document.summary.size() &lt; 100"
665 #
666 # Example (Equality):
667 #
668 # title: "Requestor is owner"
669 # description: "Determines if requestor is the document owner"
670 # expression: "document.owner == request.auth.claims.email"
671 #
672 # Example (Logic):
673 #
674 # title: "Public documents"
675 # description: "Determine whether the document should be publicly visible"
676 # expression: "document.type != 'private' &amp;&amp; document.type != 'internal'"
677 #
678 # Example (Data Manipulation):
679 #
680 # title: "Notification string"
681 # description: "Create a notification string with a timestamp."
682 # expression: "'New message received at ' + string(document.create_time)"
683 #
684 # The exact variables and functions that may be referenced within an expression
685 # are determined by the service that evaluates it. See the service
686 # documentation for additional information.
687 "description": "A String", # Optional. Description of the expression. This is a longer text which
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]688 # describes the expression, e.g. when hovered over it in a UI.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]689 "expression": "A String", # Textual representation of an expression in Common Expression Language
690 # syntax.
691 "location": "A String", # Optional. String indicating the location of the expression for error
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]692 # reporting, e.g. a file name and a position in the file.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]693 "title": "A String", # Optional. Title for the expression, i.e. a short string describing
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]694 # its purpose. This can be used e.g. in UIs which allow to enter the
695 # expression.
696 },
697 },
698 ],
699 "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help
700 # prevent simultaneous updates of a policy from overwriting each other.
701 # It is strongly suggested that systems make use of the `etag` in the
702 # read-modify-write cycle to perform policy updates in order to avoid race
703 # conditions: An `etag` is returned in the response to `getIamPolicy`, and
704 # systems are expected to put that etag in the request to `setIamPolicy` to
705 # ensure that their change will be applied to the same version of the policy.
706 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]707 # **Important:** If you use IAM Conditions, you must include the `etag` field
708 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
709 # you to overwrite a version `3` policy with a version `1` policy, and all of
710 # the conditions in the version `3` policy are lost.
711 "version": 42, # Specifies the format of the policy.
712 #
713 # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
714 # are rejected.
715 #
716 # Any operation that affects conditional role bindings must specify version
717 # `3`. This requirement applies to the following operations:
718 #
719 # * Getting a policy that includes a conditional role binding
720 # * Adding a conditional role binding to a policy
721 # * Changing a conditional role binding in a policy
722 # * Removing any role binding, with or without a condition, from a policy
723 # that includes conditions
724 #
725 # **Important:** If you use IAM Conditions, you must include the `etag` field
726 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
727 # you to overwrite a version `3` policy with a version `1` policy, and all of
728 # the conditions in the version `3` policy are lost.
729 #
730 # If a policy does not include any conditions, operations on that policy may
731 # specify any valid version or leave the field unset.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]732 }</pre>
733</div>
734
735<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]736 <code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]737 <pre>Returns permissions that a caller has on the Identity-Aware Proxy protected
738resource. If the resource does not exist or the caller does not have
739Identity-Aware Proxy permissions a [google.rpc.Code.PERMISSION_DENIED]
740will be returned.
741More information about managing access via IAP can be found at:
742https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
743
744Args:
745 resource: string, REQUIRED: The resource for which the policy detail is being requested.
746See the operation documentation for the appropriate value for this field. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]747 body: object, The request body.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]748 The object takes the form of:
749
750{ # Request message for `TestIamPermissions` method.
751 "permissions": [ # The set of permissions to check for the `resource`. Permissions with
752 # wildcards (such as '*' or 'storage.*') are not allowed. For more
753 # information see
754 # [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
755 "A String",
756 ],
757 }
758
759 x__xgafv: string, V1 error format.
760 Allowed values
761 1 - v1 error format
762 2 - v2 error format
763
764Returns:
765 An object of the form:
766
767 { # Response message for `TestIamPermissions` method.
768 "permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is
769 # allowed.
770 "A String",
771 ],
772 }</pre>
773</div>
774
775</body></html>